Email Spam Malware

TLDR:

This ongoing campaign (See this post) of spam emails has recently been redirecting to a fake flash update page. The executable from this page installed adware with a variety of malicious behaviors.

Email

The email, received July 26, 2017 was purporting to be a Facebook notification.

The header of the email shows a source IP address of 47.90.72.49. The server is located in Hong Kong.

The link goes to a domain http://tvoypozitiv[.]ru/tab[.]php. As before, this page is a javascript re-direct page with the following URL chain:

The final URL is the fraudulent flash download page:

The executable obtained from this download is on VirusTotal:

Fake Flash Installer - VirusTotal

The Malicious Sample

Static Analysis

Static analysis of the sample did not yield particularly interesting results, because it is just a downloader. Static analysis of the malicious downloads will be in a future post.

Dynamic Analysis

This sample executes full screen, as an installer. The steps to the installer are shown below Note: the process continues to execute regardless of the response to the UAC dialog:


The "Thank You" page at the end of the install process is located here, and has a private WHOIS: http://upalways.yoursafeandult2update.website/thankyou.php?channel_id=8581

and contains the following link to a known PUP:

There are numerous files downloaded during the installation process, a complete log of the network traffic is at the bottom of this post. The installer drops an executable that begins downloading malicious files immediately. That sample is here:

Adware Installer - VirusTotal

The installer adds a chrome extension with questionable permissions, and modifies the default search provider:


The extension's page is hosted on AWS here:

In addition to that downloader, potentially legitimate programs are installed, VLC and Avast.

I was running this sample in a VM with a NAT internet connection. I still had AV running on the host machine, so a lot of the malicious activity was blocked. At the moment, I don't have a lab setup that would allow me to safely run with a truly open internet connection. The applicable alerts are here:

8/9/2017 5:40:44 PM,High,An intrusion attempt by localhost was blocked.,Blocked,No Action Required,OS Attack: Microsoft SMB MS17-010 Disclosure Attempt,No Action Required,No Action Required,"localhost (127.0.0.1, 59008)",,"localhost (127.0.0.1, 445)",localhost (127.0.0.1),"TCP, Port 59008",

I do not (at the time of writing) have time to fully analyze the behavior of the installer and resulting processes, so I included the Procmon log file. I expect most people won't want to trust downloading it, but it's here anyway:

SHA1 C1B1D16D742577FE1B960CB09B993457B994C985 Procmon Log

Conclusion

I am hindered by my analysis environment/time constraints, but it's obvious this is a malicious sample. Further static analysis is something I plan to do in the near future.

Network Traffic From the Installer and Related Executables