Infected Site Installs TeamViewer

On June 30, 2016, Cyphort Labs discovered an infection via malvertising on the website trendystyleshop.com. According to Domain Tools, the site was registered in February 2016 under namecheap.com. What draw our interest to this infection is that it installs TeamViewer, a popular remote application tool which is widely used in enterprises. It makes sense for cyber criminals to use it because it is a good way to masquerade backdoor access as it blends with other users using the same app. You probably recall that a month ago a major hack of TeamViewer accounts was reported on various news outlets.

Infection Chain

The affected ad network is “nanoadexchange.com”. It advertises a game from “uphillrush.pro” but the ad is injected with an iframe that redirects to “aga111.pro” then redirects to “jnqedq.lswswc.xyz” which is hosting a Flash exploit kit.

After successful exploitation, it downloads an Andromeda bot from the same domain. The binary arrives encrypted over the network. 

The bot is installed in the %APPDATA% folder and filename starting with ms*.exe. Example:

• %APPDATA%\msqgoj.exe

As a persistence method, it will spawn a new process of “msiexec.exe” and inject its code. However, it will not install itself if the following processes are found as part of its Anti-Sandbox and Anti-Analysis trick:

• avpui.exe
• filemon.exe
• netmon.exe  
• perl.exe
• prl_cc.exe
• prl_tools.exe
• prl_tools_service.exe
• procmon.exe
• python.exe
• regmon.exe  
• sandboxiedcomlaunch.exe
• sandboxierpcss.exe  
• sharedintapp.exe
• vboxservice.exe  
• vboxtray.exe  
• vmsrvc.exe  
• vmtoolsd.exe  
• vmusrvc.exe  
• vmwareservice.exe
• vmwareuser.exe  
• wireshark.exe

However, it ignores the process blacklisting check when the following registry key is present:

• HKLM \ SOFTWARE\Policies\is_not_vm

Andromeda has been around since 2011. It is a modular type of malware with the following known types:

• Keylogger
• Browser Form Grabber
• Hidden TeamViewer
• Rootkit

For this infection, we have seen it installing additional modules from vbbb.ru including Browser Form Grabber and Hidden TeamViewer. 

The above image shows the communication to the CnC server. Bmla.ru is encrypted via RC4 where the key is hardcoded in the malware body. Download domain is at vbbb.ru but both are with the same IP address, 93.170.187.47.

As part of its routine, Andromeda gets the current time via NTP (Network Time Protocol) domains. It connects to the following NTP domains:

• pool.ntp.org
• africa.pool.ntp.org
• oceania.pool.ntp.org
• asia.pool.ntp.org
• south-america.pool.ntp.org
• north-america.pool.ntp.org
• europe.pool.ntp.org

Is Andromeda On the Rise Again?

Using the IP of the CnC 93.170.187.47, we gathered some domains resolved from it. We found that it is actively using the .ru TLD with 4 random letters as domain and usually having the last 3 letters the same. It also shows that this pattern has been active since April 10, 2016.

^{Source: virustotal.com}

We also discovered that one of the IPs used by Andromeda is actively used by Cerber ransomware, a ransomware infection used to encrypt  that . For instance, znnn.ru was registered with the following IP addresses sometime in May 2016.

It is unclear to us how the installation of TeamViewer is being exploited at this time by the actors behind this campaign, but it clearly is a major compromise that opens the door to a lot of possibilities. Cyphort Labs will continue to monitor and report any new developments.

IOCs

The post Infected Site Installs TeamViewer appeared first on Cyphort.