Malware-Traffic-Analysis.net - 2018-03-30 - Malspam pushing possible Ursnif through batch files

2018-03-30 - MALSPAM PUSHING POSSIBLE URSNIF THROUGH BATCH FILES

NOTICE:

The zip archives on this page have been updated, and they now use the new password scheme. For the new password, see the "about" page of this website.

ASSOCIATED FILES:

Zip archive of the malspam tracker: 2018-03-30-possible-Ursnif-malspam-tracker.csv.zip 1.3 kB (1,272 bytes)
Zip archive of the infection traffic: 2018-03-30-possible-Ursnif-infection-traffic-2-pcaps.zip 12.8 MB (12,726,386 bytes)
Zip archive of the associated emails, malware, and artifacts: 2018-03-30-malspam-and-possible-Ursnif-malsware.zip 3.8 MB (3,810,214 bytes)

NOTES:

In two infections from this malspam, I got two variants of Ursnif.
One sample used HTTP GET and POST requests in the post-infection traffic over TCP port 80
The other sample used tor traffic for the post-infection activity
From what I understand, these are both possibly Ursnif.
The associated PDF files are decoys. They are not malicious, but they may be unique enough, they may an indicator.

Indicators are not a block list. If you feel the need to block web traffic, I suggest the following domains and URLs:

EMAIL INFO:

Shown above: Screen shot from one of the emails.

Date/Time: As early as Wendesday 2018-03-28 at 00:35 UTC through at least Friday 2018-03-30 at 16:17 UTC

Received: from smtpcmd12140.aruba[.]it ([62.149.156[.]140])
Received: from smtpfree-g.aruba[.]it ([62.149.128[.]214])
Received: from smtpcmd02101.aruba[.]it ([62.149.158[.]101])
Received: from smtp204.alice[.]it ([82.57.200[.]100])
Received: from elasmtp-masked.atl.sa.earthlink[.]net ([209.86.89[.]68])
Received: from vmi135137.contaboserver[.]net ([5.189.176[.]126])
Received: from smtpcmd01240.aruba[.]it ([62.149.156[.]170])
Received: from smtpcmd0643.aruba[.]it ([62.149.156[.]43])
Received: from libero[.]it ([213.209.8[.]33])

Shown above: Extracting a batch file from one of the email attachments.

SHA256 HASHES FOR EMAIL ATTACHMENTS (ZIP FILES):

SHA256 HASHES FOR EXTRACTED BATCH FILES:

54d0d0fe45368446e1b86cd7d36dbfbb8e6cb7a476339e84672566d8355d4cde - BX59687039412.bat
bc6ff921b8ae9c754aa7853d6a3949973c2f88023d9df199a5e15e94cbe1e350 - DM485700945.bat
a65cb2ef007beaaf2c00c749d976110c7432370f2c7f91fb9fc25ed36a7f72fd - DR940596994.bat
81821ec46f20e8ed493af7477a818507ccfbba460a5d5c45160660002357c7ca - HT.495-495860491.bat
a72d07a99ce3135a4b49db1f60db8ca0839f03ed94f476a229d79df6a5faf004 - JP.857593048.PDF.bat
87ca438e3ffc5242fc7b669dc4f587ac5467694fc8fd7efa3008ee5a972d73d1 - OF.495093846.bat
99882cc77414dcb0b64fbd2afa77b7cbf4503274067762f19bf793a75e57495d - TF.48678398483.bat
6c570f32c543548f29028a958deeb54a8aaf14aecc72251dc0c601d8a3492df7 - VK678404951.bat
94a405b37fee16f10ff29f0e91b79f2772b8613c9047faaa046667e2edeae46c - VT8675940951.bat

Shown above: Beginning portion from one of the batch files (requests the decoy PDF document).

Shown above: After several line feeds/carriage returns, malicious script starts at the end of the batch file.

Shown above: Here's what it looks like, when run on a Windows 7 host.

Shown above: Traffic from an infection filtered in Wireshark.

Shown above: Traffic from an another infection filtered in Wireshark, several hours later.

DECOY PDF FILES (NOT MALICIOUS):

port 443 (HTTPS) - www.tnt[.]com - GET /dam/tnt_express_media/express-master/downloads/docs/AIR_Transport_SectionII_Lithium_Batteries.pdf
port 80 - www.fedex[.]com - GET /images/fbo_images/Job_aid/GFBO_JobAid.pdf

REQUESTS FOR BASE64 STRING FOR FOLLOW-UP MALWARE:

POST-INFECTION CONNECTIVITY CHECK (2018-03-29):

POST-INFECTION CALLBACK TRAFFIC (2018-03-29):

49.51.138[.]88 port 80 - f11.karilor[.]at - GET /wpapi/[long string of characters]
198.105.244[.]64 port 80 - abn.zitti[.]at - POST /wpapi/[long string of characters]
198.105.244[.]64 port 80 - torafy[.]cn - POST /wpapi/[long string of characters]

POST-INFECTION CALLBACK TRAFFIC (2018-03-30):

MALWARE RETRIEVED FROM AN INFECTED WINDOWS HOST:

SHA256 hash: 02697c7b28b85bc08e2bc35289b7c3a366872cd820b954bc870c3135ca5b65bb
File size: 404,058 bytes
File location: C:\Users\[username]\AppData\Local\Temp\WinHelperKP.cab
File description: Microsoft .cab file (converted from base64 text) from 2018-03-29.

SHA256 hash: 51cfcf85942dc9dddc0bb06aa6af85d37de44e19ca64bac0c643b90a03b40eb5
File size: 543,744 bytes
File location: C:\Users\[username]\AppData\Local\Temp\WinHelperKP.exe
File location: C:\Users\[username]\AppData\Roaming\Microsoft\[random name]\[random name].exe
File description: Malware extracted from the above .cab file on 2018-03-29 (possibly Ursnif)

SHA256 hash: 7c0a62f7cbbcd11db9b50534f1efd088ee934712170fc281d765862986ab0bb4
File size: 549,888 bytes
File location: C:\Users\[username]\AppData\Local\Temp\WinHelperKP.exe
File location: C:\Users\[username]\AppData\Roaming\Microsoft\[random name]\[random name].exe
File description: Possible Ursnif sample from similar infection on 2018-03-30.

Shown above: Malware persistent on an infected Windows host.

Shown above: Scheduled task to periodically update the malware.

Click here to return to the main page.