有害性が際立つ偽装に長けた Jupyter インフォスティーラ：ステルス性と難読性の高い、モジュール化されたマルウェア

ステップ

説明/機能

難読化した DLL

Jupyter の DLL のコアコードを記述した難読化変数。

「難読化した DLL」のコードを受け取り、Jupyter の悪意のあるコアコードの難読化を解除するルーチン。多くの場合、Jupyter は Base64 でエンコードされ、XOR で難読化されています。

永続化メカニズムとして Jupyter がスタートアップに追加され、マルウェアが強制的に再実行されるようになります。

このマルウェアは、被害者の %AppData%\Roaming\ フォルダに普通に存在するディレクトリに自身を隠匿します。ランダムな個数の「ジャンクファイル」を配置して、唯一の機能する悪意のあるファイルが見つからないようにしています。PowerShell コードの大半の変種では、作成されるジャンクファイルの個数が 100 から 300 の範囲でランダムに変化することが普通です。

このマルウェアは反射型で実行され、ユーザーのデバイスに DLL が置かれないようにしています。

永続性を高くするために、被害者のマシンにレジストリキーが追加されます。

OC-1:

MSI サンプルに .txt ファイルとして PowerShell ペイロードを埋め込み

.txt ファイルを AppData フォルダに配置

MSI に埋め込まれたペイロードの起動に使用するコマンド

AppData から .txt ファイルをコマンドで読み取り、別のコマンドをデコード

XOR 演算

OC-8:

最初に Base64 エンコード

Wscript

AppData\Adobe フォルダ

user32.dll をインポート

Get-Process

2 つの関数を定義

Base64 の DLL を反射型ロード

XOR 演算なし

OC-9:

最初に Base64 エンコード

 WScript

AppData\Adobe フォルダ

user32.dll をインポート

Get-Process

2 つの関数を定義

Base64 の DLL を反射型ロード

XOR 演算

3d8:

最初に Base64 エンコード

Wscript

AppData\Adobe フォルダ

user32.dll をインポートし、半難読化した PowerShell コマンドに隠匿

Get-Process

2 つの関数を定義

Base64 の DLL を反射型ロード

XOR 演算

import "pe"
import "dotnet"

rule Mal_Infostealer_EXE_Jupyter_Cert_36ff
{
    meta:
        description = "Detects Jupter executables by certificate OOO Sistema (36ff)"
        author = "BlackBerry Research & Intelligence Team"
        date = "2021-10-14"
        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"       

    condition:
        uint16(0) == 0x5a4d and
        for any i in (0 .. pe.number_of_signatures) : (
            pe.signatures[i].issuer contains "Certum Extended Validation Code Signing CA SHA2" and
            pe.signatures[i].serial == "36:ff:67:4e:b3:05:e9:9c:35:56:5f:a3:01:d5:c4:b0" // Serial variable must be lowercase
            )
}

rule Mal_Infostealer_MSI_EXE_Jupyter_Certificate
{
    meta:
        description = "Detects Jupter by certificate"
        author = "BlackBerry Threat Research Team"
        date = "2021-11-04"
        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

    strings:
        // MSI Installer
        $msi = { D0 CF 11 E0 A1 B1 1A E1 }

        // MSI Strings
        $a1 = "EMCO MSI Package Builder"

        // PowerShell execution strings
        $b1 = "powershell-ExecutionPolicy bypass -command \"iex([\\[]IO.File[\\]]::ReadAllText('[CurrentUserProfileFolder]" nocase
        $b2 = "powershell-ep bypass -file \"[AppDataFolder]" nocase
        $b3 = /powershell-ep bypass -windowstyle hidden -command \"\$xp=\'\[AppDataFolder\].{0,256}\.{0,256}\'/ nocase
        $b4 = /powershell-ep bypass -windowstyle hidden -command \"\$p=\'\[AppDataFolder\].{0,256}\.{0,256}\'/ nocase
        $b5 = /powershell-ExecutionPolicy bypass -command \"iex\(\[\\\[\]IO.File\[\\\]\]::ReadAllText\(\'\[CurrentUserProfileFolder\].{1,256}\..{1,256}\'\)\)/ nocase

        // Certificate Name
        $c1 = "OOO ENDI"
        $c2 = "OOO MVS"
        $c3 = "OOO LEVELAP"
        $c4 = "Soto Manufacturing SRL"
        $c5 = "Decapolis Consulting Inc."

        // Co-signers
        $f1 = "SSL.com EV Root Certification Authority RSA R2"
        $f2 = "SSL.com EV Code Signing Intermediate CA RSA R3"
        $f3 = "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
        $f4 = "DigiCert Trusted Root G40"

    condition:
        ($msi at 0 or uint16(0) == 0x5a4d) and
        all of ($a*) and
        1 of ($b*) and
        1 of ($c*) and
        2 of ($f*)
}

rule Mal_Infostealer_MSI_Jupyter_Embedded_PowerShell
{
    meta:
        description = "Detects Jupter by a specific PowerShell command present in the MSI Installer"
        author = "BlackBerry Threat Research Team"
        date = "2021-10-14"
        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

    strings:
        // MSI Installer
        $msi = { D0 CF 11 E0 A1 B1 1A E1 }

        // Embedded PowerShell Command
        $x1 = /powershell-ep bypass -windowstyle hidden -command \"\$xp=\'\[AppDataFolder\]pd\w*\.(log|txt)\';\$xk=\'[a-zA-Z]{52}\';\$xb=\[\\\[\]System\.Convert\[\\\]\]::FromBase64String\(\[\\\[\]System\.IO\.File\[\\\]\]::ReadAllText\(\$xp\)\);remove-item \$xp;for\(\$i=0;\$i -lt \$xb.count;\)\[\\\{\]for\(\$j=0;\$j -lt \$xk\.length;\$j\+\+\)\[\\\{\]\$xb\[\\\[\]\$i\[\\\]\]=\$xb\[\\\[\]\$i\[\\\]\] -bxor \$xk\[\\\[\]\$j\[\\\]\];\$i\+\+;if\(\$i -ge \$xb.count\)\[\\\{\]\$j=\$xk\.length;\[\\\}\]\[\\\}\]\[\\\}\];\$xb=\[\\\[\]System.Text.Encoding\[\\\]\]::UTF8\.GetString\(\$xb\);iex \$xb;/ nocase

    condition:
        $msi at 0 and
        all of ($x*)
}

rule Mal_Infostealer_PowerShell_Jupyter_Updated_Samples
{
    meta:
        description = "Detects Jupter powershell via common strings"
        author = "BlackBerry Threat Research Team"
        date = "2021-11-04"
        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

    strings:
        $c1 = /\.[T|t][O|o][L|l][O|o][W|w][E|e][R|r]\(\)\)?;[I|i][E|e][X|x]/
        $c2 = "get-random -minimum 50000 -maximum 200000" nocase
        $c3 = "ReaDALlBYTES" nocase
        $c4 = /createshortcut\(\$env\:appdata\+'\\m\'\+\'icr\'\+\'oso\'\+\'ft\'\+\'\\w\'\+\'ind\'\+\'ow\'\+\'s\\\'\+\'st\'\+\'art\'\+\' me\'\+\'nu\'\+\'\\pr\'\+\'ogr\'\+\'ams\\\'\+\'st\'\+\'art\'\+\'up\'\+\'\\.{29}\.lnk\'\)/ nocase

    condition:
        all of ($c*)
}

rule Mal_Infostealer_Win32_Jupyter_Main_Module
{
    meta:
        description = "Detects Jupter main module"
        author = "BlackBerry Threat Research Team"
        date = "2021-11-23"
        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

    strings:
        $g1 = { 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 } // h.t.t.p.:././.
        $g2 = { 5C 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 5C 00 52 00 4F 00 41 00 4D 00 49 00 4E 00 47 } // \.A.P.P.D.A.T.A.\.R.O.A.M.I.N.G
        $g3 = { 63 00 68 00 61 00 6E 00 67 00 65 00 5F 00 73 00 74 00 61 00 74 00 75 00 73 } // c.h.a.n.g.e._.s.t.a.t.u.s
        $g4 = { 50 00 4F 00 53 00 54 } // P.O.S.T
        $g5 = { 69 00 73 00 5F 00 73 00 75 00 63 00 63 00 65 00 73 00 73 } // i.s._.s.u.c.c.e.s.s
        $g6 = { 75 00 73 00 65 00 72 00 70 00 72 00 6F 00 66 00 69 00 6C 00 65 } // u.s.e.r.p.r.o.f.i.l.e
        $g7 = { 44 00 45 00 53 00 4B 00 54 00 4F 00 50 00 2D } // D.E.S.K.T.O.P.-
        $g8 = { 4C 00 41 00 50 00 54 00 4F 00 50 00 2D } // L.A.P.T.O.P.-
        $g9 = { 78 00 38 00 36} // x.8.6
        $g10 = { 78 00 36 00 34 } // x.6.4
        $g11 = { 41 00 64 00 6D 00 69 00 6E } // A.d.m.i.n
        $g12 = { 56 00 69 00 73 00 74 00 61 } // V.i.s.t.a
        $g13 = { 64 00 6E 00 73 } // d.n.s
        $g14 = { 64 00 7A 00 6B 00 61 00 62 72 } // d.z.k.a.b.r
        $g15 = { 78 00 7A 00 6B 00 61 00 62 00 73 00 72 } // x.z.k.a.b.s.r
        $g16 = { 64 00 7A 00 6B 00 61 00 62 00 73 00 72 } // d.z.k.a.b.s.r

        // Version Strings
        $h1 = { 4F 00 43 00 2D } // O.C.-
        $h2 = { 4E 00 56 00 2D } // N.V.-
        $h3 = { 53 00 50 00 2D } // S.P.-
        $h4 = { 49 00 4E 00 2D } // I.N.-

        $i = "System.Net"

    condition:
        10 of ($g*) and
        1 of ($h*) and
        (pe.imports("mscoree.dll", "_CorDllMain") or $i) // DotNet
}

rule Mal_Infostealer_Win32_Jupyter_InfoStealer_Module
{
    meta:
        description = "Detects Jupter infostealer module"
        author = "BlackBerry Threat Research Team"
        date = "2021-11-08"
        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

    strings:
        $d1 = "WebRequest" nocase
        $d2 = "HttpWebRequest" nocase
        $d3 = "WebResponse" nocase
        $d4 = "GetResponseStream" nocase
        $d5 = "GetResponse" nocase
        $d6 = "IsInRole" nocase
        $d7 = "get_UTF8" nocase
        $d8 = "FromBase64String" nocase
        $d9 = "get_OSVersion" nocase
        $d10 = "GetFiles" nocase
        $d11 = "GetExtension" nocase
        $d12 = "get_Current" nocase
        $d13 = "GetEnumerator" nocase

        $j1 = { 6C 6F 67 69 6E 73 } // logins
        $j2 = { 43 00 6F 00 6F 00 6B 00 69 00 65 00 73 } // C.o.o.k.i.e.s
        $j3 = { 00 6C 00 6F 00 67 00 69 00 6E 00 73 00 2E 00 6A 00 73 00 6F 00 6E 00 } // .l.o.g.i.n.s...j.s.o.n.
        $j4 = { 00 63 00 6F 00 6F 00 6B 00 69 00 65 00 73 00 2E 00 73 00 71 00 6C 00 69 00 74 00 65 00 } // .c.o.o.k.i.e.s...s.q.l.i.t.e.

    condition:
        // DotNet
        pe.imports("mscoree.dll", "_CorDllMain") and
        12 of ($d*) and
        2 of ($j*)
}

rule Mal_Infostealer_Win32_Jupyter_Download_and_Execute_Module
{
    meta:
        description = "Detects Jupter download and execute module. Research has shown it downloading SolarDelphi / JupyterStealer."
        author = "BlackBerry Threat Research Team"
        date = "2021-11-09"
        license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

    strings:
        $e1 = { 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 }
        $e2 = { 47 00 45 00 54 00 00 3D 63 00 3A 00 5C 00 77 00 69 00 6E 00 64 00 6F 00 77 00 73 00 5C 00 73 00 79 00 73 00 74 00 65 00 6D 00 33 00 32 00 5C 00 77 00 69 00 6E 00 76 00 65 00 72 00 2E 00 65 00 78 00 65 }
        $e3 = { 00 2F 00 67 00 65 00 74 00 2F 00 }
        $e4 = "FromBase64String"
        $e5 = "get_UTF8"
        $e6 = "WebResponse"
        $e7 = "GetResponse"
        $e8 = "Invoke"

    condition:
        // DotNet
        pe.imports("mscoree.dll", "_CorDllMain") and
        dotnet.version == "v4.0.30319" and
        dotnet.assembly.version.major == 0 and
        dotnet.assembly.version.minor == 0 and
        all of ($e*)
}

SHA256:

• dd8e1e321ce70472f9f0681c6e2dc078e7d066d89bc63ca4ae1ac53bee8daac2
• a772d35e54bcd6790ea99f8723d56872891ef5691ed502a82babc618d2e8a452
• 0adfbce8a09d9f977e5fe90ccefc9612d1d742d980fe8dc889e10a5778592e4d
• 0e673eb418c87268aa3bcb262e8e03a3f719a95a8e118ba99515c57c9aa02d38
• 10221ceffbc7d7e59b17b1968d0fa01c8124efa70d1d5a486e53211e4754a22d
• 13d34fbf591c2cbf38e60ec3c6d185546e206be61dd58923edc23c4b125ff2f0
• 161b6f4bc07567c0c6e2e394454a66b8aac2f73212a6cf6c0c82b9fdbdb3fcce
• 1e7914f799371cbc8560bc52203d3531bb20cb4f6092158c76a4842dbf85dabc
• 2a051324620943464749234c9b49def385b9f6dd7c30f4caa4d98b3af035bd8f
• 3303926a6468dab25286a65bb9f3e5883a8938e6501031b3b85e21f182d1ed0d
• 341881d11fd748a81c8cee584dc42392a564aeb839faf7afa136004701e656c1
• 38c833c34998c9f4d9266f920c0f0862d986cb434740f99175e32f3f49275eb5

C2 IP:

• 146.70.24[.]229
• 23.29.115[.]175
• 92.204.160[.]110
• 146.70.41[.]157
• 37.221.114[.]23
• 188.241.83[.]61
• 69.46.15[.]151

C2 の識別子/バージョン：

• NV-5
• OC-11
• OC-1
• OC-2
• J13
• J15
• J16
• IN-10
• NV-1
• NV-4
• NV-6
• OC-3
• OC-7
• OC-8
• OC-9
• OC-W1
• SP-10
• SP-13
• SP-17
• SP-18
• SP-W2

証明書 #1：

• シリアル番号: 36 FF 67 4E B3 05 E9 9C 35 56 5F A3 01 D5 C4 B0
• 名前: OOO Sistema
• 有効期間の開始日: 01:51 PM 12/02/2020
• 有効期間の終了日: 01:51 PM 12/02/2021
• サムプリント: C301843CA390AED52C4C6D59EF3D125400F186FB

証明書 #2：

• シリアル番号: 5B A9 00 D7 A7 61 EE 27 C2 79 98 C8 B9 B4 FA 70
• 名前: OOO LEVELAP
• 有効期間の開始日: 11:53 AM 09/14/2021
• 有効期間の終了日: 11:53 AM 09/14/2022
• サムプリント: EDEBF26E6CAD49A8F48A11EFF6BFC13266FF6872

証明書 #3：

• シリアル番号: 6F E7 21 C3 DD BD 27 74 D0 3D CE A4 4A 26 A7 8A
• 名前: OOO ENDI
• 有効期間の開始日: 08:17 PM 09/29/2021
• 有効期間の終了日: 08:17 PM 09/29/2022
• サムプリント: BC346A6BF6B6D53A69A742A4245A43320980B1C0

証明書 #4：:

• シリアル番号: 7B 44 65 51 DE 53 1A 37 D3 A0 EB FB 8F 0B 6E 01
• 名前: OOO MVS
• 有効期間の開始日: 08:19 PM 10/01/2021
• 有効期間の終了日: 08:19 PM 10/01/2022
• サムプリント: 691718CA7F85C0D5B89250D685EB52A808A321E5

証明書 #5：

• シリアル番号: 06 48 7A 92 B1 D9 12 B7 9F 22 91 C0 D3 82 0F 2C
• 名前: Soto Manufacturing SRL
• 有効期間の開始日: 12:00 AM 10/04/2021
• 有効期間の終了日: 11:59 PM 08/04/2023
• サムプリント: AEE8241A17357D5713C451406BA4D3FBDCC1E25F

証明書 #6：

• シリアル番号: 0A 54 C6 04 87 D8 38 4E DC E9 81 81 4B E7 67 CB
• 名前: Decapolis Consulting Inc.
• 有効期間の開始日: 12:00 AM 10/31/2021
• 有効期間の終了日: 11:59 PM 10/24/2022
• サムプリント: BB800B7DE9E457D670303AF12E1940C732CC5975