Kelihos botnet sending Panda Zeus to German and UK Banking Customers

On August 11th and August 12th the Kelihos botnet has been observed sending malware again.  Unlike the Ransomware that we've seen it send recently (see Kelihos spamming American Airlines Ransomware and Kelihos spamming Dutch Wildfire Ransomware ), this time it is sending links to a Word document that will drop a variant of Zeus.

One interesting observation about the spam is that it is doing "geo-targeting" based on the ccTLD of the email recipient.  Max Gannon, a UAB malware researcher in our lab, has modified his copy of Wireshark with a couple nice extra columns -- "imf.to" "imf.from" "imf.subject"

Now we can do a filter in Wireshark like this:

Filter:  imf.to contains .co.uk

which reveals only the subject lines that were sent to people in the UK!

The subjects in this run for .co.uk people were:

Subject: Barclays Personal Banking
Subject: Detected suspicious transaction on your account
Subject: HSBC Personal Banking
Subject: Incomplete transaction
Subject: Locked transaction


(There was also one "The truth about male power" but that's just a counterfeit pharmaceutical website, which is the main thing Kelihos spams when it is not on a special mission!)

Here's an example of the Barclays spam:

And an example of the HSBC spam:

The .de people also got a special German invitation to be infected:

Subject: Bitte beachten Sie in ihre Postbank konto
Subject: Geehrter Kunde
Subject: Info von ihre Bank
Subject: Inkasso von Anton Weber
Subject: Mahnung abhleichen
Subject: Postbank AG
Subject: Postbank info abteilung
Subject: Rechnung bei Postbank AG
Subject: Rechtsanwalt T. Hoffman
Subject: Von Ihre Bank
Subject: Von Postbank
Subject: Weitere Mahnung erfolgt in Ihre bank
Subject: Wir erwarten die Zahlung

(And they also had a few pill-spam subject, "Win your female partner's addiction", etc.)

Here's one of the PostBank samples:

The malicious URL in each of these emails, dropped from several sites, including:

 www dot 1800cloud dot com / infos / report dot doc
 guestlistalamode.com / bank / report dot doc

VirusTotal hint leads to . . . ZEUS!

A very curious thing when we looked at the file on VirusTotal is that there is an "EXIF comments" section that contains a goodly blob of characters that looked ASCII range to me ... so ...

"66756e6374696f6e20737461727428297b7472797b76617220...."
when decoded by an awesome tool former UAB MS/CFSM student Vicki Carleton built for me 8-) ...

becomes a URL!



and THAT ... is Zeus! (with an 8 of 55 detection rate at VirusTotal as of this writing...)



The Zeus file, when executed, creates a .bat file, which deletes itself after running . . . and then stops me because it is 5:00 PM and I'm hungry . . .

The rest, as we say in Academia, is left as an exercise for the reader . . .

We'll let others dig into the actual Zeus malware that is dropped next, but for now, we have it on good authority that this is the "Panda Zeus" malware, discovered by Fox-IT back in April and blogged about more recently by Arbor Networks and IBM Security Intelligence.

The other Kelihos spam?

100% of the ".com", ".net", and ".pl"  addresses were pill spam
Subject: Achieve pure fun
Subject: Ancient secret of immeasurable nights of happiness
Subject: Are you ready to amaze your woman this night?
Subject: Big dignity will please your lady
(ok, i'll stop ...)

The only other geo-targeted spam was in Italian and targeted only at ".it" email addresses. It seemed to be a romance scam invitation.   (lyudmilafedoji@gmail.com wants me, and a few million other people, to "scrivere" her "su un personal mail.:)

Lyudmilafedoji had her own set of subject lines:
Al di mare grande, si sei ora?
Avete tuo piani per stasera?
Buon Pomeriggio, come stai?
Buona sera, siamo a conoscenza.
Ciao, come ti nome?
Ciao, scrivimi me.
Ciaooo, io ti conosco!
Forse tu sei tu persona che sara felice
Hi, come stai?
Io voglio il vero amore!
Io voglio incontrarmi con tuo.
and many more . . .
(So for my Italian readers, beware!  She's interested in EVERYONE!)

American Airlines spam from Kelihos delivers Ransomware

I'm pleased to have Arsh Arora return with another guest blog about his findings as he continues to observe the Kelihos botnet.  Arsh recently received his Masters in Computer Forensics and Security Management in our program at UAB and has chosen to continue his malware research as a PhD candidate.

Kelihos botnet delivering CryptFlle2 Ransomware with theme AmericanAirlines

By Arsh Arora

When we saw the Kelihos botnet delivering ransomware last month on July 8th, we sat up and took notice.  The Kelihos botnet has a long history of delivering pharma spam and stock market manipulation spam (pump-n-dump), but now it was spamming the WildFire ransomware. ( See: http://garwarner.blogspot.com/2016/07/kelihos-botnet-delivering-dutch.html )  I was under the impression that it was one of the occasional gimmicks observed with Kelihos where they try something a single time and then move on.  I assumed that some script kiddies were testing new ransomware techniques. Unfortunately, I was wrong and Kelihos hit back with CryptFIle2 encryption ransomware.

To attract people to their ransomware, this campaign used subject lines imitating American Airlines specifically to attract customers. The URLs listed below are the locations that were sent in the spam email along with its corresponding subject lines:

hxxp://dataupllinks[.]top/nfdk/ticket1845[.]doc - Free Fly with AmericanAirlines

hxxp://ftp[.]dataupllinks[.]top/edsf/tick-873[.]doc  - Bonus from AmericanAirlines

hxxp://ftp[.]filesgigastor[.]top/23tf/disc_tick-235[.]doc  - AmericanAirlines free 100$

hxxp://www[.]webdataupllinks[.]net/rety/tick-834[.]doc  - AmericanAirlines discount

The following is the email that the victim receives and is inclined to check out the special travel prices for his/her favorite vacation spots.

Figure 1 - American Airlines Discounts

Several subject lines were used, including:

• Subject: Bonus from AmericanAirlines
• Subject: AmericanAirlines free 100$
• Subject: AmericanAirlines discount
• Subject: Free fly with AmericanAirlines

---

Subject: AmericanAirlines discount 

Traveling with the world's largest airline shouldn't have to be expensive. That's why at Ctrip, we are
bringing you our lowest prices yet for flights with American Airlines. 

>>> DOWNLOAD FREE DISCOUNT 100$ TICKET:
*Prices exclude taxes and fees.
Los Angeles - Las Vegas from 88$
Las Vegas - Los Angeles from 198$
New York - Chicago from 192$
Toronto - Hong Kong from 923$
Los Angeles - Shanghai from 832$
Toronto - Beijing from 958$
Chicago - Beijing from 712$
Boston - Beijing from 1,077$
Boston - Shanghai from 1,060$
Chicago - Shanghai from 845$
Atlanta - Beijing from 1,581$
Chicago - New York from 221$
Los Angeles - New York from 440$
New York - Toronto from 220$
New York - Miami from 177$
New York - Orlando from 203$
Seattle - Los Angeles from 145$
New York - Los Angeles from 366$
Los Angeles - San Francisco from 186$

>>> DOWNLOAD FREE DISCOUNT 100$ TICKET:
hxxp://www[.]webdataupllinks[.]net/rety/tick-834[.]doc 

Terms and Conditions:
Prices are correct at time of publication and are subject to availability and change. Please see
english.ctrip.com to confirm availability, prices, and applicable terms and conditions. Flights for
certain dates may be sold out. In this event, please try to enter another flight date. Airlines reserve
right to adjust prices and control seat availability according to sales situation. Final fare based on
airline's actual sale price. Seat availability subject to airlines. Special fares may be subject to
strict change, refund and endorsement conditions. Please refer to conditions of confirmed booking for
details. Ctrip.com International Ltd. (CTRP) reserves all rights of final interpretation.

---

The prices are striking enough to entice the victim to click the link. Once the link is clicked, a pop up is shown to download a Word document. Although the user is unaware that the Word document contains hostile code, Microsoft Word document delivery is one of the more common ways of distributing malware.

Once the download is complete the victim opens the document. The document follows a similar pattern as it used in the previous ransomware sent by Kelihos. The Word document is opened in ‘Protected View’ and seeks the user to ‘Enable Editing’ to view the document.

Figure 2 - "Protected Document"

After clicking the ‘Enable Editing’ box, another window asks to ‘Enable Macros’, aka the “ENCRYPT ME” button.

Figure 3 - "Enable Editing AKA Encrypt Me!"

After clicking the ‘Enable Content’ button, it shows the following message.

Figure 4 - Looks like a Word Document!

This behavior is the first of its kind observed in Word documents delivering malware. Generally, there is no content in the Word document and the malware infects the victim’s machine within minutes if not seconds.

The feature makes the Word document seem like a legit file and distracts the user while the malware contacts its command and control center and encrypts files in the background.

As soon as you complete reading, you realize that your computer has been encrypted by CryptFIle2 encryption ransomware.

Figure 5 - You are now ENCRYPTED

An interesting feature about the ransom note is that the threat actors have evolved their technique for obtaining ransom payment. As it can be seen, there is no mention of Tor-hosted or Onion-domain payment websites. Instead, it has 2 email addresses in which the victim can email the threat actor directly to pay the ransom. The email addresses are:

westbors@oath[.]com
gobas@inorbit[.]com

This seems fool-hardy and not very sophisticated, but the American Airlines lure will certainly gain some victims!  This is phenomenally different behavior than the previous WildFire ransomware. The text displayed after enabling Macros is a significant change in the Word document that spread ransomware.

Other interesting observations found are:

• .      MD5 hash of the Word document - 4fde04b25ea20b6ab30c5e4984e01afc
• .      Website mentioned in the Word document – english[.]ctrip[.]com
• .      Payload location: hxxp://216[.]170[.]126[.]3/wfil/file[.]exe
•                           hxxp://216[.]170[.]118[.]4/default[.]jpg
•     Command & Control Center: hxxp://216[.]170[.]118[.]4/wes/offers[.]php

#AA #AmericanAirlines – Just realized that AA stands for my name too. So were the threat actors targeting the American Airlines or Arsh Arora, in disguise of AA?

---

Thanks for that guest post, Arsh! Be on the lookout for a new paper about the spam campaigns of Kelihos at an upcoming conference based on Arsh's studies.