The Latest in IT Security

ARBOR SERT – Trojan.Prinimalka is a banking trojan associated with an attack campaign that received quite a bit of press in October 2012. “Project Blitzkrieg” is “a new cybecriminal [sic] project aimed at recruiting 100 botmasters to help launch a series of lucrative online heists targeting 30 U.S. banks. The Trojan installs a proxy on the victim host and then sends system/web browser details back to the C&C. The botmasters can use this setup to “spoof” banking requests as the unsuspecting banking user.

Trojan.Prinimalka is based on Gozi and shares quite a few similarities. There are at least 2 variants in the wild: “nah” and “gov”. This analysis focuses on the “gov” version. Static analysis was performed on a memory dump of a sample (MD5: 2bdb44e5e3bbcebf3f0ceb156a407794). It was supplemented with some dynamic analysis using C&Cs located at 193.xxx.92.xxx (as of writing, still live) and 213.155.28.104.

Registry Persistence
A value named “govShell” is created under the “HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” key. It stores “%UserProfile%\govXXXX.exe”-the “X”s are random lowercase letters. This is a standard registry persistence technique where the program will run on user login.

Mutexes
A mutex named “sdfsdfsdfsdfsfsdfsdfsdfsdfsdf” is created.

Dropped Files

• %UserProfile%\govXXXX.exe-the “X”s are random lowercase letters
• %UserProfile%\govtemp1.exe
• %UserProfile%\govold.exe
• %UserProfile%\govcookies.txt
• %CD%\govcookies.dat

Registry Configuration
Under the “HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion” key, various configuration values with a “gov” prefix are maintained.

Bindshell
“cmd.exe” is bound to “127.0.0.1” on a random port. The bindshell is used in conjunction with the Type 2 “TELN” command.

Proxy
A basic proxy is bound to “127.0.0.1” on a random port-bindshell’s random port minus 1.  The proxy is used in conjunction with the Type 2 “SCKS” command. RSA indicates that the C&C backend has the ability to make web requests to banking websites via the infected host.

C&C Command Channel, Type 1
A Type 1 command request looks like this.

The returned command grammar has the following format.

Here are the identified commands.

C&C Command Channel, Type 2

The Type 2 command channel is a reverse connection from the victim host back to the C&C. It is enabled by the Type 1 “enable_backconnect” command. There isn’t much of a format, the victim host reads 4 bytes from the socket and checks them against the following identified commands.

Configuration
There is an 81 byte obfuscated configuration file stored in the binary. It is copied to the “govoptions” registry value. Using corkami’s aplib compression library, the obfuscation can be cleaned up.

Here are the identified configuration verbs.

An updated, obfuscated configuration file can be requested from the C&C like this.

The “3rep” sections of the configuration file define “find and replace” rules. These are used with the web browser function-hooking feature to secretly add code to banking websites. At the time of writing, 34 bank URLs are being targeted:

• -investing.schwab.com/trading/start
• -www.schwab.com
• bankofamerica.com/accounts-overview/accounts-overview.go
• chaseonline.chase.com/MyAccounts.aspx
• client.schwab.com/Accounts/Summary/Summary
• etrade.com/e/t/accounts/accountscombo
• fidelity.com/ftgw/fbc/ofsummary/defaultPage
• ibanking-services.com/cib/CEBMainServlet/AccountOverview
• investing.schwab.com/secure/schwab/
• investor.firstrade.com/firstrade/mainmenu.do
• myaccountsaws.navyfcu.org/nfoaa/main
• online.citibank.com/US/JPS/portal/Home.do
• online.wamu.com/Servicing/Servicing.aspx?targetPage=AccountSummary
• online.wellsfargo.com/das/cgi-bin/session.cgi
• onlineaccess.ncsecu.org/accounts/balances.aspx
• onlinebanking.capitalone.com/CapitalOne/Accounts/
• onlinebanking.huntington.com/Accounts/Accounts.asp
• onlinebanking.mandtbank.com/summary/AccountSummary.aspx
• onlinebanking.pnc.com/alservlet/
• onlinebanking.tdbank.com/accts/getAccts.asp?fname=
• secure.accurint.com
• securebank.regions.com/balances/AccountSummary.aspx
• sharebuilder.com/sharebuilder/Home.aspx
• suntrust.com/portal/server.pt
• trading.scottrade.com/home/default.aspx
• us.hsbc.com/1/2/
• usaa.com/inet/ent_home/CpHome
• usbank.com/internetBanking/RequestRouter
• wachovia.com/MyAccounts.aspx
• www.53.com/servlet/efsonline/index.html
• www.americanfunds.com/account/account-summary.htm
• www.optionsxpress.com/
• www.paypal.com/us/cgi-bin/webscr
• wwws.ameritrade.com/cgi-bin/apps/u/Home

A sample find and replace rule looks like this.

As can be seen, code is added to the end of the page to POST balance, bank name, and last login information to “/robots.txt”. The “/robots.txt” is used as a tag, see below.

Process Injection and Function Hooking

The Trojan injects part of itself into all running processes except for those with an image name starting with:

• svchost.exe
• [System Process]
• System
• smss.exe
• winlogon.exe
• lsass.exe
• avp
• csrss.exe
• services.exe

The injected function is responsible for hooking the following functions.

The CreateProcess hooks make sure any new processes are injected.

The FindXFile hooks hide any files that start with “gov”.

The RegEnumValue hooks hide any registry values that start with “gov”.

The InternetReadFile and PR_Read hooks are used to rewrite pieces of returned banking websites based on the “3rep” rules in the configuration file.

The HttpSendRequest and PR_Write functions look for the “/robots.txt” tag introduced by the “3rep” rewrite rules.  They then POST the HTTP request and cookie file to the C&C.

System/Web Browser Cloning

RSA indicates that the C&C backend has the ability to clone a victim’s web browser while sending requests through the victim host’s proxy. The following shows the type of data the trojan gathers for this feature.