Undetected cerber3 in ammyy setup

[askmark]

Thats a very good point and No i too have that option disabled, I would suspect any advanced user
would know to disable that, a novice user may not know. Thanks for asking

Your'e right an advanced user should know - but there are so many options in the interface that aren't important, this one doesn't stand out. Personally, I think it should be disabled by default.

 

[_CyberGhosT_]

Your'e right an advanced user should know - but there are so many options in the interface that aren't important, this one doesn't stand out. Personally, I think it should be disabled by default.

Yep, and displayed on the first page of settings, not hidden in advanced.

 

[askmark]

Yep, and displayed on the first page of settings, not hidden in advanced.

Agreed

Sorry, mods for turning this into a Voodooshield thread

 

[cruelsister]

This is really an important post as so many think that ransomware is primarily served up by exploits on infected web pages or via an email attachment. But as can be seen here, obviously the Ammyy site suffered a breach no doubt through the Admin FTP credentials being hacked. Once that is done it is easy to delete an existing file and upload an infected one. Stolen FTP credentials have been an ongoing issue- Secunia had a really good paper on this about 10 years ago (I lost the reference), and Bluecoat also highlighted this topic here: A Treasure Trove of FTP Logins | Blue Coat

Note that in this case neither the main exe nor the dropped Cerber were signed. Using something like CF would have alerted to this by auto-sandboxing both the original application as well as the spawn. And you really can't count on any traditional AV to protect in case the ransomware that is dropped is true zero-day; evidence of this can be seen in the ESET video from last weekend, and I guess I should address BitDefender next.

ps- the fools at Ammyy STILL have the infected file active to be downloaded.

 

[shmu26]

the VT results make it sound like it is a legit remote control software that is unknown and is just being generically analysed. They aren't calling it ransomware or high-risk malware of some type.

The real give-away IMO is that the product version is not new, and the company is known. So VT should have cleared away most of the FPs by now, if it was legit.

 

[shmu26]

an anti-exe program would not protect against this kind of attack. Since you downloaded it from the official site, you would trust it and run it.
You need anti exploit/behavior blocker for this kind of thing.

Kaspersky 2017 blocked it, even with file anti-virus and web anti-virus turned off.
first I was warned that it is a remote control soft, and I said okay, and then a few seconds later, it was deleted due to suspicious behavior. tested in Shadow Defender.

+1 for behavior blocking

 

[Guillaume Durand]

This is a hard subject, but I agree the site looks dated and unsafe, I myself would not download from there, seeing what this tool is for, I would be hyper alert too.
I have had cause to use TeamViewer on occasion and even that software once I am done is removed from my system.
Reguardless of the protection software employed, this is where an experienced eye and common sense are as equally important
as a solid config, weather your a home or business user. I am very surprised an experienced user would download from that site.
Great share all.
PeAcE

Here the problem is that the site has always been like that. Perhaps a new user would think it suspect, but someone accustomed to it (which is my case) wouldn't have any suspicion. And even so, it is a tool that we ask our customers to install when we want to do remote support, and they usually have no clue about computers and will run the exe anyway. "Fortunately" I was infected before we could ask another customer to install it. I can't imagine the consequences of a customer losing all its data because of us.
I hope this post and the submissions I made to the antivirus companies will prevent this kind of propagation.

 

[shmu26]

Here the problem is that the site has always been like that. Perhaps a new user would think it suspect, but someone accustomed to it (which is my case) wouldn't have any suspicion. And even so, it is a tool that we ask our customers to install when we want to do remote support, and they usually have no clue about computers and will run the exe anyway. "Fortunately" I was infected before we could ask another customer to install it. I can't imagine the consequences of a customer losing all its data because of us.
I hope this post and the submissions I made to the antivirus companies will prevent this kind of propagation.

you made a great post, for sure. I am wiser for it.

 

[askmark]

ps- the fools at Ammyy STILL have the infected file active to be downloaded.

If they haven't already, someone needs to tell them to get the infected file off their site, or, if they can't remove it, then shut the site down.

 

[Guillaume Durand]

If they haven't already, someone needs to tell them to get the infected file off their site, or, if they can't remove it, then shut the site down.

I'm in the process of doing that. I opened a support ticket with no effect right now and I'm trying to contact them via their online chat. Someone answered, and I explained. Still waiting for feedback.

 

[askmark]

Here the problem is that the site has always been like that. Perhaps a new user would think it suspect, but someone accustomed to it (which is my case) wouldn't have any suspicion. And even so, it is a tool that we ask our customers to install when we want to do remote support, and they usually have no clue about computers and will run the exe anyway. "Fortunately" I was infected before we could ask another customer to install it. I can't imagine the consequences of a customer losing all its data because of us.
I hope this post and the submissions I made to the antivirus companies will prevent this kind of propagation.

I would suggest you get your customers to install something else in future. Ammyy has been used to scam users for years - just do a search for "ammyy scam".

As a result of this kind of exposure, I wouldn't touch their software with a barge pole!

 

[askmark]

I'm in the process of doing that. I opened a support ticket with no effect right now and I'm trying to contact them via their online chat. Someone answered, and I explained. Still waiting for feedback.

That's the best you can do, the rest is up to them . Many thanks for reporting this here first.

 

[Mohan Rajan]

I would like to report that I was hit by a cerber3 ransomware variant embedded in the currently available ammyy setup. Ammyy is a remote control software, such as VNC or Teamviewer, and their site was visibly hacked recently because their setup was repacked as a virus deployer and it is not detected by most antiviruses. The malicious setup is not detected, but worse still, the deployed viral exe is not either.
Some antiviruses detect the setup as being a RemoteAdmin, but as Ammy is a remote admin tool, you will of course allow the execution, and the setup will deploy and run the virus. Very astute way to ensure the antivirus is bypassed.
Once you launch the setup, the file encrypted.exe is deployed into <local settings>\temp along the legit Ammyy setup and both are executed. Then the ransomware starts encrypting your data.
Now a HIPS soft may help with this, but if the hackers are not too stupid they would name the exe video_helper_driver64.exe or whatever may seem a legit Ammyy companion and then you would allow it to run.
Note that the legit setup is signed by the company and the repacked setup is not.

I submitted the malicious setup to some AV sites, explaining the false detection problem, but they use automated analysis and just report a RemoteAdmin threat, so I'm not sure they'll investigate further to discover how cerber3 can be embedded in there.

The malicious setup, sometimes detected as RemoteAdmin: Antivirus scan for 5b13f477c35822e4ba55dfb3d0d99677e1d50dabc78035970104540255df8ec3 at 2016-09-13 12:54:09 UTC - VirusTotal
The deployed ransomware: https://www.virustotal.com/en/file/...3efa7ec5e6f32ee9e500a7394e3daf7a916/analysis/

As a side note I tried Comodo AV and IS in a VM and only AV warned me about Ammyy being a possible RemoteAdmin threat. I find strange that they don't have the same behaviour, but perhaps it's because I tested on Windows XP and some OS features are not available. Also Avira did not find a thing although the virustotal reports show otherwise.

I went to their web page, clicked on the download button and was taken to a new page where I was asked to enter my email id to download.
I did so and when I clicked to submit, KIS 2017 Web antivirus immediately blocked the data from being sent to their website citing dangerous Web site
So, now I cannot even go to their website , leave alone download the infected app and run it on my system.

I shudder to think what might have happened to my PC had I not had an Internet security app in the first place.

Kudos to Kaspersky.

 

[shmu26]

I went to their web page, clicked on the download button and was taken to a new page where I was asked to enter my email id to download.
I did so and when I clicked to submit, KIS 2017 Web antivirus immediately blocked the data from being sent to their website citing dangerous Web site
So, now I cannot even go to their website , leave alone download the infected app and run it on my system.

I shudder to think what might have happened to my PC had I not had an Internet security app in the first place.

Kudos to Kaspersky.

I disabled kaspersky web protection, and I downloaded the file, and I also disabled kaspersky file antivirus, in case it is already in the data base.
but Kaspersky blocked and deleted the file anyway, because of suspicious behavior.

Besides that, cerber will be stopped by UAC, if you have UAC on highest level.
in such a case, you will get a prompt that file with a random name, signed by Microsoft, wants to run.

 

[Nikos751]

Eset detects the setup downloaded as multiple threats. You can also see the log for details.

 

[askmark]

Eset detects the setup downloaded as multiple threats. You can also see the log for details.
View attachment 115492

That's good to know. Thanks for sharing

 

[Nikos751]

signed by Microsoft

I read it's not signed. how is it signed by Microsoft?

 

[shmu26]

I read it's not signed. how is it signed by Microsoft?

I saw someone post a screenshot of the prompt, and it was signed.
explanation: cerber can hijack several different windows processes, some of which are signed (but not all of them), and it forces them to load a rogue dll. So if it hijacks a signed process, the prompt will say so.

 

[Sumit Verma]

I just paid to them lets see what happens

 

[shmu26]

I just paid to them lets see what happens

for the future: put your user account control on highest setting. then cerber (and most other malware) won't be able to run unless you specifically allow it.

and make system images, kept offline, for backup.