Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV

End of Bibblio RCM includes -->
1/2/2020
09:25 AM
Larry Loeb
Larry Loeb
Larry Loeb

Fortinet Finds Loader Uses Updated Version of Backdoor

Security firm Fortinet has found traces of how the financially motivated FIN7 group manages to keep on delivering the Carbanak backdoor malware.

When malware has been around for a while, its authors are faced with the need for its maintenance if they want it to continue to succeed in their criminal activity.

Security firm Fortinet has found traces of how the financially motivated FIN7 group does this kind of maintenance on delivering the Carbanak backdoor malware.

FireEye has already looked at one way that FIN7 does this with its BOOSTWRITE loader tool. Fortinet found that the predecessor BIOLOAD tool is a loader as well, but with a different and singular payload. BIOLOAD is not as easily detected as BOOSTWRITE but has the same end effect.

The malware subverts the normal way that Windows will load a Dynamic Linked Library (DLL), by a technique known as DLL search order hijacking (or binary planting). In this case, the attackers use FaceFodUninstaller.exe. This exists on a clean OS installation starting from Windows 10 RS4 (1803) at the "%WINDR%\System32\WinBioPlugIns" folder. The executable is also dependent on winbio.dll, which is usually found in the parent directory ("%WINDR%\System32").

The uninstaller program is started by a built-in scheduled task named FODCleanupTask, which minimizes the attacker's footprint on the machine and therefore reduces the chances of detection even further.\r\nBIOLOAD has the encrypted payload DLL embedded in it. Unlike BOOSTWRITE, it does not support multiple payloads. Decrypting the payload is done by a simple XOR decryption. This is a key point, because it implies that BIOLOAD is tailor-made for every machine it infects. It will use the machine name to derive the decryption key. This means that it does not need to access a remote server in order to fetch the key.

The attacker places the resultant malicious WinBio.dll in the "\System32\WinBioPlugIns" folder, which is home of the legitimate DLL "winbio".

Fortinet says that, "The samples [that they found] target a 64-bit OS and were compiled in March and July of 2019. BOOSTWRITE targets 32-bit machines and was compiled (and signed) in May 2019."

Fortinet also found that BIOLOAD contained newer builds of the Carbanak backdoor than BOOSTWRITE. They were dated January and April of 2019, according to their timestamps. This version checks to see if another Anti-Virus (AV) is running on the machine, besides Kaspersky, AVG and TrendMicro. The result, however, has no effect on the operations of the backdoor.

BIOLOAD has the characteristic of being the first public case of FaceFodUninstaller.exe being abused as host process by a threat actor.

Also, BIOLOAD shows that the attackers are specifically building infections for each targeted machine as well as somehow obtaining the needed administrative permissions to deploy it. This implies that the group needs to gather other critical information about its targets' networks in order to carry out the attack.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-2287
PUBLISHED: 2022-07-02
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.
CVE-2022-34911
PUBLISHED: 2022-07-02
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the usern...
CVE-2022-34912
PUBLISHED: 2022-07-02
An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.
CVE-2022-34913
PUBLISHED: 2022-07-02
** DISPUTED ** md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input.
CVE-2022-2286
PUBLISHED: 2022-07-02
Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.