Malicious PNG: "demon" hidden in Images"

Malicious PNG: "demon" hidden in Images"

In the constant battle of Internet security, cyber attackers have been constantly improving their attack technologies. Security researchers found that the latest Graftor Trojan variant can embed malicious DLL files into PNG images, and then use images as the carrier to hide and download malicious DLL files to the target system, and can avoid detection of antivirus software. For the samples in this article, malicious content is embedded at the end of the actual PNG image data.

Advertising software, or even genuine software bound to malware, is increasingly used as a Means by attackers to initially access the target user system. In these cases, users are induced to access some malicious websites or install some software. In the sample analyzed this time, after accessing the system, malware downloads a PNG file containing malicious DLL and other executable content, the PNG file is used for further exploitation. Among them, the download of PNG files occurs in the system background, without interacting with users, and malicious content is hidden at the end of the PNG file, in this way, attackers try to bypass system and network security detection.

Intended to steal user input data

In the samples analyzed in March, malware first attempted to download malicious PNG images from the HTTP: // 174.128.244.58: 808 toopu.png website through http requests, as shown in the analysis code.

A dll file is appended to the end of the toopu.png file, which is not obfuscated or hidden in any way, but only appended to the IEND mark of the PNG file, generally, the IEND mark indicates the end of the image file.

By searching for virustotal, you can find that toopu.png is closely related to more than one thousand samples, and these samples also use malicious content in the PNG file. We can see that the toopu.png file is downloaded from 192.253.234.50. In addition, we also found that the attacker also used his/her own PNG files, such as khbgvkh.pngand test.png files. In the sample we analyzed, VT indicates that it hooks functions related to keyboard and mouse operations. You can simply find some strings such as "ActiveOfflineKeyLogger" and "UnActiveOfflineKeyLogger" in the content added to the test.png file, indicating that the malware does try to obtain the keyboard data entered by the user.

Modify host files

By detecting samples of other toopu.png files mounted to virustotal, attackers can also find another common technique, that is, modifying the content of local host files and directing URLs of different anti-virus vendors to local hosts to prevent local hosts from accessing these URLs. In one sample, the content of the host file (hosts) modified by malware is as follows:

 

 

Analysis is used to construct an HTTP request to obtain malicious PNG files. It seems that this function lacks some functions. The response request contains only empty referrer and cookie headers.

Malware Execution Process

If this function fails to retrieve the PNG file, it will sleep for a period of time and then request again. Once a PNG file is obtained, the retrieval function performs some basic verification operations to ensure that the correct image file is obtained. The sample detects the "200 OK" response and checks whether the file length is 0x41EA9 (269993), and then moves to the embedded DLL file to start offset 0xEA9 (3753 ).

The embedded DLL file actually contains some C & C functions. The type and cr parameters in the function are hardcoded into "loadall" and "yes ".

UPX shelling File Content

 

The PNG file also contains an UPX shelling file, which contains a list of domain names and user proxies. the domain names corresponding to C & C include:

Niudoudou.comfxxx114.comwlkan.cnit885.com.cnaquametron.com

The user agent contained in the shell file is unique. One of them lists the outdated versions of Chrome, the other two lists the two versions of IE, And the other lists the IE11 and Firefox browsers.

Chrome user proxy (Chrome's current version is 41) is:

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/534.15 (KHTML, like Gecko) Chrome/10.0.612.1Safari/534.15

The two IE user proxies are:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT5.1; SV1); Maxthon/3.0) mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT5.1; SV1); 360SE)

Firefox user agent:

Mozilla/5.0 (Windows NT 5.1; rv:11.0) Gecko/20100101Firefox/24.0

IOC hash value:

Renewal Domain Name:

Niudoudou.comfxxx114.comwlkan.cnit885.com.cnaquametron.com

IP Address:

174.128.244.58192.253.234.50 conclusion

Bundling malware and other advertising software is becoming increasingly common attack methods. The initial detection rate of these PNG files embedded with malicious code is very low, as is the sample analyzed in this article. Therefore, users must always be vigilant against installing other software or accessing malicious websites. In addition, a layered security method can help reduce this threat by limiting the background access to malicious websites and blocking them before malware runs.