We’ve been closely monitoring an information stealer called ViperSoftX. ViperSoftX was first reported on Twitter in 2020, and by Fortinet in the same year. Some aspects of ViperSoftX were also described previously by Colin Cowie. However, it has undergone very intensive development since then, intensifying throughout 2022. The malware authors’ constant game of hide-and-seek in which they continually improve their strategies and techniques to avoid detections shows no signs of stopping. We, therefore, decided to put the pieces together to provide a comprehensive analysis.

This multi-stage stealer exhibits interesting hiding capabilities, concealed as small PowerShell scripts on a single line in the middle of otherwise innocent-looking large log files, among others. ViperSoftX focuses on stealing cryptocurrencies, clipboard swapping, fingerprinting the infected machine, as well as downloading and executing arbitrary additional payloads, or executing commands.

One of the payloads ViperSoftX distributes is a specific information stealer in the form of a browser extension for Chromium-based browsers. Due to its standalone capabilities and uniqueness, we decided to give it its own name, VenomSoftX. The malicious extension provides full access to every page the victim visits, carries out man-in-the-browser attacks to perform cryptocurrency addresses swapping by tampering with API requests’ data on popular cryptocurrency exchanges, steals credentials and clipboard content, tampers with crypto addresses on visited websites, reports events using MQTT to the C&C server, and more.

ViperSoftX is mostly spread via cracked software such as Adobe Illustrator, Corel Video Studio, Microsoft Office, and more, commonly distributed over torrents.

Campaign overview

Since the beginning of 2022, we have protected more than 93,000 of our users. As the malware is mostly spread via torrents and software-sharing sites, ViperSoftX activity is distributed all over the world. The most impacted countries are India (7,000+), USA (6,000+), and Italy (5,000+).

Monetary gain

Both ViperSoftX and VenomSoftX focus on stealing cryptocurrencies from infected computers, either by scanning local files or by using more sophisticated techniques. In the table below, we show an estimation of the attackers’ total earnings for relevant cryptocurrency wallets.

Cryptocurrency	Earnings in cryptocurrency	~Earning in USD
Bitcoin	5.947 BTC	$116,812.81
Ethereum	5.312 ETH	$7,826.13
Dogecoin	34,355.528 DOGE	$3,474.47
Bitcoin Cach	9.11997194 BCH	$1,021.39
Cosmos (ATOM)	65.153 ATOM	$846.44
Tezos	191.445553 XTZ	$241.32
Dash	4.72446445 DASH	$199

Table with monetary gain (data refreshed 2022-11-08)

The amounts in the wallets ViperSoftX and VenomSoftX redirect stolen cryptocurrencies to add up to about $130,421.56, as of November 8, 2022. This is just the amount sent to cryptocurrency wallets, and doesn’t include other possible profits from other activities.

Technical analysis

Overview of the infection chain

From cracked software to fake logs

In the beginning, ViperSoftX is served to victims when they download what they believe to be cracked software. It is commonly named Activator.exe or Patch.exe. Upon execution, however, the victim is infected with ViperSoftX.

Activator.exe extraction

Activator.exe is in fact a loader that decrypts data from itself using AES in CBC mode.

The decryption algorithm performs a checksum as follows:

1. Read 4 bytes at offset 0x24 from the end of the file which gives an offset
2. Hash the offset value using SHA256
3. Read the rest of the bytes (from -0x20) and compare it to the hash

If the checksum holds, the offset points to the location where the data is stored at offset+0x24 from the end of the binary. Since the data is stored from the end of the binary, offset is also the size of the data blob. This blob can be decrypted straight away using a hardcoded key as well as IV inside the binary:

Key	71C54C3BCFFCE591A70C0B5BA6448327BC975D89F3021053125F1CB9A7C0AF72
IV	C0BA0B56EAC742AFD4CB680EE0EB4FB0

The decrypted data blob is a serialized protocol buffer structure. The structure template contains two protobuf messages as shown below:

We can use this template to deserialize the structure, revealing five different files:

• A log file with a hidden additional payload resulting in the ViperSoftX PowerShell (see next subsections)
• XML file for the task scheduler
• SyncAppvPublishingServer.vbs (clean) that is used to create a scheduled task for persistence
• Application binary (usually clean) that is supposed to be cracked
• Manifest file

Last but not least, you can find the extraction Python script in our GitHub repository.

Analyzing the files

The most interesting file is the aforementioned “log file” which is usually more than 5 MB in size and contains a single malicious line of code (usually from 17,302 lines in total, but this might vary in different versions).

This log file is usually named and stored as:
C:\Windows\Logs\system-logs.txt
although we saw variants dropping the same “log” files disguising as a “driver” or a “text” file, e.g.
C:\Windows\System32\Drivers\p4kizn\e12de1ae-2139-45f6-b883-3c58243f23d6.sys
C:\Windows\2ZQ2UoL\5A7C4B54-4404-4424-83DA-CC696BED43D3.txt
where the subfolder names and the GUIDs are randomized.

An example of such a malicious line can be found below. As we will see later, this line actually contains a script that is decoded and executed.

The malware creates a scheduled task using the legacy SyncAppvPublishingServer.vbs script for executing these hidden scripts afterward as well for ensuring persistence. Note that the line number varies depending on the malware configuration provided in the scheduled task.

Hidden Script Variants

We have seen two variants of hidden scripts lurking in the logs so far.

The first variant is a simple dropper that downloads another payload from a hardcoded C&C server and executes it. We have only seen the ViperSoftX information stealer downloaded as a payload so far. We will cover the stealer separately in the subsection below.

The second variant is in the form of a PowerShell script without the encoding. This script contains two parts, the first one is a set of decryption functions and the second is an encrypted data blob.

The script uses AES in CBC mode to decrypt the payload, the ViperSoftX stealer. The AES key is passed via the command line by the scheduled task created by Activator.exe. You can find the decryption process in this CyberChef template.

ViperSoftX Information Stealer

When the payload is dropped, an obfuscated ViperSoftX PowerShell script is presented to us. We have seen multiple variants of ViperSoftX, suggesting that the malware is under active development. In the text below, we will cover the stealer’s features as a whole.

Stealing Capabilities

First, let’s have a look at what ViperSoftX is actually capable of stealing. ViperSoftX performs fingerprinting of the infected machine, focusing on various types of information, including:

• Computer name
• Username
• OS information and its architecture
• Installed antivirus or other security software and whether the solution is active

The malware focuses on stealing cryptocurrencies. To do so, it searches the typical locations for web browser extensions and locally stored wallets. The full list of locations can be found in the Appendix. More generic information, such as OS, architecture, and username, is obtained using WMI and system variables.

ViperSoftX searches for cryptocurrencies stored locally on the infected device in cryptocurrency software and browser extensions, and monitors the clipboard for cryptocurrency wallet addresses to perform clipboard swapping.

The gathered data, as well as the fingerprint, is then concatenated together into a single string, encoded by base64, and sent to the hardcoded C&C server in the User-Agent HTTP header. Note that C&C servers vary across versions:
http://api.private-chatting[.]com/connect

Each time the victim copies anything to their clipboard, ViperSoftX scans the content using predefined regular expressions in the background. If the expression matches one of the configured wallet addresses belonging to the specific cryptocurrency, the malware replaces the content with the attacker’s address and sends a notification to the C&C server in the X-Notify HTTP header in a form of three values:
Cryptocurrency type - victim’s address - attacker’s address

The cryptocurrency type reflects what type of cryptocurrency was matched and can be one of the following: BTC, BCH, BNB, ETH, XMR, XRP, DOGE, or DASH.

The malware also checks title texts of opened windows (MainWindowTitle property) and if it spots an application focused on cryptocurrencies or finance, it logs its presence into:
%SystemDrive%\Users\Public\log.dat
The full list of searched keywords can be found in the Appendix.

On top of the information-stealing core, ViperSoftX provides RAT functionalities as well, like executing arbitrary commands on the command line, downloading an additional arbitrary payload provided by the C&C server, and executing it, as well as removing itself completely from the system. The RAT functionality can also be used, for example, to steal cryptocurrencies from their locations, which it previously identifies and sends to the C&C server.

Host Header Spoofing

Aside from trying to steal cryptocurrencies, the malware spoofs host headers to obfuscate its communication with the C&C servers.

The spoofed host header consists of five to 10 lowercase alpha letters, but the true destination is in the hardcoded $meta_host variable. This way, the real C&C server address is obfuscated by a random-looking domain that doesn’t exist.

VenomSoftX Browser Extensions

Newer versions of ViperSoftX information stealer are capable of loading a custom malicious browser extension to Chromium-based browsers installed on infected computers. The extension is provided by the C&C server. The extension is basically another standalone information stealer, we are calling VenomSoftX, but is installed by ViperSoftX, as described below. The extension disguises itself as various popular browser extensions to avoid user detection. 

The main goal VenomSoftX is also to steal cryptocurrencies from the unsuspecting victim. The difference is, VenomSoftX mainly does this by hooking API requests on a few very popular crypto exchanges victims visits/have an account with. When a certain API is called, for example, to send money, VenomSoftX tampers with the request before it is sent to redirect the money to the attacker instead. Although similar in principle to what information stealers like ViperSoftX do and rather a common clipboard swapping, this technique is performed at a lower level, meaning the victim has little to no chance of noticing the money is being transferred elsewhere.

Installing the extension

ViperSoftX’s approach is simple. The malware downloads a VenomSoftX PowerShell installer from the C&C server e.g. by base64-decoding a hardcoded request metadata directly from the PowerShell script, following a request to:
http://apps-analyser[.]com/api/v1/<HASH>
depending on the malware version. This can hold different payloads, but we will focus on the VenomSoftX browser extension.

After the installer script is downloaded from the C&C server and the VenomSoftX browser extension is extracted, the installer searches several locations for .lnk files and if such a link file belongs to Chrome, Brave, Opera, or Edge, it modifies the link file with a parameter --load-extension=<path_to_the_malicious_extension>. This way, when the user starts their favorite browser, they actually load the malicious extension with it.

These locations are checked for link files leading to browsers:

• %USERPROFILE%\Desktop
• %USERPROFILE%\OneDrive\Desktop
• %PUBLIC%\Desktop
• %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs
• %APPDATA%\Microsoft\Windows\Start Menu\Programs
• %APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

The extension ID is randomly generated, provided random lowercase characters to represent the extension folder and randomly generated version number of the extension:

$(Get-Random -Minimum 1 -Maximum 10).$(Get-Random -Minimum 1 -Maximum 10).$(Get-Random -Minimum 1 -Maximum 10)._0

We observed further versions of ViperSoftX containing a full update mechanism. These versions were able to walk through the modified .lnk files, parse the manifest.json file of the malicious extension, and when an older version or an old write timestamp of the extension was detected on the infected system than what was advertised by the C&C server, the malware requested an update and replaced the extension files to the newest version by a dedicated command (provided by the C&C server).

The extension tries to disguise itself as well known and common browser extensions such as Google Sheets. In reality, the VenomSoftX is yet another information stealer deployed onto the unsuspecting victim with full access permissions to every website the user visits from the infected browser.

Diving into javascript shenanigans

The extension contains several files, as shown in the table below. Each file has a different purpose:

File name	Purpose
128.png	Google Sheets icon to disguise the extension
content.bootstrap.js	Orchestrates the malicious activity, sends results using MQTT
manifest.json	The extension’s manifest file
rules.json	URL filter rules for Kucoin
webpack_block.js	Request tampering and credential theft on Blockchain.com
webpack_bnb.js	Request tampering and cryptocurrency theft on Binance
webpack_cb.js	Request tampering and cryptocurrency theft on Coinbase
webpack_common.js	Contains an address book for pattern matching, clipboard monitoring and stealing
webpack_content.js	When no exchange is detected – attacker’s addresses are replaced on the visited websites with the ones that victim entered earlier
webpack_gt.js	Request tampering and cryptocurrency theft on Gate.io
webpack_kuc.js	Request tampering and cryptocurrency theft on Kucoin

The malware focuses on five big cryptocurrency exchanges, reflected by abbreviations in the modules names.

In the paragraphs below, we’ll focus on what each of the modules do, in detail.

content.bootstrap.js

This module is the starting point of VenomSoftX and it is loaded with every site visit. It orchestrates what modules to load and it is also responsible for sending stolen data to the C&C server.

The scripts are loaded depending on the visited domain. The bootstrap checks what site is being loaded and if it is one of the following: Blockchain.com, Binance, CoinBase, Gate.io, or Kucoin, the module loads an appropriate “webpack”. If the user is on any other site, webpack_content.js is loaded. The module webpack_common.js is loaded by default regardless of which site the victim visits.

All the modules serve their own purpose. However, two of the modules, webpack_common.js and webpack_block.js, are capable of sending data back to the collector server using a Paho MQTT client present in the content.bootstrap.js. The MQTT client has an event listener set to a hardcoded value b8b0becb-080a-46af-9688-e3671fcc4166 that indicates data should be sent to an MQTT broker, harvesting the data:
broker.emqx[.]io
Note that the collector address can vary in different versions.

The sent data are structured as follows:
MSG: time: <utc_datetime>
ip: <client_ip>
data: <data>

The time and ip fields are obtained using a public service (https://worldtimeapi.org/api/ip).

The data field is either clipboard content with a cryptowallet and other metadata, or stolen credentials for blockchain.com. See further sections below for details.

webpack_common.js

The “common” module is loaded to every website, regardless of whether it is a cryptocurrency exchange or something else. It is used to define an address book with regular expression patterns, which is used for crypto address matching on several occasions in other modules.

The structure of the address book is in the form of a dictionary, where the key is the regular expression and the value is yet another dictionary containing three values: coin, address, and network. An example of such an address book can be seen in the below snippet. For the full address book, see Appendix.

Furthermore, each time the user pastes anything into any website (except the malicious address from the address book), this module checks whether the clipboard content matches any of the regular expressions from the address book and if they do, it sends the following data to the collector server encoded using base64. The data for the MQTT message has a following construct:

Action

Site: <URL>
Browser: <USER-AGENT>
Clipboard: <CLIPBOARD-WALLET-ADDRESS>
Time: <TIMESTAMP>

webpack_content.js

This module monitors two input elements for content the user fills into websites and it is loaded when the victim is outside of any of the mentioned exchange sites:

• HTMLInputElement
• HTMLTextAreaElement

This is done by implementing hooks in getters of these elements to try to find a compatible crypto address for the user’s input and if found, the malware creates new localStorage entry with a combination of visited site and the compatible address:
website_attackerAddress: userAddress
The compatible address is found when the provided address matches any of the regular expressions from the address book described in the previous section.

After that, a custom MutationObserver watches for dynamic changes in the site (e.g. loading the page, displaying a message sent earlier in the user’s messenger client, etc.) and if such a change occurs, the malware replaces all mentions of the malicious address (if found) with the user’s address using the localStorage. This effectively hides all traces of the malicious address in the website’s body.

Note that since the information is stored directly in the persistent localStorage, the functionality survives a browser restart, PC restart, or re-visiting the page anytime in the future. The victim has to clear the user data in their browser or uninstall the malware extension altogether to get rid of the malicious behavior.

For the sake of demonstrating this behavior, we decided to create a demo PoC of a simple page that illustrates the whole process of content tampering while the malware is active:

1. First two buttons, Attacker address and User address, fill in attacker address or user address to the “Dynamic content to be pasted” line on the webpage
2. “Get value” button triggers the getter but the hook is inactive since the provided address doesn’t match cryptowallet address pattern (it is too short)
3. The user fills in a compatible address
4. “Get value” button creates a localStorage entry with the entered address
5. The attacker’s address is always replaced with the one from localStorage

Draining the victim’s accounts

As we already mentioned, VenomSoftX focuses on five different crypto exchanges/websites, namely on Blockchain.com, Binance, Coinbase, Gate.io, and Kucoin.

In these modules, the malware tries to tamper with API requests the sites use for several actions like money withdrawal or sending security codes. This is done by creating hooks on the API calls (or rather functions responsible for sending those requests), parsing their structure, and replacing the response’s body with the desired attacker’s contents – commonly meaning that the recipient’s address is replaced by the attacker’s one as well as the amount is set to the value of an available account balance if known. The request is then processed by the malware without the user noticing anything, completely draining the victim’s portfolio as a result.

Note that the user has little to no chance to notice this. In comparison to a rather common clipboard swapping, for example, this “swapping” is performed on a lower level. Since the transactions on blockchains/ledgers are inherently irreversible, when the user checks the transaction history of payments afterward, it is already too late.

The complete list of hooked API functions can be found in the Appendix. The only file that differs from the rest is webpack_block.js. This module focuses on www.blockchain.com and it tries to hook https://blockchain.info/wallet. It also modifies the getter of the password field to steal entered passwords. Once the request to the API endpoint is sent, the wallet address is extracted from the request, bundled with the password, and sent to the collector as a base64-encoded JSON via MQTT.

Since the rest of the hooks are the same on the higher level if we ignore API differences, we will use the Binance module as an illustration example.

The Binance module recognizes six different API calls invoking malicious interactions. When the user logs in to the site, it is expected that at some point the API function
https://www.binance.com/bapi/asset/v3/private/asset-service/asset/get-user-asset
will be called. VenomSoftX then parses and saves all assets available on the victim’s account. When the user tries to manipulate their savings, e.g. withdrawing their money, the malware intercepts the request
https://www.binance.com/bapi/capital/v3/private/capital/withdraw/apply
and tampers with the request body, modifying the address to redirect the money to the attacker’s address if a compatible attacker’s address was found. The amount of the request is also set to the maximum amount available obtained by the previous step. After the tampering, the request is passed further like nothing happened, effectively draining the victim’s wallet.

Conclusion

In this blog post, we took a closer look at ViperSoftX, a long-standing information stealer, and its malicious browser extension payload VenomSoftX. We described both information stealers’ infection chains, and how the original payload hides and decrypts on the infected system.

We described what both ViperSoftX and VenomSoftX steal and how the browser extension leverages its full access to every page the victim visits and carries out man-in-the-browser attacks by silently tampering with the API requests popular cryptocurrency exchanges use, resulting in draining the victim’s accounts.

Indicators of Compromise (IoC)

• GitHub repository: ViperSoftX

ViperSoftX

File name	SHA256
Activator.exe	e1dc058fc8282acb95648c1ee6b0bc36b0d6b5e6853d4f602df5549e67d6d11a
Hidden log script first variant	0bad2617ddb7586637ad81aaa32912b78497daf1f69eb9eb7385917b2c8701c2
Hidden log script second variant	0cb5c69e8e85f44725105432de551090b28530be8948cc730e4b0d901748ff6f
ViperSoftX PowerShell	23b9075dac7dbf712732bb81ecd2c21259f384eb79ae8fdebe29b7c5a12d0519
ViperSoftX’s browser installer	5c5202ed975d6647bd157ea494d0a09aac41d686bcf39b16a870422fa77a9add

VenomSoftX

File name	SHA256
content.bootstrap.js	3fe448df20c8474730415f07d05bef3011486ec1e070c67683c5034ec76a2fcb
manifest.json	0de9a23f88b9b7bda3da989dce7ad014112d88100dceaabca072d6672522be26
rules.json	1d6845c7b92d6eb70464a35b6075365872c0ae40890133f4d7dd17ea066f8481
webpack_block.js	7107ab14a1760c6dccd25bf5e22221134a23401595d10c707f023f8ca5f1b854
webpack_bnb.js	ddee23e2bfd6b9d57569076029371e6e686b801131b6b503e7444359d9d8d813
webpack_cb.js	947215a1c401522d654e1d1d241e4c8ee44217dacd093b814e7f38d4c9db0289
webpack_common.js	7b75c1150ef10294c5b9005dbcd2ee6795423ec20c512eb16c8379b6360b6c98
webpack_content.js	d7dfc84af13f49e2a242f60804b70f82efff7680cddf07f412667f998143fe9c
webpack_gt.js	4da1352e3415faa393e4d088b5d54d501c8d2a9be9af1362ca5cc0a799204b37
webpack_kuc.js	705deecbbb6fd4855df3de254057c90150255c947b0fb985ea1e0f923f75a95f

C&C

C&C

api.private-chatting[.]com

apps-analyser[.]com

wmail-blog[.]com

wmail-service[.]com

Appendix

Scripts and tools

• Extractor for ViperSoftX’s initial payloads (commonly named Activator.exe)
• CyberChef template for decrypting the second variant of the hidden scripts in logs

List of wallet addresses

Cryptocurrency	Address
ADA	addr1q9c27w7u4uh55sfp64ahtrnj44jkthpe7vyqgcpt73z9lrq7fw3juld8k2ksz2p82tv45j8yc5wzqmr4ladxyt0vjxrsf33mjk
ATOM	cosmos1mcah8lel6rxhlqsyrzpm8237cqcuzgyw70nm6f
BNB	bnb1u64a2n3jhw4yh73s84rc58v8wxrwp7r8jwakpr
BNB	bnb1vmwl54jxj9yvsgz33xtyuvqnurdjy2raqnttkq
BTC	1L8EBHDeiHeumtcpcroaxBceXnWFiYU5dh
BTC	1Pqkb4MZwKzgSNkaX32wMwg95D9NfW9vZX
BTC	32Wx3dsHCCxyJZLwseFYkgeFqVk16tCCcF
BTC	3JvBvRuBfYvB6MjzMornj9EQpxhq9W7vXP
BTC	bc1qn6ype8u5kgj672mvsez9wz9wt9wk22tzd5vprp
BTC	bc1qxgz2g8kn2kg0wqqrmctyxu5n925pnwphzlehaw
BTC	qq9yrhef7csy3yzgxgs0rvkvez440mk53gv8ulyu6a
BTC	qqh3g98z60rdl05044xxt7gkgncezmdfy5tja99z53
DASH	XdxTmTFuHrcHnQQhfweAnHtExFB5BXmU1z
DASH	Xtwj8uGx77NYBUki1UCPvEhe4kHYi6yWng
DOT	122zNSYNN2TSR2H5wBCX16Yyvq7qLFWo1d6Lvw2t9CNxMxt1
DOGE	DDxhfK5wbJkRN25mAbBYk3ND4xLjiMRyNq
DOGE	DUUNTm23sVwLyiw27WW9ZPT9XfiWhB1Cvf
ETH	0x12507F83Dde59C206ec400719dF80D015D9D17B6
ETH	0x884467182849bA788ba89300e176ebe11624C882
KAVA	kava1emxzwjw84e0re7awgue9kp4gseesyqrttg69sm
SOL	7j5bxiFPSsScScBEjLj9qud5Yc2CqXGmembX3hQBdFTd$
USDT	TDJLMdJWPrKNMHuxgpQL8QPYgvdXTnWJao
XMR	475WGyX8zvFFCUR9ufThrNRtJmzmU13gqH9GV2WgAjbR7FgRVCWzokdfVf2hqvRbDBaMzBm1zpDiBTpBgxLt6d7nAdEEhC4
XMR	48qx1krgEGzdcSacbmZdioNwXxW6r43yFSJDKPWZb3wsK9pYhajHNyE5FujWo1NxVwEBvGebS7biW9mjMEWdMevqMGmDJ6x
XRP	rH6dyKWNpcvFz6fQ4ohyDbevSxcxdxfSmz
XRP	rpzn8Ax7Kz1A4Yi8KqvzV43KYsa59SH2Aq
XTZ	tz1g6rcQAgtdZc8PNUaTUzrDD8PYuCeVj4mb
ZEC	t1XjiZx8EydDDRuLisoYyVifcSFb96a3YBj
ZIL	zil1aw3kyrymt52pq2e4xwzusdfce9e5tmewvshdrm

Also in our GitHub.

ViperSoftX

List of monitored cryptocurrency locations

Complete list in our Github.

List of monitored window titles

Monitored window titles

binance

coinbase

blockchain

voyager

blockfi

coindesk

etoro

kucoin

citi

paxful

paypal

huobi

poloniex

bittrex

kraken

bitfinex

bitstamp

Also in our GitHub.

VenomSoftX

Address book

Complete list in our Github.

List of hooked API calls

Blockchain.com

https://blockchain.info/wallet

Binance

https://www.binance.com/bapi/accounts/v1/protect/account/email/sendEmailVerifyCode

https://www.binance.com/bapi/accounts/v1/protect/account/email/sendMobileVerifyCode

https://www.binance.com/bapi/kyc/v1/private/risk/check/withdraw-pre-check

https://www.binance.com/bapi/capital/v3/private/capital/withdraw/apply

https://www.binance.com/bapi/asset/v3/private/asset-service/asset/get-user-asset

https://www.binance.com/bapi/capital/v1/private/capital/deposit/queryUserDepositAddress

Coinbase

https://www.coinbase.com/api/v3/coinbase.public_api.authed.sends.Sends/CreateSend

https://www.coinbase.com/api/v3/coinbase.public_api.authed.sends.Sends/CreateSendMax

https://www.coinbase.com/api/v3/coinbase.public_api.authed.accounts.Accounts/GetAccounts

https://www.coinbase.com/api/v3/coinbase.public_api.authed.sends.Sends/CommitSend

https://www.coinbase.com/graphql/query?&operationName=ReceiveContentQuery

Gate.io

https://www.gate.io/myaccount/second_confirm

Kucoin

https://www.kucoin.com/_api/payment/withdraw/safe-img

https://www.kucoin.com/_api/payment/withdraw/apply

https://www.kucoin.com/_api/account-front/query/currency-balance

https://www.kucoin.com/_api/payment/deposit-address/get

The post ViperSoftX: Hiding in System Logs and Spreading VenomSoftX appeared first on Avast Threat Labs.

Campaign overview

A new Traffic Direction System (TDS) we are calling Parrot TDS, using tens of thousands of compromised websites, has emerged in recent months and is reaching users from around the world. The TDS has infected various web servers hosting more than 16,500 websites, ranging from adult content sites, personal websites, university sites, and local government sites.

Parrot TDS acts as a gateway for further malicious campaigns to reach potential victims. In this particular case, the infected sites’ appearances are altered by a campaign called FakeUpdate (also known as SocGholish), which uses JavaScript to display fake notices for users to update their browser, offering an update file for download. The file observed being delivered to victims is a remote access tool.

The newly discovered TDS is, in some aspects, similar to the Prometheus TDS that appeared in the spring of 2021 [1]. However, what makes Parrot TDS unique is its robustness and its huge reach, giving it the potential to infect millions of users. We identified increased activity of the Parrot TDS in February 2022 by detecting suspicious JavaScript files on compromised web servers. We analysed its behaviour and identified several versions, as well as several types of campaigns using Parrot TDS. Based on the appearance of the first samples and the registration date of the Command and Control (C2) domains it uses, Parrot TDS has been active since October 2021.

One of the main things that distinguishes Parrot TDS from other TDS is how widespread it is and how many potential victims it has. The compromised websites we found appear to have nothing in common apart from servers hosting poorly secured CMS sites, like WordPress sites. From March 1, 2022 to March 29, 2022, we protected more than 600,000 unique users from around the globe from visiting these infected sites. In this time frame, we protected the most users in Brazil, more than 73,000 unique users, India, nearly 55,000 unique users, and more than 31,000 unique users from the US.

Compromised Websites

In February 2022, we identified a significant increase in the number of websites that contained malicious JavaScript code. This code was appended to the end of almost all JavaScript on the compromised web servers we discovered. Over time, we identified two versions (proxied and direct) of what we are calling Parrot TDS. 

In both cases, web servers with different content management systems (CMS) were compromised. Most often WordPress in various versions, including the latest one or Joomla, were affected. Since the compromised web servers have nothing in common, we assume the attackers took advantage of poorly secured servers, with weak login credentials, to gain admin access to the servers, but we do not have enough information to confirm this theory.

Proxied Version

The proxied version communicates with the TDS infrastructure via a malicious PHP script, usually located on the same web server, and executes the response content. A deobfuscated code snippet of the proxied version is shown below.

This code performs basic user filtering based on the User-Agent string, cookies and referrer. Briefly said, this code contacts the TDS only once for each user who visits the infected page. This type of filtering prevents multiple repeating requests and possible server overload.

The aforementioned PHP script serves two purposes. The first is to extract client information like the IP address, referrer and cookies, forward the request from the victim to the Parrot TDS C2 server and send the response in the other direction.

The second functionality allows an attacker to perform arbitrary code execution on the web server by sending a specifically crafted request, effectively creating a backdoor. The PHP script uses different names and is located in different locations, but usually, its name corresponds to the name of the folder it is in (hence the name of the TDS, since it parrots the names of folders).

In several cases, we also identified a traditional web shell on the infected web servers, which was located in various locations under different names but still following the same “parroting” pattern. This web shell likely allowed the attacker more comfortable access to the server, while the backdoor in the PHP script mentioned above was used as a backup option. An example of a web shell identified on one of the compromised web servers is shown below.

Since we have seen several cases of reinfection, it is highly likely that the server automatically restores possibly deleted files using, for example, a cron job. However, we do not have enough information to confirm this theory.

Direct Version

The direct version is almost identical to the previous one. This version utilises the same filtering technique. However, it sends the request directly to the TDS C2 server and, unlike the previous version, omits the malicious backdoor PHP script. It executes the content of the response the same way as the previous version. The whole communication sequence of both versions is depicted below. We experimentally verified that the TDS redirects from one IP address only once.

Identified Campaigns

The Parrot TDS response is JavaScript code that is executed on the client. In general, this code can be arbitrary and exposes clients to further danger. However, in practice, we have seen only two types of responses. The first, shown below, is simply setting the __utma cookie on the client. This happens when the client should not be redirected to the landing page. Due to the cookie-based user filtering mentioned above, this step effectively prevents repeated requests on Parrot TDS C2 servers in the future.

The next code snippet shows the second type, which is a campaign redirection targeting Windows machines.

FakeUpdate Campaign

The most prevalent “customer” of Parrot TDS we saw in the wild was the FakeUpdate campaign. The previous version of this campaign was described by MalwareBytes Lab in 2018 [2]. Although the version we identified slightly differs from the 2018 version, the core remains the same. The user receives JavaScript that changes the appearance of the page and tries to force the user to download malicious code. An example of what such a page looks like is shown below.

This JavaScript also contains a Base64 encoded ZIP file with one malicious JavaScript file inside. Once the user downloads the ZIP file and executes the JavaScript it contains, the code starts fingerprinting the client in several stages and then delivers the final payload.

User Filtering

The entire infection chain is set up so that it is complicated to replicate and, therefore, to investigate it. Parrot TDS provides the first layer of defence, which filters users based on IP address, User-Agent and referrer. 

The FakeUpdate campaign provides the second layer of defence, using several mechanisms. The first is using unique URLs that deliver malicious content to only one specific user.

The last defence mechanism is scanning the user’s PC. This scan is performed by several JavaScript codes sent by the FakeUpdate C2 server to the user. This scan harvests the following information.

• Name of the PC
• User name
• Domain name
• Manufacturer
• Model
• BIOS version
• Antivirus and antispyware products
• MAC address
• List of processes
• OS version

An overview of the process is shown in the picture below. The first part represents the Parrot TDS filtering based on the IP address, referrer and cookies, and after the user successfully passes these tests, the FakeUpdate page appears. The second part represents the FakeUpdate filtering based on a scan of the victim’s device.

Final Payload

The final payload is then delivered in two phases. In the first phase, a PowerShell script is dropped and run by the malicious JavaScript code. This PowerShell script is downloaded to a temporary folder under a random eight character name (e.g. %Temp%\1c017f89.ps1). However, the name of this PowerShell is hardcoded in the JavaScript code. The content of this script is usually a simple whoami /all command. The result is sent back to the C2 server.

In the second phase, the final payload is delivered. This payload is downloaded to the AppData\Roaming folder. Here, a folder with a random name containing several files is dropped. The payloads we have observed so far are part of the NetSupport Client remote access tool and allow the attacker to gain easy access to the compromised machines [3]. 

The RAT is commonly named ctfmon.exe (mimicking the name of a legitimate program). It is also automatically started when the computer is switched on by setting an HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run registry key.

The installed NetSupport Manager tool is configured so that the user has very little chance of noticing it and, at the same time, gives the attacker maximum opportunities. The tool basically gives the attacker full access to the victim’s machine. To run unnoticed, chat functions are disabled, and the silent option is set on the tool, for example. A gateway is also set up that allows the attacker to connect to the client from anywhere in the world. So far, we’ve seen Chinese domains in the tool’s configuration files used as gateways. The following picture below shows the client settings.

Phishing

We identified several infected servers hosting phishing sites. These phishing sites, imitating, for example, a Microsoft office login page, were hosted on compromised servers in the form of PHP scripts. The figure below shows the aforementioned Microsoft phishing observed on an otherwise legitimate site. We don’t have enough information to assign this to Parrot TDS directly. However, a significant number of the compromised servers contained phishing as well.

Conclusion and Recommendation

We have identified an extensive infrastructure of compromised web servers that served as TDS and put a large number of users at risk. Given that the attacker had almost unlimited access to tens of thousands of web servers, the above list of campaigns is undoubtedly not exhaustive. 

The Avast Threat Labs has several recommendations for developers to avoid their servers from being compromised.

• Scan all files on the web server with Avast Antivirus.
• Replace all JavaScript and PHP files on the web server with original ones.
• Use the latest CMS version.
• Use the latest versions of installed plugins.
• Check for automatically running tasks on the web server (for example, cron jobs).
• Check and set up secure credentials. Make sure to always use unique credentials for every service.
• Check the administrator accounts on the server. Make sure each of them belongs to you and have strong passwords.
• When applicable, set up 2FA for all the web server admin accounts.
• Use some of the available security plugins (WordPress, Joomla).

Indicators of Compromise (IoC)

• Repository: https://github.com/avast/ioc/tree/master/ParrotTDS

Parrot TDS

SHA256	Description
e22e88c8ec0f439eebbb6387eeea0d332f57c137ae85cf1d8d1bb4c7ea8bd2f2	Proxied version JavaScript
daabdec3d5a43bb1c0340451be466d9f90eaa0cfac92fb6beaabc59452c473c3	Direct version JavaScript
b63260c1f213c02fcbb5c1a069ab2f1d17031e598fd19673bb639aa7557a9bae	web shell
On demand*	PHP Backdoor

* In attempts to prevent further attacks onto the infected servers, we are providing this hash on demand. Please DM us on Twitter or reach us out at [email protected].

C&C Servers

clickstat360[.]com

statclick[.]net

staticvisit[.]net

webcachespace[.]net

syncadv[.]com

webcachestorage[.]com

FakeUpdate

SHA256	Description
0046fad95da901f398f800ece8af479573a08ebf8db9529851172ead01648faa	FakeUpdate JavaScript
15afd9eb66450b440d154e98ed82971f1b968323ff11b839b046ae4bec60f855	FakeUpdate appearance JavaScript

C&C Servers
parmsplace[.]com	ahrealestatepr[.]com	expresswayautopr[.]com
xomosagency[.]com	codigodebarra[.]co	craigconnors[.]com
lawrencetravelco[.]com	maxxcorp[.]net	2ctmedia[.]com
accountablitypartner[.]com	walmyrivera[.]com	youbyashboutique[.]com
weightlossihp[.]com	codingbit[.]co[.]in	fishslayerjigco[.]com
avanzatechnicalsolutions[.]com	srkpc[.]com	wholesalerandy[.]com
mattingsolutions[.]co	integrativehealthpartners[.]com	wwpcrisis[.]com
lilscrambler[.]com	markbrey[.]com	nuwealthmedia[.]com
pocketstay[.]com	fioressence[.]com	drpease[.]com
refinedwebs[.]com	spillpalletonline[.]com	altcoinfan[.]com
windsorbongvape[.]com	hill-family[.]us	109.234.35[.]249
141.136.35[.]157	91.219.236[.]192*	91.219.236[.]202*

* Delivering the final payload

NetSupport RAT

SHA256	Filename
b6b51f4273420c24ea7dc13ef4cc7615262ccbdf6f5e5a49dae604ec153055ad	%AppData%/Roaming/xxx/ctfmon.exe**
8ad9c598c1fde52dd2bfced5f953ca0d013b0c65feb5ded73585cfc420c95a95	%AppData%/Roaming/xxx/remcmdstub.exe**
4fffa055d56e48fa0c469a54e2ebd857f23eca73a9928805b6a29a9483dffc21	%AppData%/Roaming/xxx/client32.ini**

**xxx stands for the random string name

C&C

194.180.158[.]173

87.120.8[.]141

15.76.172[.]110

45.76.172[.]113

5.180.136[.]119

94.158.247[.]84

94.158.245[.]113

94.158.247[.]100

154.38.242[.]14

199.247.3[.]55

Resources

[1] Viktor Okorokov and Nikita Rostovcev. Prometheus TDS, Group IB, 5 Aug. 2021, https://blog.group-ib.com/prometheus-tds. 
[2] Jérôme Segura. FakeUpdates Campaign Leverages Multiple Website Platforms, MalwareBytes Labs, 10 Apr. 2018, https://blog.malwarebytes.com/threat-analysis/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms/.
[3] NetSupport Software. https://www.netsupportsoftware.com/.

The post Parrot TDS takes over web servers and threatens millions appeared first on Avast Threat Labs.