On June 30, 2016, Cyphort Labs discovered an infection via malvertising on the website trendystyleshop.com. According to Domain Tools, the site was registered in February 2016 under namecheap.com. What draw our interest to this infection is that it installs TeamViewer, a popular remote application tool which is widely used in enterprises. It makes sense for cyber criminals to use it because it is a good way to masquerade backdoor access as it blends with other users using the same app. You probably recall that a month ago a major hack of TeamViewer accounts was reported on various news outlets.
The affected ad network is “nanoadexchange.com”. It advertises a game from “uphillrush.pro” but the ad is injected with an iframe that redirects to “aga111.pro” then redirects to “jnqedq.lswswc.xyz” which is hosting a Flash exploit kit.
After successful exploitation, it downloads an Andromeda bot from the same domain. The binary arrives encrypted over the network.
The bot is installed in the %APPDATA% folder and filename starting with ms*.exe. Example:
As a persistence method, it will spawn a new process of “msiexec.exe” and inject its code. However, it will not install itself if the following processes are found as part of its Anti-Sandbox and Anti-Analysis trick:
However, it ignores the process blacklisting check when the following registry key is present:
- HKLM \ SOFTWARE\Policies\is_not_vm
Andromeda has been around since 2011. It is a modular type of malware with the following known types:
- Browser Form Grabber
- Hidden TeamViewer
For this infection, we have seen it installing additional modules from vbbb.ru including Browser Form Grabber and Hidden TeamViewer.
The above image shows the communication to the CnC server. Bmla.ru is encrypted via RC4 where the key is hardcoded in the malware body. Download domain is at vbbb.ru but both are with the same IP address, 22.214.171.124.
As part of its routine, Andromeda gets the current time via NTP (Network Time Protocol) domains. It connects to the following NTP domains:
Is Andromeda On the Rise Again?
Using the IP of the CnC 126.96.36.199, we gathered some domains resolved from it. We found that it is actively using the .ru TLD with 4 random letters as domain and usually having the last 3 letters the same. It also shows that this pattern has been active since April 10, 2016.
We also discovered that one of the IPs used by Andromeda is actively used by Cerber ransomware, a ransomware infection used to encrypt that . For instance, znnn.ru was registered with the following IP addresses sometime in May 2016.
It is unclear to us how the installation of TeamViewer is being exploited at this time by the actors behind this campaign, but it clearly is a major compromise that opens the door to a lot of possibilities. Cyphort Labs will continue to monitor and report any new developments.
|45959b3d2bde20435a9aeed861046506||%TEMP%\msiexec.exe||Team Viewer Module|