Netskope amplía su liderazgo en protección de datos con la adquisición de Dasera. Leer el comunicado de prensa

cerrar
cerrar
  • Por qué Netskope chevron

    Cambiar la forma en que las redes y la seguridad trabajan juntas.

  • Nuestros clientes chevron

    Netskope atiende a más de 3.400 clientes en todo el mundo, incluidos más de 30 de las 100 empresas más importantes de Fortune

  • Nuestros Partners chevron

    Nos asociamos con líderes en seguridad para ayudarlo a asegurar su viaje a la nube.

Un Líder en SSE.
Y ahora Líder en SASE Single-Vendor.

Descubre por qué Netskope debutó como Líder en el Cuadrante Mágico de Gartner® 2024 para Secure Access Service Edge (SASE) de Proveedor Único.

Obtenga el informe
Visionarios del cliente en primer plano

Lea cómo los clientes innovadores navegan con éxito por el cambiante panorama actual de las redes y la seguridad a través de la Plataforma Netskope One.

Obtenga el eBook
Visionarios del cliente en primer plano
La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.

Más información sobre los socios de Netskope
Grupo de jóvenes profesionales diversos sonriendo
Tu red del mañana

Planifique su camino hacia una red más rápida, más segura y más resistente diseñada para las aplicaciones y los usuarios a los que da soporte.

Obtenga el whitepaper
Tu red del mañana
Presentamos la Netskope One Plataforma

Netskope One es una Plataforma nativa en la nube que ofrece servicios convergentes de seguridad y redes para hacer posible su transformación SASE y de confianza cero.

Más información sobre Netskope One
Abstracto con iluminación azul
Adopte una arquitectura de borde de servicio de acceso seguro (SASE)

Netskope NewEdge es la nube privada de seguridad más grande y de mayor rendimiento del mundo y ofrece a los clientes una cobertura de servicio, un rendimiento y una resiliencia incomparables.

Más información sobre NewEdge
NewEdge
Netskope Cloud Exchange

Cloud Exchange (CE) de Netskope ofrece a sus clientes herramientas de integración eficaces para que saquen partido a su inversión en estrategias de seguridad.

Más información sobre Cloud Exchange
Vista aérea de una ciudad
  • Servicio de seguridad Productos Edge chevron

    Protéjase contra las amenazas avanzadas y en la nube y salvaguarde los datos en todos los vectores.

  • Borderless SD-WAN chevron

    Proporcione con confianza un acceso seguro y de alto rendimiento a cada usuario remoto, dispositivo, sitio y nube.

  • Secure Access Service Edge chevron

    Netskope One SASE proporciona una solución SASE nativa en la nube, totalmente convergente y de un único proveedor.

La plataforma del futuro es Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) y Private Access for ZTNA integrados de forma nativa en una única solución para ayudar a todas las empresas en su camino hacia el Servicio de acceso seguro Arquitectura perimetral (SASE).

Todos los productos
Vídeo de Netskope
Next Gen SASE Branch es híbrida: conectada, segura y automatizada

Netskope Next Gen SASE Branch converge Context-Aware SASE Fabric, Zero-Trust Hybrid Security y SkopeAI-Powered Cloud Orchestrator en una oferta de nube unificada, marcando el comienzo de una experiencia de sucursal completamente modernizada para la empresa sin fronteras.

Obtenga más información sobre Next Gen SASE Branch
Personas en la oficina de espacios abiertos.
Diseño de una arquitectura SASE para Dummies

Obtenga un ejemplar gratuito del único manual que necesitará sobre diseño de una arquitectura SASE.

Obtenga el eBook
Cambie a los servicios de seguridad en la nube líderes del mercado con una latencia mínima y una alta fiabilidad.

Más información sobre NewEdge
Autopista iluminada a través de las curvas de la ladera de la montaña
Habilite de forma segura el uso de aplicaciones de IA generativa con control de acceso a aplicaciones, capacitación de usuarios en tiempo real y la mejor protección de datos de su clase.

Descubra cómo aseguramos el uso generativo de IA
Habilite de forma segura ChatGPT y IA generativa
Soluciones de confianza cero para implementaciones de SSE y SASE

Más información sobre Confianza Cero
Conducción en barco en mar abierto
Netskope logra la alta autorización FedRAMP

Elija Netskope GovCloud para acelerar la transformación de su agencia.

Más información sobre Netskope GovCloud
Netskope GovCloud
  • Recursos chevron

    Obtenga más información sobre cómo Netskope puede ayudarle a proteger su viaje hacia la nube.

  • Blog chevron

    Descubra cómo Netskope permite la transformación de la seguridad y las redes a través del perímetro de servicio de acceso seguro (SASE)

  • Eventos y Talleres chevron

    Manténgase a la vanguardia de las últimas tendencias de seguridad y conéctese con sus pares.

  • Seguridad definida chevron

    Todo lo que necesitas saber en nuestra enciclopedia de ciberseguridad.

Podcast Security Visionaries

El futuro de la seguridad: cuántica, IA y cambio macropolítico
Emily Wearmouth y Max Havey hablan con el CEO de Netskope, Sanjay Beri, y el CTO, Krishna Narayanaswamy, sobre el futuro de la seguridad.

Reproducir el pódcast Ver todos los podcasts
El futuro de la seguridad: cuántica, IA y cambio macropolítico
Últimos blogs

Lea cómo Netskope puede habilitar el viaje hacia Zero Trust y SASE a través de las capacidades de perímetro de servicio de acceso seguro (SASE).

Lea el blog
Amanecer y cielo nublado
SASE Week 2024 bajo demanda

Aprenda a navegar por los últimos avances en SASE y Zero Trust y explore cómo estos marcos se están adaptando para abordar los desafíos de ciberseguridad e infraestructura

Explorar sesiones
SASE Week 2024
¿Qué es SASE?

Infórmese sobre la futura convergencia de las herramientas de red y seguridad en el modelo de negocio actual de la nube.

Conozca el SASE
  • Empresa chevron

    Le ayudamos a mantenerse a la vanguardia de los desafíos de seguridad de la nube, los datos y la red.

  • Ofertas de Trabajo chevron

    Join Netskope's 3,000+ amazing team members building the industry’s leading cloud-native security platform.

  • Soluciones para clientes chevron

    Le apoyamos en cada paso del camino, garantizando su éxito con Netskope.

  • Formación y Acreditaciones chevron

    La formación de Netskope le ayudará a convertirse en un experto en seguridad en la nube.

Apoyar la sostenibilidad a través de la seguridad de los datos

Netskope se enorgullece de participar en Vision 2045: una iniciativa destinada a crear conciencia sobre el papel de la industria privada en la sostenibilidad.

Descubra más
Apoyando la sustentabilidad a través de la seguridad de los datos
Ayude a dar forma al futuro de la seguridad en la nube

At Netskope, founders and leaders work shoulder-to-shoulder with their colleagues, even the most renowned experts check their egos at the door, and the best ideas win.

Únete al equipo
Empleo en Netskope
Netskope dedicated service and support professionals will ensure you successful deploy and experience the full value of our platform.

Ir a Soluciones para clientes
Servicios profesionales de Netskope
Asegure su viaje de transformación digital y aproveche al máximo sus aplicaciones en la nube, web y privadas con la capacitación de Netskope.

Infórmese sobre Capacitaciones y Certificaciones
Grupo de jóvenes profesionales que trabajan

Netskope Threat Research Labs Technical Analysis: CloudSquirrel Malware

Jul 27 2016
Tags
Cloud Best Practices
Cloud Malware
Cloud Security
CloudSquirrel
Netskope Threat Research Labs
Tools and Tips
Vulnerability Advisory
Cloud-Squirrel-3

Visual depiction of the life cycle of the Cloud Squirrel Attack

Last week we posted an article, giving an overview about the CloudSquirrel malware campaign that takes advantage of multiple cloud apps throughout the kill chain with the intent to steal and exfiltrate user data. We will talk about technical details in this blog.

Listed below are the activities seen in the CloudSquirrel malware campaign:

  • Uses a variety of cloud services to download its main payload.
  • Uses DropBox for its C&C (command and control) server.
  • Infects users by downloading malicious payloads ( 32 bit and 64 bit executables) that collects information about the victim’s machines including the victim’s email account credentials configured in native email clients.
  • Primarily affecting Brazilian users based on the facts – file names e.g. “NF-eletronica”, “visualizar boleto” and also the parameter names used in the data exfiltration.

CloudSquirrel malware typically arrives on the user’s machine as an attachment or a link via email. These attachments, and links will generally involve a ‘..’ extension, such as “NF-eletronica-8457348947..Docx.zip”. The delivery mechanism of CloudSquirrel we saw was being distributed using ServInt’s Jelastic Platform-As-A-Service(PaaS). Jelastic redirects to the CloudApp cloud platform which in turn uses Amazon AWS for its backend cloud services as shown in Figure 1.

CSFigure1

Figure 1: CloudSquirrel delivery mechanism

The downloaded sample “NF-eletronica-8457348947..Docx.zip” (md5 – F23E27F452C523D95D06371922531C48) is a zip archive that contained a JAR file “NF-eletronica-8457348947..Docx.jar” (md5 – A32F45F7B24FBE474816710BBDB046A6). If the user has not allowed viewing of file extensions in their operating system folder options, the sample would be displayed as “NF-eletronica-8457348947..Docx” without the .jar extension. This tricks the user and makes them believe it is a document file.

Analysis of the JAR file

We decompiled the JAR file and the main class file “vvbdhu.class” contained a list of hard-coded URLs in its code, as shown in Figure 2 below:

CSfigure2

Figure 2: URLs present in vvbhdu.class

Three of these URLs referred to Dropbox, while another referred to an IP address. These mp4 files were in fact in plain text format and each of them contained list of URLs, as shown in Figure 3 and Figure 4.

CSfigure3

Figure 3: URLs in xxxconfg.mp4

CSfigure4

Figure 4: URLs in xxxconf1.mp4 , xxxconf2.mp4 and xxxconf4.mp4

At the time of this blog’s publishing, the IP 45.63.23[.]187 was down, and not serving any payload. Since the IP is down, the malware makes an attempt to download the files from the URLs listed with IP 45.32.186[.]249 sequentially. As soon as it downloads a file successfully, it moves to the next stage of execution. Listed below in Figure 5 is the screenshot of malicious server hosting the files.

CSfigure5

Figure 5: Files present inside directory /clientes/dados at the website 45.32.186[.]249

The files stark1.pdf, stark2.pdf, stark3.pdf and stark4.pdf have the extension .pdf but are not real PDF files. They are executable files encrypted with the Data Encryption Standard (DES) algorithm which we decrypted using the code present in the vvbhdu.class file shown in Figure 6.

CSfigure6

Figure 6: Encrypt and decrypt routines using DES algorithm referred in vvbhdu.class

The vvbhdu.class file also referred to a key “squirrel123” in its code which is used to decrypt the files as shown in Figure 7.

CSfigure7

Figure 7: Static key “squirrel123” used for encryption and decryption referred in vvbhdu.class

We made an attempt to manually decrypt the files using the key “squirrel123” as shown in Figure 7, but were unsuccessful. Since a DES key is typically 8 bytes long, we tried with “squirrel” and successfully decrypted the files. In Java, though the DES key is more than 8 bytes long, it considers only the first 8 bytes due to which the execution of the JAR file worked perfectly without giving an exception.

Using the key “squirrel”, the encrypted files were decrypted to the following executables with predefined names OutFileHome.exe, OutFileBreak.exe, Ifgtray.exe and OIgfNswv.exe as shown in Figure 8. These files are saved under “%APPDATA%” in random folder name.

CSfigure8

Figure 8: Predefined executable names present in the class file

Analysis of the 4 dropped executable files

The following Table 1 provides additional details around the 4 decrypted files.

File nameMD5ApplicationPacker
IgfTray.exe6276CB1C74D736BC493D5474C04C478132-bit ExecutableVMProtect
OIgfNswv.exeF7DF2D29EDF85E7A05C90474FD4B9BE732-bit ExecutableVMProtect
OutFileBreak.exeD1C35FF526FC5B5866B889D9957CA36164-bit ExecutableVMProtect
OutFileHome.exe60336413E419C2EA5E215F1A32061E4064-bit Executable

Table 1: Details of the dropped files from the execution of NF-eletronica-8457348947..Docx.jar

OutFileHome.exe

We did not observe any activity performed by OutfileHome.exe as shown in Figure 9. The sample is likely a benign file that has the icon and properties of Windows notepad Application.

CSfigure9

Figure 9: Message displayed on execution of OutFileHome.exe

Ifgtray.exe

Upon execution of Ifgtray.exe, it dropped two additional utility executables, VIEW.exe and VIEWS.exe related to Nirsoft, a website that provides freeware utilities,  in the %temp% directory with details as shown in Table 2, below.

File nameMD5Application
VIEW.exe5F6E36DC418B9EF021D7AD958549722C32-bit Executable
VIEWS.exe5E59D5F0EEB20FA9F598D56284FADA9832-bit Executable

Table 2: Details of the dropped files from the execution of Igftray.exe

VIEW.exe is a OutlookAddressBookView utility that displays the details of all recipients stored in the address books of Microsoft Outlook.

VIEWS.exe is an e-mail password recovery utility that reveals the passwords and other account details stored for various accounts that are configured on the local email clients/applications on the victim’s machine. Figure 10 shows the properties of the two utility executables. Figure 11 and 12 show the screenshots when the two utility executables are executed.
CSfigure10

Figure 10: Nirsoft Email Password-Recovery and OutlookAddressBookView utility properties

CSfigure11

Figure 11: VIEW.exe.Outlook Address Book View window displayed on execution

CSfigure12

Figure 12: VIEWS.exe.Email Password-Recovery window displayed on execution

The data collected by the utility executables VIEW.exe and VIEWS.exe are uploaded to the C&C server at 146.185[.]136.31 as shown in Figure 13.

CSfigure13

Figure 13: Data sent to the C&C server at IP 146.185[.]136.31

Figure 13 shows the file with the name in the format SMTP_MACHIENAME_NUMBER.DAT containing the exfiltrated data and being uploaded to C&C server IP, http://146.185.136[.]31/book/index.php

OutFileBreak.exe

Upon execution of OutFileBreak.exe, the details of the victim’s machine are sent to another C&C server at 81.4.108[.]247 as shown in Figure 14.

CSfigure14

Figure 14: Data exfiltration to the command and control server at IP 81.4.108[.]247

The following are the details of the data being sent to the command and control server:

NOME – Machine Name, SO – Operating System Software, DATA – Date, IDIOMA – Language, ANTI – Antivirus, etc. as shown in Figure 14.

OIgfNswv.exe

Upon execution of OIgfNswv.exe, the sample creates mutex BaseNamedObjects[{1B765A84-BFC1-4B49-8FF5-0B5F9E247CFE}] and drops randomly named VBS files which attempts to download additional C&C configuration data from the URL shown in Figure 15.

CSfigure15

Figure 15: VBS file dropped by OIgfNswv.exe referring to URL hosting additional C&C configuration data.

Figure 16 shows all the URLs that the VBS script attempts to download the C&C configuration data. At the time of writing since the IP 82.196.6[.]25 was down.

CSFigure16

Figure 16: All URLs that are part of the VBS files dropped by OIgfNswv.exe

OIgfNswv.exe later deletes the other files OutFileHome.exe, OutFileBreak.exe, Ifgtray.exe which are present in the folder.

The analysis of the 4 dropped executable files and their capabilities indicate that the intent of the CloudSquirrel malware was to steal and exfiltrate data especially the data related to the usernames and corresponding passwords for email accounts configured in any of the email clients/applications.

Hunting for the CloudSquirrel campaign

A search using popular search engines based on the some of the keywords seen in the decompiled code of the JAR file pointed us to an article from a JAVA web tutorial website. We suspect that the malware author copied this exact code which is used for encryption and decryption with DES from the example on this website. We spotted similar strains of this malware and identified several samples in the wild. An interesting finding we observed during the analysis of all these samples was related to the size of the JAR files which ranged from 3 KB to 6 KB. After investigating the JAR samples, we suspect that the CloudSquirrel malware author has been working through multiple iterations of the malware and adding additional capabilities during each iteration. As an example, one of the malicious JAR file with md5  D037294DCD0AC7B7107C89CADEA7EE35 when decompiled generated capital.class file which did not contain any Dropbox links as shown in Figure 17. However, usage of the key “squirrel123” and the DES encryption/decryption code was the same.

CSFigure17

Figure 17: Absence of Dropbox URLs in one of the samples of CloudSquirrel

A majority of the JAR files related to CloudSquirrel downloaded the malicious payloads for performing data exfiltration. The malicious files were packed with VMProtect packer with variations in the hashes possibly to thwart antivirus detection.

As we continued to track this campaign, we noticed the URL which was initially serving the CloudSquirrel payload NF-eletronica-8457348947..Docx.jar started serving another payload NF-eletronica-8457348947..Docx.exe (md5 – 1DAB898C884A4B984985FABBE0F22B3F) which is a downloader compiled in Visual Basic. The malicious exe attempted to download additional dropper files from the URLs http://82.196.3[.]170/ava/helpmng.exe and http://82.196.3[.]170/nucomamaonobolso/helpmng.exe. At the time of writing this blog, these URLs were down and not serving any files.

Netskope’s Detection & Remediation

Netskope Active Threat Protection detects the CloudSquirrel malware files as follows:

MALWAREMD5
Gen:Variant.Zsy.1982761dab898c884a4b984985fabbe0f22b3f
Gen:Variant.Symm.661048f7789042583ccb0729abbac6d6a1608
Gen:Variant.Symm.6503088ecc913e5f663451e701225377c949c
Gen:Variant.Symm.661046276cb1c74d736bc493d5474c04c4781
Backdoor.Generckd.33840951cff73957b55019ae8e046e1e0b62467
Backdoor.Generckd.3379060a32f45f7b24fbe474816710bbdb046a6
Backdoor.Generckd.3382089f7df2d29edf85e7a05c90474fd4b9be7
Backdoor.Generckd.33842098e4f3f2c65bbdb04861ec10c438615dd
Backdoor.Generckd.3381526b293fbf215658016a53e7f29ca9db3d9
Backdoor.Generckd.3380714dc25540a1957aa6406643eb7f19b7cbf
Backdoor.Generckd.33650340bd2ea285213859378487859bace0c12
Backdoor.Generckd.33650235e9a105c250b288ad2e4c100f1db7abb
Backdoor.Backdoor.Downloadr.RT3eb68685746c80739a6cb87584122d33
Gen:Variant.Symm.661043c445c444c909e5359fa8c4972fd2245
Gen:Variant.Symm.66730c57d7381147cd3d1a6635d860c97d9a0
Backdoor.Backdoor.Dlf.AASQd1c35ff526fc5b5866b889d9957ca361
PE.PE.Mailpassviw.G5e59d5f0eeb20fa9f598d56284fada98
Backdoor.Backdoor.Dlf.AASQ841d1f4c2f091cab12ca1447523d52fa
Backdoor.Backdoor.Dlf.AASQaa5699aeadd6044b7e8a7e53f37ede33
Backdoor.Backdoor.Dlf.AASQ272c2175a9c770f8701a782a905377f6
Backdoor.Generckd.34260019e16806e69a0e6e6366306a2d740d863

The Netskope Active Platform is the only product that can provide deep insight into cloud apps. A customer can effectively block the suspicious files moving in and out of multiple cloud apps. In the case of CloudSquirrel, customers can leverage the custom DLP rule to detect and block files from being downloaded/uploaded that have the following extensions “..Docx.zip”, “..Docx.jar”, “__Docx.jar”,  “(docx)-pdf.jar”, ”(XLS)-xml4.jar” and also detect files that are within container files (zip, jar, tar, gzip, etc.) having the following“..Docx.jar”, “__Docx.jar” and “..”  in filenames. These policy alerts appear as shown in Figure 18 below:
CSfigure18

CSfigure19

Figure 18: Policy alerts indicating suspicious files being transferred via Cloud applications.

Netskope also notified the cloud app vendors ServInt, CloudApp, Amazon AWS, and Dropbox to take down the necessary files and URLs related to CloudSquirrel. Please contact us for the IOCs, additional details, or any other consultation related to CloudSquirrel.

Summary Observations

Malware authors are aggressively using cloud apps in various stages of the malware attack kill chain. The CloudSquirrel campaign highlights the use of cloud apps for hosting drive-by-download files and, most importantly, to host command and control configuration data. A significant motivation for malware authors to use cloud apps (especially mainstream ones) is due to the fact that many enterprises lack visibility into SSL traffic by traditional perimeter security vendors like firewalls and proxies. Enterprises – many of whom need to offer access to popular cloud services – are caught between a rock and a hard place, and often forced to allow these services in the first place, or at least make exceptions for them if blocked. This makes popular cloud services especially susceptible to the use by malicious actors in the malware attack kill chain.

author image
Ashwin Vamshi
Ashwin Vamshi is a Security Researcher with innate interest in targeted attacks and malwares using cloud services.

Stay informed!

Suscríbase para recibir lo último del blog de Netskope