Notorious Malware named "Gameover" gets itself a kernel-mode rootkit

<div dir="ltr" style="text-align: left;" trbidi="on"> <div dir="rtl" style="text-align: right;"> <a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-right: 1em;"></a><a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-right: 1em;"></a><a href="https://www.blogger.com/blogger.g?blogID=6380879847017191063" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-right: 1em;"></a><span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Zeus, also known as Zbot, is a malware family that we have written about many times on Naked Security. </span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Currently, the most widespread Zbot derivative is the Gameover bot, also known as Zeus P2P because of its use of peer-to-peer network connectivity for command and control.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The Gameover gang has been trying new techniques recently: hot on the heels of code to target logged-in users of cloud-based CRM Salesforce.com comes the introduction of a kernel-mode rootkit.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The code for this rootkit comes from another notorious malware family known as Necurs.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Malware in the Zbot family is built to steal information, primarily login credentials, and it is good at its job. </span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Early Zbot versions employed a user-mode rootkit that would hide the Zbot directory and registry entries from user-land tools. </span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">However, by Version 2 of the malware, this rootkit had been dropped as it was largely ineffective. </span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Instead Zbot began to inject its code into system processes and browsers, hooking important software functions in order to snoop on the data passing through the system.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">In the latest Gameover development, the Necurs rootkit has been added to protect the malware files on disk and in memory, making it harder to find and remove once the malware is active.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">This particular strain of Gameover is being delivered through spam messages containing fake invoices.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The attachments don't contain the malware itself; instead, they contain downloader malware known as Upatre.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Downloaders do exactly what their name suggests: they call home and fetch the latest malware version that the crooks want to distribute.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Fake invoice emails are similarly straightforward but effective: they claim to contain some sort of payment advice for a purchase you know you didn't make; the crooks hope you will open the attachment as the first step in contesting the payment.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">Here is an example message:</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><img height="203" src="http://sophosnews.files.wordpress.com/2014/02/go-email-5001.png?w=500&h=203" width="500" /></span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">In this case the campaign is targeted at French speakers and purports to be from HSBC France.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The Upatre downloader is attached as an EXE file (a Windows program) inside a ZIP file named Avis.de.Paiement.zip.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">If you launch the file, it downloads an unstructured lump of data - known to programmers as a BLOB, short for "binary large object" - which is actually an obfuscated and compressed copy of the Gameover malware:</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;"><img height="381" src="http://sophosnews.files.wordpress.com/2014/02/upatre-500.png?w=500&h=381" width="500" /></span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">The downloader then unscrambles and launches Gameover.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">When it launches, Gameover installs into your Application Data directory, tagging itself with a short block of system-specific binary data.</span></div> <div dir="rtl" style="text-align: right;"> <span style="color: #444444; font-family: Arial, Helvetica, sans-serif;">This "tagging" serves two purposes: the installed copy is tied to your computer, so it won't run anywhere else if it is taken away for analysis; and your copy of the malware is unique, so that simple checksum-based file matching can't be used to detect it.</span></div> <div dir="rtl" style="text-align: right;"> Normally, Gameover then injects itself into other processes and exits. </div> This is where the new variant drops and installs the Necurs rootkit, which is implemented as a kernel driver.<br /> Two drivers - a 32-bit and a 64-bit version - are decrypted using different RC4 keys:<br /> <img height="431" src="http://sophosnews.files.wordpress.com/2014/02/rc4-500.png?w=500&h=431" width="500" /><br /> Then, further shellcode is decrypted and executed to setup and load the appropriate driver.<br /> We can see that the code first checks to see if the Necurs device object NtSecureSys already exists:<br /> <img height="322" src="http://sophosnews.files.wordpress.com/2014/02/kernobj-500.png?w=500&h=322" width="500" /><br /> If it does not, the appropriate driver will be loaded.<br /> If the system is 32-bit and you do not have administrator rights, the malware tries to exploit an aging vulnerability known as CVE-2010-4398 to elevate its privilege so it can load the driver.<br /> The exploit relies on a specially-crafted registry entry and, somewhat curiously, the use of a system function associated with End-User Defined Characters (EUDCs), as seen here:<br /> <img height="420" src="http://sophosnews.files.wordpress.com/2014/02/eudc-500.png?w=500&h=420" width="500" /><br /> If you are patched against this vulnerability, then the loading of the rootkit will trigger a User Account Control (UAC) prompt - an immediately-suspicious side effect, considering that the file you just opened was supposed to be an invoice.<br /> If you are running XP, which doesn't have UAC, and you aren't an administrator, the rootkit can't prompt for permission to load, ironically making you very slightly safer.<br /> The 64-bit driver is digitally signed, but with an unsigned and obviously bogus certificate:<br /> <img height="124" src="http://sophosnews.files.wordpress.com/2014/02/digsig-500.png?w=500&h=124" width="500" /><br /> 64-bit versions of Windows usually insist that drivers are signed with verified certificates, so the malware tries to reconfigure your system so that it will accept unverified drivers.<br /> The malware uses the BCEDIT Boot Configuration Editor utility to set the TESTSIGNING boot option, allowing the malicious driver to be loaded:<br /> <img height="124" src="http://sophosnews.files.wordpress.com/2014/02/bcdedit-500.png?w=500&h=124" width="500" /><br /> Once active, the rootkit protects the Gameover malware so that you can't delete it:<br /> <img height="46" src="http://sophosnews.files.wordpress.com/2014/02/rk-del-500.png?w=500&h=46" width="500" /><br /> It also stops you killing off the Gameover process: <br /> <img height="278" src="http://sophosnews.files.wordpress.com/2014/02/rk-proc-500.png?w=500&h=278" width="500" /><br /> The rookit greatly increases the difficulty of removing the malware from an infected computer, so you are likely to stay infected for longer, and lose more data to the controllers of the Gameover botnet.<br /> What does this apparent collaboration between the Gameover and Necurs gangs mean?<br /> We don't know for sure - perhaps the the two groups are joining forces, or perhaps the Necurs source code has been acquired by the Gameover gang.<br /> Whatever the reason, the addition of the Necurs rootkit to an already-dangerous piece of malware is an unwelcome development. <br /> Gameover is just one of many bots and botnets that are currently at large on the internet.<br /> If you'd like to know more about the what, how and why of these threats, you might like to listen to our Techknow podcast on the subject: <br /> This post was made using the <a href="http://www.webmagnates.org/auto-blogging-software.html" title="auto-blogging software">Auto Blogging Software</a> from <a href="http://www.webmagnates.org/" make="" money="" online="" title="">WebMagnates.org</a> This line will not appear when posts are made after activating the software to full version.</div>

Gameover itself kernelmode Malware named news Notorious rootkit Notorious Malware named "Gameover" gets itself a kernel-mode rootkit

Zeus, also known as Zbot, is a malware family that we have written about many times on Naked Security. Currently, the most widespread Zb...

Read more »