2019-04-05 - FAKE UPDATES CAMPAIGN - INDICATORS

DOWNLOADED .JS FILE FROM FAKE UPDATE PAGE:

- SHA256 hash: 9b446e8bbf065897ac511fa36c0e028f3cf3aef17cc507843193efecba12a30a

- File size: 18,992 bytes
- File name: Chrome.Update.9684ff.js (different hex characters before .js each
download)
- Any.Run analysis: https://app.any.run/tasks/6fc29add-83dc-4f5e-ae1a-8cce674124f8
- CAPE sandbox: https://cape.contextis.com/analysis/61711/
- Reverse.it:
https://www.reverse.it/sample/9b446e8bbf065897ac511fa36c0e028f3cf3aef17cc507843193e
fecba12a30a
- NOTE: This was a different name/file hash each time it was downloaded from the
fake update page

FOLLOW-UP EXE RETRIEVED AFTER RUNNING THE .JS FILE (CHTHONIC):

- SHA256 hash: 668c1615f3d06b0ef3cafa527099481b10a8758691e6e8710f2ade7f33bfa266

- File size: 392,456 bytes
- File location: C:\Users\username\AppData\Local\Temp\Chrome.Update.9684ff.exe
- File location: C:\Users\username\AppData\Roaming\bJava\bJava.exe
- Any.Run analysis: https://app.any.run/tasks/b040e7a4-893b-40c3-ba80-3a3d51b5fe6a
- CAPE sandbox: https://cape.contextis.com/analysis/61712/
- Reverse.it:
https://www.reverse.it/sample/668c1615f3d06b0ef3cafa527099481b10a8758691e6e8710f2ad
e7f33bfa266

UPDATED CHTHONIC BINARY ABOUT 40 MINUTES AFTER THE INITIAL INFECTION:

- SHA256 hash: 9d6163d57c9c99026b1203a475f0dac06b6a75a82a83d7c0c19442cb14ba35e5

- File size: 481,480 bytes
- File location: C:\Users\username\AppData\Roaming\bJava\bJava.exe
- Any.Run analysis: https://app.any.run/tasks/e80a337c-f604-4367-b5b9-d20989ea8bb5
- CAPE sandbox: https://cape.contextis.com/analysis/61714/
- Reverse.it:
https://www.reverse.it/sample/9d6163d57c9c99026b1203a475f0dac06b6a75a82a83d7c0c1944
2cb14ba35e5

INFO ON OTHER FILES FOUND ON THE INFECTED WINDOWS HOST:

$ ll

6348800 Apr 5 02:38 11AC.tmp

6205440 Apr 5 02:38 143B.tmp
47104 Apr 5 02:39 35324533.tmp
47104 Apr 5 02:38 64594E6E.tmp
561603 Apr 5 02:38 a4c0b2b7c36fc6231.png

$ file *.*

11AC.tmp: MS Windows registry file, NT/2000 or above

143B.tmp: MS Windows registry file, NT/2000 or above
35324533.tmp: PE32 executable (DLL) (console) Intel 80386, for MS Windows
64594E6E.tmp: PE32 executable (DLL) (console) Intel 80386, for MS Windows
a4c0b2b7c36fc6231.png: PNG image data, 1366 x 768, 8-bit/color RGBA, non-interlaced
nircmdc.exe: PE32+ executable (console) x86-64, for MS Windows

$ shasum -a 256 *.*

71212281dd8a07a76df6ea7cefc178c198ee047c979bcf6dc9dc4946dcaf209c 11AC.tmp
b3191e45c95461dcf90615315dd6878f6c48a1d3f9d871f0690b007fed1919cd 143B.tmp
873a2ba4c3bb88b9354eab47b8e5f8118212a63abf7cb149696a385edb57dd63 35324533.tmp
873a2ba4c3bb88b9354eab47b8e5f8118212a63abf7cb149696a385edb57dd63 64594E6E.tmp
11c2e77c86822015ce2cb3c6d20a10813344c1e5058fa81440679cb6e231c8be
a4c0b2b7c36fc6231.png
fb5443d482c98f02a343fb0c50bf86aed5ac7a4aaea00e818ff1ef96771602d3 nircmdc.exe

INITIAL TRAFFIC TO FAKE GOOGLE UPDATE PAGE:

- 146.83.204.167 port 80 - www.med.ufro.cl - Compromised site

- 81.4.122.101 port 443 - click.clickanalytics208.com - Redirect to fake updates
page
- 93.95.100.178 port 443 - snap.cr-acad.com - fake Google update page (index page)
- 93.95.100.178 port 80 - snap.cr-acad.com - other URLs for fake Google update page

TRAFFIC GENERATED BY DOWNLOADED .JS FILE:

- 188.165.62.40 port 80 - 3c22c4fa.static.spillpalletonline.com - POST /pixel.gif

- 188.165.62.40 port 80 - 3c22c4fa.static.spillpalletonline.com - POST /pixel.gif?
ss&ss1img

TRAFFIC GENERATED BY CHTHONIC BANKING TROJAN:

- 5.135.183.146 TCP port 53 - DNS query for afroamericanec.bit

- 31.3.135.232 TCP port 53 - DNS query for afroamericanec.bit
- 51.254.25.115 TCP port 53 - DNS query for afroamericanec.bit
- 58.251.121.110 TCP port 53 - DNS query for afroamericanec.bit
- 59.36.120.151 TCP port 53 - DNS query for afroamericanec.bit
- 180.163.8.114 TCP port 53 - DNS query for afroamericanec.bit
- 188.165.200.156 TCP port 53 - DNS query for afroamericanec.bit

- 8.208.22.216 port 80 - afroamericanec.bit - POST /en/

- 8.208.22.216 port 80 - afroamericanec.bit - POST /en/www/