The Tales of Macro Payload Steganography with 5 Layers of Obfuscation...

Cyber Security Industry are very familiar with malicious Windows office files that contains macro to execute batch or powershell script to download malicious executable like (emotet, trickbot, azorult and etc..) to infect in the wild. But in this article I will share how malware author use to hide their payload script in a normal image file and execute it, I will also discuss the 5 layer obfuscation techniques it used to bypassed the possible AV detection and to make the analysis more harder and time consuming for malware researcher, reverse engineer or security analyst.

So Lets Start :)!!

The Macro Code:

The interesting stuff start with malicious .XLS file that contains obfuscated macro code that will load the 1st part of the payload. The macro has a sub routine that checks the Current country/region setting in the Windows Control Panel before to execute the actual code. This technique shows that this campaign is designed for specific country or region in world.

figure 1 - The obfuscated macro and its country setting checking.

PAYLOAD: 1st Layer Of Obfuscation - Binary To ASCII Array:

The macro will execute the obfuscated batch file. The Obfuscation Technique used by the malware author is creating an array of binary convert it to hex then to ascii character to form the 2nd layer of Obfuscation.

figure 2 - The payload generated by the macro malware

I used a python script to de-obfuscate this part and to see the next stage which is more interesting than this one.

PAYLOAD: 2nd Layer Of Obfuscation - Steganography:

The 2nd layer code contain an obfuscated Powershell that tries to download some images "Mario.png" and then locate each pixel to get the next payload. It is really interesting that they are now using this technique to hide their track.

figure 3 - The second layer that use Steganography Technique

I tried to download the PNG and clean the obfuscated code so it is much easier to understand, Then I execute it to powershell in a couple of test (not a powershell expert :) ) and finally I got the 3rd stage.

figure 4 - Extract the 3rd Layer Script out of the image.

PAYLOAD: 3rd Layer Of Obfuscation - Array Indexing, Encoding and Compression :

The 3rd stage is quite tricky because it creates an array of string that will be indexed by its code to form a base64 encoded string then will decompress using [System.IO.Compression.CompressionMode]::"Decompress".

figure 5 - Decompressing the 3rd stage to get the 4th stage script

PAYLOAD: 4th Layer Of Obfuscation - Hex Bytes to ASCII with Several Delimiter:

The 4th stage seem looks strange but actually it was an array composed of hex bytes that are delimited by different character. The code will split those hex bytes by finding all the delimiter and convert them to ASCII. I just use simple python for this one.

figure 6 - hex array to form the 5th layer script.

PAYLOAD: 5th Layer Of Obfuscation - String Array Indexing:

The Final stage is not so new compare from the last 4 stage, it just use string indexing method to obfuscate the main string. we can fix this manually since it is not too big, but what I did is I collect all jumbled string array as well as their index put in the tuples and process it to show the actual string.

figure 7 - The Final Stage that show the URl link where it tries to download URSNIF malware.

Conclusion:

As the technology evolving in detecting and eradicates several malware families, attacks and etc. malware author keeps on updating their techniques and approach to infect user in very clever and interesting way. :)

IOC:

Excel File:

Sha1: c7c346997d6bd8fd767da61b529dc1e505c2ef45

Md5: b9be30731811f7d32c9c015383dc2d37

Sha256:8bd89bfcae7900fbc2bc16de0a4c6a93ec8f2fa0c9e6ac6ad817a68a409d4995

https://www.virustotal.com/#/file/8bd89bfcae7900fbc2bc16de0a4c6a93ec8f2fa0c9e6ac6ad817a68a409d4995/details

Interesting Azorult Mutex Name that will be send as POST command

Azorult malware is a Delphi compiled banker Trojan that tries to spy to the infected machine like bit coin wallet, parsing web browser cookies, password and many more. In this article I will focus on the interesting behavior of this malware where it send its generated mutex name from the infected machine going to its C&C server.

Parsing System Info:

after  unpacking the actual code of this malware, the first subroutine of function it will execute is harvesting all its needed API dynamically. After that it will start to set-up now all the information it needed to generate its unique Mutex Name. This is by parsing the Machine GUID, Product Name, User Name and Computer Name of infected machine then convert it into ANSI string format using delphi internal API LStrFromWstr.

figure 1 - the machine information parse by Azorult

Hashing and Encrypt the string:

Then after having those 4 system information in ANSI format, it will hash it using simple hashing algorithm that show in figure 3.

figure 2 - hashing the system info.

figure 3 - hashing algorithm

 After that, it will concatenate those 4 ANSI string as 1 long string to compute the 5th hash value.

figure 4 - concatenation of the system info. string

It will separate those 5 hash value with '-' dash character and call the CreateMutex function.

figure 5 - adding delimiter for each hash value

figure 6 - create mutex

It will check if there is some error upon creating the Mutex, This is to make sure that only 1 instance of its code running in the infected machine. If no error occur it will decrypt the C&C URL link, convert all integer value in the hash value its created to hex string , xored it with  3 bytes hardcoded key to its code then send it as http POST request to the decrypted C&C server URL link.

Simplified Process:

Sha1: 35aedeadde9f2ca077b0e4093d72334a57531a9a
Md5: b3bc031fef0d0c41fd26b308c8cbc620
Sha256: 3a65b5735981f636fbaf9cff05e78f933d10b5191209eb077d4a29210c23e739

https://www.virustotal.com/#/file/3a65b5735981f636fbaf9cff05e78f933d10b5191209eb077d4a29210c23e739/detection

Yara Rule:

import "pe"

rule azorult_win32_unpack {
    meta:
        author =  "tccontre"
        description = "detecting azorult malware"
        date =  "2019-01-23"
        sha256 = "ae75cd28bc2309f085f79bc8bd480e797b5e42f852c40a8cc733e1a51a7c5fa9"
  
    strings:
        $mz = { 4d 5a }
      
        $s1 = "FROM moz_places, moz_historyvisits WHERE" fullword
      
        $c0 = "\\accounts.xml" fullword wide
        $c1 = "PortNumber" fullword wide
        $c2 = "\\places.sqlite" fullword wide

        $code1 = { 81 F1 8A 45 21 65 03 D9 8B CB C1 E1 0D 8B F3 C1 EE 13 0B CE 2B D9 42 48 }
               
    condition:
        ($mz at 0) and all of ($s*) and 2 of ($c*) and all of ($code*)
      
    }