Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious update/malware by a semi-advanced adversary

axelp.io

Post reply on HN
Print view View original

21–30 of 37 posts

Re: Malicious update/malware by a semi-advanced adversary

#21

Post by cm_silva »

blincoln wrote: post #18
CuckooExe wrote: post #2

Small blog post where I detail a malicious update I got served, try to track what it was doing, who sent it, and my mistakes. Would love to hear your thoughts!

I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it. I had to rebuild the MBR. I definitely recommend doing any live testing in a VM on a dedicated testing device. Who knows what sneakier persistence techniques are out there now?

>I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it.

In this case, wouldn't the infection go away by formatting the disk?

Re: Malicious update/malware by a semi-advanced adversary

#22

Post by sandos »

chomp wrote: post #4

Good article, I also would advise running in HyperV or its 3rd party equivalent, having to re-OS is lame, and using your main OS leaves you open to UEFI attacks.

There has been several exploits breaking out of VMs though, no? Can you trust even that...

Re: Malicious update/malware by a semi-advanced adversary

#24

Post by sgarland »

sandos wrote: post #22
chomp wrote: post #4

Good article, I also would advise running in HyperV or its 3rd party equivalent, having to re-OS is lame, and using your main OS leaves you open to UEFI attacks.

There has been several exploits breaking out of VMs though, no? Can you trust even that...

I think most of the attacks are for Type 2 hypervisors, and even then, are fairly rare. I did find this [0] very interesting read on an AMD-specific KVM escape (albeit via nested virtualization, so I'm not sure if that quite counts as a Type 1).

[0]: https://googleprojectzero.blogspot.com/2021/06/an-epyc-escap...

Re: Malicious update/malware by a semi-advanced adversary

#25

Post by CuckooExe »

dannyw wrote: post #15

They probably have logs for manual investigative activity, and took the site down when you kept re-running the payload. Also, please don't execute payloads on your laptop. That seems really stupid.

> Also, please don't execute payloads on your laptop. That seems really stupid.

I would never execute a payload that I didn't manually vet on my computer :) That's why I didn't actually execute the full stage-two, but just pieces of it so it would decode what it was reaching out to. I also replaced the `eval` in the next stage to an `echo` to see what it was doing!

Re: Malicious update/malware by a semi-advanced adversary

#26

Post by CuckooExe »

geocar wrote: post #20
CuckooExe wrote: post #2

Small blog post where I detail a malicious update I got served, try to track what it was doing, who sent it, and my mistakes. Would love to hear your thoughts!

__utma means they were looking for Google Analytics cookies. If you weren't on the landing page after seeing the ad (and just opened the zip file) you wouldn't have these on your test page. Also: $ base64 -d dj01MDY1NDg3MTIwZTU2ZmQ1ZTZlNCZjaWQ9MjY0 v=5065487120e56fd5e6e4&cid=264 cid= is common for campaign identifiers. Might also be "channel". This might not be a CNC system but ad fraud. Using a coffee shop is a grea…

Yeah, when I decoded the B64 params, I did see the `cid` keyword, and briefly thought that this might be just really good adware. However, the following stages were too sophisticated for some person to just serve me an ad.

And I'm not sure if a coffee shop farther outside of Tyson's (not going to ask why you specifically said that area) would've helped. I'm very confident that they tore down their C2 after seeing either a (in their eyes) successful callback, or me badger their server with follow on requests.

Re: Malicious update/malware by a semi-advanced adversary

#27

Post by batch12 »

I've seen this. This is the same basic payload/TTP from the regional news sites that were compromised (via shared scripts hosted by McClatchy and MediaNews) a few years ago (2019). Op needs to hit the site with a new IP and with a 'referer' to get the second stage. There is also some JS fingerprinting, like checking GPU model, to ensure a plausible client visit. This was a fun piece of malware to dissect.

I believe Symantec classified it as SocGholish.

Edited: clarity, details

Re: Malicious update/malware by a semi-advanced adversary

#29

Post by CuckooExe »

bryanrasmussen wrote: post #13
55555 wrote: post #11

Earlier quoted context omitted.

Deletion could be triggered by their systems determining that someone is trying to research their malware/infra.

right, that's what I figured but the phrasing of the article made me think the assumption was otherwise.

Thanks for pointing that out! I'll try to update my phrasing to make it more clear. At the end of the day, I don't have definitive proof of anything, however, I'm fairly confident that it was taken down in response to one of two things: a) the payload was downloaded and executed (technically), or b) I was badgering their domain with requests to re-download it.

If it was a), then this might indicate a more advanced adversary who has the TTPs to support this. If it was b), which hints at something more reactionary, then I'm going to guess the adversary was slightly less advanced.

Lmk if you have more questions!

Re: Malicious update/malware by a semi-advanced adversary

#30

Post by geocar »

CuckooExe wrote: post #26
geocar wrote: post #20

Earlier quoted context omitted.

__utma means they were looking for Google Analytics cookies. If you weren't on the landing page after seeing the ad (and just opened the zip file) you wouldn't have these on your test page. Also: $ base64 -d dj01MDY1NDg3MTIwZTU2ZmQ1ZTZlNCZjaWQ9MjY0 v=5065487120e56fd5e6e4&cid=264 cid= is common for campaign identifiers. Might also be "channel". This might not be a CNC system but ad fraud. Using a coffee shop is a grea…

Yeah, when I decoded the B64 params, I did see the `cid` keyword, and briefly thought that this might be just really good adware. However, the following stages were too sophisticated for some person to just serve me an ad. And I'm not sure if a coffee shop farther outside of Tyson's (not going to ask why you specifically said that area) would've helped. I'm very confident that they tore down their C2 after seeing eit…

> the following stages were too sophisticated for some person to just serve me an ad.

You may not believe me, but this is much less sophisticated than some of the things I have seen; My opinion is that the people who participate in ad fraud are a lot more sophisticated than any of the ad-fraud detection/protection "vendors" working to try and stop it.

To give you an idea of what I mean, "these guys" might not have been trying to show you an ad at all, but to sell your traffic (or normal looking cookies) to someone else who has already sold an ad, but just want something to juice the click-rate or the conversion-rate of some other traffic, and so if you weren't in that market, they won't even serve you the content that performs these steps.

> I'm very confident that they tore down their C2 after seeing either a (in their eyes) successful callback, or me badger their server with follow on requests.

No doubt. Unusual traffic tends to spook them. They will shut everything down, then use google search to look for their domain name in blogs and stuff, and if that doesn't happen, and their "customer" doesn't complain about anything, they will resume the juicing.

Post reply on HN