Tag Archives: worm

The Java Autorun Worm, Java.Cogyeka (3 of 3)

As I wrote in parts one and two of this series of blogs, Java.Cogyeka uses an autorun.inf file to propagate and download an additional module. I was able to get the downloaded module, based on a Java application, even though it took over a week because of the difficulty in establishing a connection with the server. The downloaded module, like the main module, tries to protect itself through obfuscation with Zelix KlassMaster. After investigating the downloaded module, I discovered that the purpose of Java.Cogyeka is to steal information from a video game on the compromised computer.

The targeted game
The game being targeted by Java.Cogyeka is League of Legends, a free-to-play video game published by Riot Games. While the game is free-to-play, users can purchase additional characters and character skins with real money. Java.Cogyeka may target League of Legends because of these real money transactions.

Infostealer
The downloaded module attempts to steal the League of Legends player’s account information and keystrokes to gain control of their account. While the purpose of the threat is to steal information related to the League of Legends game, it may also steal additional information because of its keystroke-stealing capabilities.

Stealing keystrokes
The downloaded module drops two types of DLL files, a 32-bit version and a 64-bit version. This is done using the same technique that the threat uses for obtaining the drive letters of the removal drive in the main module, as described in the second Java.Cogyeka blog. The Java system does not permit Java applications to obtain keystroke information from other processes. The malware may steal passwords, but it needs a native call, so it drops the Windows DLL file from the Java application.

The SetWindowsHookEx API is used to log keystrokes and mouse operations while WH_KEYBOARD_LL and WH_MOUSE_LL are used as hook types. The stolen keystrokes and mouse operations are then sent to a remote server.

Fig1_1.png

Figure 1. Downloaded module steals keystrokes and mouse operations

Stealing account information
The malware steals keystrokes in the hopes of obtaining a player’s League of Legends user name and password. However, the League of Legends login window has an option to remember a player’s user name and, if a player has selected this option, Java.Cogyeka cannot obtain the player’s user name. To get around this, the malware also attempts to steal a file that contains the user’s account information.

Fig2_0.png

Figure 2. League of Legends login screen

To steal the user’s account information, the malware tries to search for the following folder on all drives:

  • Riot Games/League of Legends/RADS/projects/lol_air_client/releases

This folder contains a folder with the name of the version number of the game, for example “0.1.2.0.” The malware traverses folders at the version folder searching for the following path:

  • deploy/preferences/global/global.properties

This file contains the game settings as well as the player’s user name that is used to log in to the game.

Sending the stolen information
Once the downloaded module has obtained the login information, it sends it to the domain Jkl.no-ip.biz on TCP port 1087.

This server name has been deactivated and is no longer accessible. However, both the server name and port number are hardcoded into the module unlike the command-and-control server name and port number, and the stolen information is encrypted.

Fig3.png

Figure 3. Malware observed worldwide as the targeted game is played all over the world

Conclusion
In this series of blogs, I have discussed the propagation and information-stealing functions of Java.Cogyeka and how it uses an obfuscation tool to protect itself from detection by security scanners. While the malware has a specific target, the video game League of Legends, other information may also be stolen through the captured keystrokes and mouse operations. Java.Cogyeka may also update itself because it downloads an additional Java module. We will continue to observe and investigate this malware.

I am left wondering why the malware requires the USB spreading functionality. The purpose of this malware is to steal information from an online game. The League of Legends is a type of game whereby users connect to a game server in order to play online. There is a possibility that it attempts to infect computers at Internet cafés. In this case, game players or administrators of the Internet café may use a USB storage device. On the other hand, a user may play the game with his or her friends at the same place and use USB storage devices to share files. It is possible that the malware aims to take advantage of such a situation.

Symantec detects these files as Java.Cogyeka, Java.Cogyeka!autorun, and Java.Cogyeka!gen1. We recommend  that users keep their security software up to date.

The Java Autorun Worm, Java.Cogyeka (2 of 3)

Obfuscations
In my previous blog, I discussed some stealth techniques Java.Cogyeka uses. These stealth techniques are not effective at deceiving users or security researchers, but their use proves that Java malware is continuously improving.

Aside from the stealth techniques, Java.Cogyeka is designed to evade security researchers through various obfuscation techniques. Some are effective, some are overdone. Overdone obfuscation techniques will often cause malware to be less effective.

Java.Cogyeka uses three obfuscation techniques:

1. Autorun.inf obfuscation
The autorun.inf file helps Java.Cogyeka spread through removable drives. This file is made up of three parts:

  1. Action
  2. Icon
  3. ShellExecute

It must contain a ShellExecute function in order to execute itself in the removable drive Recycler folder. As I wrote in my previous blog, Java.Cogyeka employs a folder icon and also displays the message “Open folder to view files.”

Java.Cogyeka uses an obfuscation technique to ensure that security scanners do not detect autorun.inf. The obfuscation technique inserts garbage between entries. The garbage consists of a control character between 0x00 and 0x1F. This obfuscation technique is often found in malicious .inf or .html files.

Figure1_3.png

Figure 1. Obfuscation technique fills in garbage

Uppercase and lowercase capitalization is used randomly in the ASCII characters to create inconsistency. The volume of the garbage is between 0 and 50 bytes and it is in clusters located alongside the tokens in a crafted autorun.inf file. Symantec detects the autorun.inf file crafted by Java.Cogyeka as Java.Cogyeka!autorun.

2. Zelix obfuscation tool
This Java malware spreads itself as a JAR file with 15 class files (a.class to o.class). Originally, these classes may have been named based on the functionality of each class. The Java obfuscation tool—named Zelix KlassMaster—modifies class names, method names, Java byte codes, and strings.

Figure2_1.png

Figure 2. Zelix bitmap of encrypted and decrypted strings with XOR table

The Java obfuscation tool is not malware but rather a legitimate tool. Java developers may want to hide important data and code in Java class files. It is difficult to decompile a Java class file if Zelix obfuscation has been applied.

Java.Cogyeka is not the only object to use this tool; many malicious Java applets that exploit Java vulnerabilities, for instance, are also use this tool.

3. Network connection obfuscation
Determine server name and port number

To download an additional module from the command-and-control (C&C) server, Java.Cogyeka has to connect to it. However, it is difficult to successfully connect an existing server while also attempting to connect many fake servers. It takes a long time to download an additional module this way. The difficulty results from the complicated server name and port number.

The C&C server’s host name is made up of five to eight random letters and the randomly selected domain is based on a dynamic DNS. A random seed based on the time the malware is run is used to select the random letters. The domain is selected from 22 famous dynamic services by the same random seed used to obtain the random letters.  The port number is also randomly generated by the same random seed. The seed number is based on a 64-bit integer.

Figure3_1.png

Figure 3. Random seed used to determine host name, domain name, and port number

There is a possibility that the generated C&C server name is the same as a legitimate one hosted by another user in the dynamic DNS service. If so, the malware tries to connect the server name with a generated TCP port number. If the server denies connection with the port the connection will be closed immediately, but the malware has to wait until it knows the connection cannot be established.

Negotiation
The protocol used to download an additional module is the original one, but it is obfuscated. The protocol will likely establish a secure connection because it uses a stream cipher created by a pseudo-random generator.

Java.Cogyeka and the server program have the same random seed and pseudo-random generator. The malware negotiates by exchanging two byte streams.

Figure4_1.png

Figure 4. Java.Cogyeka and server program negotiation

Java.Cogyeka generates the first byte stream, and its length, with a pseudo-random generator and then sends it to the server through a TCP connection. The server then receives the data. If the server was created by the malware author, the server program runs and has the same random seed and pseudo-random generator as the malware. The server can verify the byte stream, and the length, by using the same generator. To perform a double check, the server creates a second byte stream. The malware receives the second byte stream and verifies the data with a byte stream it has generated.

If the negotiation is successful, the malware has confirmed the server has the same random seed and pseudo-random generator.

Downloading a module
After a successful negotiation Java.Cogyeka downloads the settings, including the size of the module to download, but the settings are encrypted by the stream cipher. After obtaining the size, it downloads a module encrypted by the stream cipher. The settings include a hash value of the downloaded module. The malware can make sure the download is successful by using SHA-512.

Made with a purpose
I discussed three obfuscation techniques used by Java.Cogyeka. The obfuscation techniques used by the malware are somewhat complicated, but the autorun.inf file in the malware should be easy to detect by security scanners. Part of the obfuscation technique used for the server name and port number is ineffective because of too much obfuscation. The streaming cipher may be effective against network-type security scanners. This obfuscation technique demonstrates that this malware was not created as a hobby, but instead, made with a specific purpose.

To be concluded…
The third and final blog in this series will show the purpose of the malware as well as what information it obtains and how it obtains it.

Java Autorun ??? Java.Cogyeka?? 1 ??

Java.Cogyeka
最近、Java の脆弱性が大きく注目を集めています。脆弱性がマルウェア作成の引き金になる経緯も話題になっていますが、マルウェアが存在するには必ずしも脆弱性が必要なわけではないことに注意してください。Java.Cogyeka がまさにそのケースです。Java.Cogyeka は、Java の脆弱性こそ悪用していませんが、それ自体は Java で書かれており、多くの悪質な活動を実行します。このブログシリーズでは、その悪質な活動について詳しく説明します。

Java.Cogyeka は 2012 年 6 月に発見され、今もなお活動中です。このマルウェアには以下のように 5 つの機能があり、それぞれについて解説します。

  1. autorun.inf を通じた拡散
  2. ステルス技術
  3. ダウンローダ機能
  4. 不明瞭化
  5. Infostealer 機能

これまでに見られた他の Java マルウェアでも、悪質な機能がここまで複合していた例はありません。悪質なプログラムで Java を見かける場合、その唯一の目的は他のマルウェアをダウンロードすることであり、それ以降の悪質な処理は他のマルウェアによって実行されるのが一般的です。ところが、Java.Cogyeka はそれ自体が悪質なプログラムであり、独自の目的も持っています。追加の悪質なモジュールを必要とせず、Java コード自体が悪質な活動の実行に使われます。これまでに見てきた Java マルウェアの中で、Java.Cogyeka が最も総合的なマルウェアと言えるのはこのためです。

今回は、3 回シリーズの第 1 回目として、この Java.Cogyeka の以下の特徴について説明します。

  • autorun.inf ファイルを通じた拡散
  • ステルス技術
  • ダウンローダ機能

残りの機能、不明瞭化と Infostealer 機能については、次回以降のブログで説明します。

autorun.inf ファイルを通じた拡散
上述のように、このワームは autorun.inf を使って拡散し、以下の形式のファイル名でリムーバブルドライブに自身をコピーしようとします。

  • %DriveLetter%:\RECYCLER\[SID]\[ランダムなファイル名].[ランダムな 3 文字の拡張子]

次に、リムーバブルドライブのルートフォルダに autorun.inf ファイルをコピーしようとします。これは、リムーバブルドライブが他のコンピュータに接続されたとき常にワームを実行するためです。

技術的には、リムーバブルドライブ上に autorun.inf ファイルを作成するときには問題が発生します。設計上、Java はサンドボックス内で動作し、オペレーティングシステムのリソースと直接やり取りすることができないためです。そのため、Java アプリケーションが直接リムーバブルドライブのドライブ名を決定することはできず、JNI(Java Native Interface)を利用してこの問題を解決します。Java.Cogyeka ワームが autorun.inf ファイルを保存して実際に利用するには、リムーバブルドライブのドライブ名を知る必要があります。この問題を解決するために、Java.Cogyeka はネイティブ WIN32 API の GetDriveType メソッドを呼び出そうとします。このとき使われるのは、マルウェア作成者がこのために特別に作成した Windows バイナリ DLL ファイルです。次に、JNI を利用する Java コードが、この DLL に間接的にアクセスします。シマンテックは、この悪質な DLL ファイルも Java.Cogyeka として検出します。

Determining_the_name_of_removable_drives_243px.png

図 1. リムーバブルドライブの名前の決定

ステルス技術
Java.Cogyeka は、コンピュータに侵入するとき一種のステルス技術を使います。と言っても、それらの技術が侵入先のコンピュータのユーザーを本当に欺くものかどうかは疑わしく、またセキュリティ製品を欺けるかどうかも疑問です。この脅威で用いられているステルス技術は 3 つあります。

リムーバブルドライブのアイコンの偽装
このマルウェアに侵入されたリムーバブルドライブは、ドライブのアイコンがフォルダアイコンに変更されます。ドライブのアイコンを変えるのは簡単で、このマルウェアも autorun.inf ファイルに “icon=[アイコン画像のパス]” という文字列を追加しているだけです。このマルウェアは、shell32.dll ファイルのフォルダアイコンを利用しています。

Java_Cogyeka_1_of_3_1_edit.png

図 2. アイコンが変更されたリムーバブルドライブ

偽装の手口としては、実行可能ファイルのアイコンを変更する方法が有名です。実行可能ファイルが Microsoft Office Word や Adobe PDF のような文書ファイルのアイコンになっていると、ユーザーはそれを文書ファイルと信じてしまいます。しかし、リムーバブルドライブのアイコンを変更するというのは話が別です。このマルウェアがリムーバブルドライブのアイコンを変更する理由はわかりませんが、これも無意味なステルス技術のひとつにすぎません。侵入先のコンピュータでこのようなアイコンが見つかった場合に、マルウェアに感染した証拠になるくらいでしょう。

コピーではなく再圧縮
このマルウェアは自身をコピーすると述べましたが、それは正確ではありません。実際には、自身を以下の場所に再圧縮します。

  • %Temp%\jar_cache[ランダムな数字].tmp

Java.Cogyeka は、JAR ファイルとして自身を拡散します。具体的には、ランダムなバイトを追加して JAR ファイルのハッシュ値を変更しようとする場合があります。JAR のファイル形式は Zip 形式に類似しており、Java のクラスを 1 つのファイルに圧縮するときに使われます。Java.Cogyeka は Zip ヘッダーの追加フィールドにランダムなバイトを追加しようとしますが、最近ではセキュリティソフトウェアのウイルススキャン機能によって Zip ファイルが解凍され、アーカイブ内のファイルもスキャンされます。そのため、JAR ファイル内の悪質な .class ファイルもスキャンされるので、たとえ JAR ファイルのハッシュ値が変更されていても検出されることになります。

したがって、JAR ファイルのハッシュ値を変更するという手口も意味がありません。

システムプロセスではなく java.exe
Java.Cogyeka は、java.exe を以下の場所にコピーします。

  •  %Temp%\hsperfdata_[ユーザー名]\[システム実行可能ファイル名].exe

システム実行可能ファイル名として、以下のいずれかが使われます。

  • csrss
  • explorer
  • lsass
  • services
  • smss
  • svchost
  • winlogon

explorer.exe 以外のプロセスは、たとえ管理者権限があったとしても、ユーザーが終了することはできません。マルウェアは、ワームが実行されているプロセスをユーザーには終了できないようにすることを狙っているのです。ところが、シマンテックの脅威情報に記載されているとおり、Java.Cogyeka は StubPath レジストリのサブキーで “javaw” を使っており、上記のいずれかのプロセスを表す “システムファイル名” を指定した “[システムファイル名].exe” を使っていません。このマルウェアがシステムプロセスとして実行されていることを発見した場合に、Windows のタスクマネージャを使ってマルウェアのプロセスを手動で停止することはできませんが、サードパーティ製のソフトウェアを使えばプロセスを終了できます。また、Symantec Endpoint Protectionノートン インターネットセキュリティノートン 360 は、起動後すぐにこのプロセスを自動的に終了することにも注目してください。

マルウェアの作成者はユーザーが手動でこのプロセスを終了することを妨げているつもりですが、その手口もとうてい成功しているとは言えません。

ダウンローダ機能
コンピュータに侵入した Java.Cogyeka は、サーバーに接続して追加のモジュールをダウンロードしようと試みます。このモジュールは明らかに JAR ファイルです。JAR ファイルをダウンロードしてクラスファイルをメモリ空間に解凍し、ClassLoader Java クラスを使ってロードします。任意のクラスをロードすれば、マルウェアの作成者は侵入先のコンピュータを制御できるようになります。Java.Cogyeka は、自身と他のモジュールの新機能を持つ更新もダウンロードできます。

次回は…
今回は、Java.Cogyeka の概要と、コンピュータに侵入するときの仕組みについて説明しました。次回は、このワームが使っている不明瞭化の手口と、そのメインモジュールについて説明します。

 

* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。

The Java Autorun Worm, Java.Cogyeka (1 of 3)

Java.Cogyeka
Recently there has been a lot of attention drawn to the vulnerabilities in Java and how they can lead to malware being created. However, it is worth noting that a vulnerability is not always required for malware to exist, as is the case with Java.Cogyeka. While this threat does not exploit any vulnerability in Java itself, it is written in the Java language and performs numerous malicious activities, which I intend to explore throughout this series of blogs.

Java.Cogyeka was discovered in July 2012 and is still active now. This malware has five features, which I have broken down into the following categories:

  1. Propagation through autorun.inf
  2. Stealth techniques
  3. Downloader functionality
  4. Obfuscation
  5. Infostealer functionality

Other Java malware we have seen does not have this combination of malicious features. Typically, when we encounter Java in a malicious program, its only purpose is to download other malware, which then performs further malicious actions. However, Java.Cogyeka is a malicious program in its own right and with its own purpose—the Java code itself is being used to perform malicious activities without requiring an additional malicious module. This makes it the most comprehensive Java-only malware that I have ever come across.

This is the first in a series of three blogs on Java.Cogyeka and in this blog I will discuss the following features:

  • Propagation through an autorun.inf file
  • Stealth techniques
  • Downloader functionality

The remaining functions, Obfuscation and Infostealer functionality, will be discussed in future blogs.

Propagation through an autorun.inf file
As previously mentioned, this worm uses autorun.inf to spread and attempts to copy itself to a removable drive using a file name in the following format:

  • %DriveLetter%:\RECYCLER\[SID]\[RANDOM FILE NAME].[THREE RANDOM LETTERS FILE EXTENSION]

It then attempts to copy an autorun.inf file to the root folder of the removal drive in order to execute the worm whenever the removable drive is inserted into another computer.

Technically, a problem exists when creating the autorun.inf file on the removable drive. By design, Java operates within a sandbox and cannot interact directly with the resources of the operating system. Because of this, a Java application cannot directly determine the drive letter of a removable drive, but the Java Native Interface (JNI) offers a possible solution to this problem. The worm needs to know the drive letter of a removable drive in order to store and use the autorun.inf file effectively. To solve this problem, it attempts to call a native WIN32 API method GetDriveType through a Windows binary DLL file that the malware author made specifically for this purpose. This DLL is then accessed indirectly by the Java code using JNI. Symantec also detects the malicious DLL file as Java.Cogyeka.

Determining_the_name_of_removable_drives_243px.png

Figure 1. Determining the name of the removable drive

Stealth techniques
Java.Cogyeka uses certain stealth techniques when compromising a computer. It is doubtful that these techniques successfully trick users of the compromised computer or fool security products for that matter. The threat uses three stealth techniques.

Compromised removable drive icon
The removable drive that is compromised by this malware has its drive icon changed to a folder icon. It is easy to change a drive icon, the malware simply adds “icon=[PATH OF ICON IMAGE]” to the autorun.inf file. This malware uses the folder icon from the shell32.dll file.

Java_Cogyeka_1_of_3_1_edit.png

Figure 2. Removable drive with changed icon

Changing the icon of an executable file is a well-known camouflage technique. If an executable file has a document file icon, like Microsoft Word or Adobe PDF, users may misidentify the executable file as a document file. However, changing the icon of a removable drive is a slightly different case. I do not know why the malware changes the icon of the removable drive, but this is one of the malware’s meaningless stealth techniques. If found on the compromised computer, it can be seen as a sign that the malware may be present.

Repacked, not copied
Previously, I stated that the malware copies itself, but this is not entirely accurate. The malware actually repacks itself to the following location:

  • %Temp%\jar_cache[RANDOM DIGITS].tmp

The malware spreads itself as a JAR file. It may try to change the hash value of the JAR file by adding random bytes. The JAR format is like a Zip format that is used to pack Java classes into one file. The malware attempts to add random bytes to an extra field in the Zip headers. However, most security vendor virus scanners can extract Zip files to scan files contained in the archive. They do this so that they can scan the malicious .class file within the JAR file and detect it even though the hash value of the JAR file has changed.

As a result, the malware’s modification of the hash value of the JAR file is meaningless.

java.exe instead of a system process
The malware copies java.exe to the following location:

  •  %Temp%\hsperfdata_[USER NAME]\[SYSTEM EXECUTABLE FILE NAME].exe

It uses one of the following system executable file names:

  • csrss
  • explorer
  • lsass
  • services
  • smss
  • svchost
  • winlogon

Users, even if they have administrator privileges, cannot end these processes, except for the explorer.exe process. The malware aims to deter users from ending the process that the worm is running on. However, it uses “javaw” in the StubPath registry subkey, as described in our detection write-up, instead of “[SYSTEM FILE NAME].exe” with “SYSTEM FILE NAME” representing one of the processes listed above. Users who find this malware running as a system process cannot manually end the malware process by using Windows Task Manager. Third-party software, however, can be used to end the process.  It is also worth noting that Symantec Endpoint Protection and Norton Internet Security/Norton 360 products will end this process automatically as soon as it starts.

While the malware author makes it inconvenient for users to end this process manually, the technique used is far from successful.

Downloader functionality
After the malware compromises a computer, it attempts to connect to a server in order to download an additional module. Apparently, this module is a JAR file. It downloads and extracts class files into its memory space and then loads them with the ClassLoader Java class. Through any class loading, a malware author can gain control of the compromised computer. The malware can also download updates with new features for itself or other modules.

To be continued…
This blog is an overview of Java.Cogyeka and how it works to compromise computers. The next blog in the series will discuss obfuscation techniques used by the worm as well as its main module.

Polymorphic AutoRun Worm Evolves and Obfuscates

Recently we have seen a spike in a Visual Basic 6-compiled AutoRun worm family. The family is both client- and server-side polymorphic. (For more on this family, refer to our VIL and Advisory entries.) The W32/Autorun.worm.aaeh family usually gets on a victim’s machine through email spam, Blacole drive-by downloads, or downloads by BackDoor-FJW. From a behavioral Read more…