cat _posts/2019-04-22-halykbank-en.md
22 April 2019Analysis of a phishing attack against Halyk Bank customers
I presented this at 2600 Qazaqstan (December 7, 2018). You can download the malware sample here. The password is infected. Use it at your own risk.
The following email, which included an ISO attachment, was sent to customers of Halyk Bank.
Title:
Email body:
The attached ISO image contains a file named Scan00987643.exe.
Why use an ISO file? The attackers may have been trying to evade detection in antivirus sandboxes.
VirusTotal results:
VirusTotal did not initially identify the malware correctly. We will see why later. First, let’s take a closer look at the file:
The executable is written in C# and obfuscated with .NET Reactor. We can remove the obfuscation with de4dot.
With that done, we can open the cleaned file in a hex editor and look for anomalies. One pattern immediately stands out:
This is most likely XOR-encoded data.
Static analysis revealed nothing else of interest, so let’s debug the sample with dnSpy, a .NET debugger and decompiler. dnSpy can edit an application’s code at runtime and supports applications built with .NET Framework, .NET Core, and Unity.
Opening the executable in dnSpy shows that it was not completely deobfuscated.
The decompiled code near the entry point shows that the malware loads another payload.
The Assembly.Load() call receives the malicious payload as a byte array. Because dnSpy lets us edit the code, we can intercept it.
We modify the loading routine so that it saves the payload to a file.
Hooray! We dumped the first payload!
The payload is also a C# executable and is obfuscated, although Detect It Easy did not identify the obfuscator.
At this point, we have an ISO image containing an obfuscated executable that loads another obfuscated executable.
We use de4dot again.
We load the resulting executable into dnSpy and inspect the code again. All of the malware’s strings are encoded and decoded at runtime.
The resources section contains Base64-encoded strings.
The payload copies itself to the Users directory under the name null and establishes persistence through an autorun entry.
A DLL is loaded from the resources and receives the decoded executable, also extracted from the resources, as an argument.
This obfuscated executable has an unusual name: Reborn stub.
I had heard the name before, so I searched for it.
The payload turned out to be the popular HawkEye keylogger. Instead of continuing the manual analysis, I used ANY.RUN for further dynamic analysis.
The RebornStub.exe execution chain:
This confirms that the sample is the HawkEye keylogger, which VirusTotal did not initially identify correctly.
The sample makes a suspicious outbound connection.
The malware loads a Mozilla DLL to steal saved Firefox passwords.
The overall execution flow:
