4 ms·

Small blog post where I detail a malicious update I got served, try to track what it was doing, who sent it, and my mistakes. Would love to hear your thoughts!

3np 4y ago
If not be so quick to jump on conclusions that the distributing sites and servers are aware that they are complicit, or "fake". Infected WordPress installations participating in botnets and spreading malware is a scourge. It would be commendable to try to contact the site operators in cases like this.
blincoln 4y ago
I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it. I had to rebuild the MBR. I definitely recommend doing any live testing in a VM on a dedicated testing device. Who knows what sneakier persistence techniques are out there now?
- cm_silva 4y ago
  >I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it. In this case, wouldn't the infection go away by formatting the disk?
  - ElectricalUnion 4y ago
    Strictly speaking (disks), yes, but people often say "disk" and format partitions instead. As the partition table and the MBR/"EFI system partition" exist outside of the realm of normal partitions, formatting normal partitions doesn't help in this case.
geocar 4y ago
__utma means they were looking for Google Analytics cookies. If you weren't on the landing page after seeing the ad (and just opened the zip file) you wouldn't have these on your test page. Also: $ base64 -d dj01MDY1NDg3MTIwZTU2ZmQ1ZTZlNCZjaWQ9MjY0 v=5065487120e56fd5e6e4&cid=264 cid= is common for campaign identifiers. Might also be "channel". This might not be a CNC system but ad fraud. Using a coffee shop is a great idea, but perhaps one further away from Tyson's Corner since there are a lot of IP addresses there used by netsec people and servers, so they are on a lot of blocklists. Sometimes the script is looking for special cookies when injecting onto sites like amazon, so I used to use gift cards to buy stuff on amazon on my testrig when examining some malware, and I would get much more interesting ads than without. Also: Be careful when recording your SSL traffic (with something like MITMPROXY), since ad guys know about this: https://github.com/mitmproxy/mitmproxy/issues/4575 https://github.com/mitmproxy/mitmproxy/issues/4575 but a lot of netsec people forget about this.
- CuckooExe 4y ago
  Yeah, when I decoded the B64 params, I did see the `cid` keyword, and briefly thought that this might be just really good adware. However, the following stages were too sophisticated for some person to just serve me an ad. And I'm not sure if a coffee shop farther outside of Tyson's (not going to ask why you specifically said that area) would've helped. I'm very confident that they tore down their C2 after seeing either a (in their eyes) successful callback, or me badger their server with follow on requests.
  - geocar 4y ago
    > the following stages were too sophisticated for some person to just serve me an ad. You may not believe me, but this is much less sophisticated than some of the things I have seen; My opinion is that the people who participate in ad fraud are a lot more sophisticated than any of the ad-fraud detection/protection "vendors" working to try and stop it. To give you an idea of what I mean, "these guys" might not have been trying to show you an ad at all, but to sell your traffic (or normal looking cookies) to someone else who has already sold an ad, but just want something to juice the click-rate or the conversion-rate of some other traffic, and so if you weren't in that market, they won't even serve you the content that performs these steps. > I'm very confident that they tore down their C2 after seeing either a (in their eyes) successful callback, or me badger their server with follow on requests. No doubt. Unusual traffic tends to spook them. They will shut everything down, then use google search to look for their domain name in blogs and stuff, and if that doesn't happen, and their "customer" doesn't complain about anything, they will resume the juicing.
0x53 4y ago
Use a VM when running random scripts.

3np 4y ago

If not be so quick to jump on conclusions that the distributing sites and servers are aware that they are complicit, or "fake". Infected WordPress installations participating in botnets and spreading malware is a scourge. It would be commendable to try to contact the site operators in cases like this.

blincoln 4y ago

I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it. I had to rebuild the MBR. I definitely recommend doing any live testing in a VM on a dedicated testing device. Who knows what sneakier persistence techniques are out there now?

cm_silva 4y ago
>I haven't looked at ad malware for many years, but when I did, it infected the MBR, so reinstalling Windows alone wouldn't remove it. In this case, wouldn't the infection go away by formatting the disk?
- ElectricalUnion 4y ago
  Strictly speaking (disks), yes, but people often say "disk" and format partitions instead. As the partition table and the MBR/"EFI system partition" exist outside of the realm of normal partitions, formatting normal partitions doesn't help in this case.

geocar 4y ago

__utma means they were looking for Google Analytics cookies. If you weren't on the landing page after seeing the ad (and just opened the zip file) you wouldn't have these on your test page. Also: $ base64 -d dj01MDY1NDg3MTIwZTU2ZmQ1ZTZlNCZjaWQ9MjY0 v=5065487120e56fd5e6e4&cid=264 cid= is common for campaign identifiers. Might also be "channel". This might not be a CNC system but ad fraud. Using a coffee shop is a great idea, but perhaps one further away from Tyson's Corner since there are a lot of IP addresses there used by netsec people and servers, so they are on a lot of blocklists. Sometimes the script is looking for special cookies when injecting onto sites like amazon, so I used to use gift cards to buy stuff on amazon on my testrig when examining some malware, and I would get much more interesting ads than without. Also: Be careful when recording your SSL traffic (with something like MITMPROXY), since ad guys know about this: https://github.com/mitmproxy/mitmproxy/issues/4575 https://github.com/mitmproxy/mitmproxy/issues/4575 but a lot of netsec people forget about this.

CuckooExe 4y ago
Yeah, when I decoded the B64 params, I did see the `cid` keyword, and briefly thought that this might be just really good adware. However, the following stages were too sophisticated for some person to just serve me an ad. And I'm not sure if a coffee shop farther outside of Tyson's (not going to ask why you specifically said that area) would've helped. I'm very confident that they tore down their C2 after seeing either a (in their eyes) successful callback, or me badger their server with follow on requests.
- geocar 4y ago
  > the following stages were too sophisticated for some person to just serve me an ad. You may not believe me, but this is much less sophisticated than some of the things I have seen; My opinion is that the people who participate in ad fraud are a lot more sophisticated than any of the ad-fraud detection/protection "vendors" working to try and stop it. To give you an idea of what I mean, "these guys" might not have been trying to show you an ad at all, but to sell your traffic (or normal looking cookies) to someone else who has already sold an ad, but just want something to juice the click-rate or the conversion-rate of some other traffic, and so if you weren't in that market, they won't even serve you the content that performs these steps. > I'm very confident that they tore down their C2 after seeing either a (in their eyes) successful callback, or me badger their server with follow on requests. No doubt. Unusual traffic tends to spook them. They will shut everything down, then use google search to look for their domain name in blogs and stuff, and if that doesn't happen, and their "customer" doesn't complain about anything, they will resume the juicing.

0x53 4y ago

Use a VM when running random scripts.