Resume-themed malspam pushing Smoke Loader

Published: 2017-11-19. Last Updated: 2017-11-19 22:40:22 UTC
by Brad Duncan (Version: 1)
0 comment(s)

Introduction

Malicious spam (malspam) with malware disguised as a resume.  This is a long-running theme frequently used by criminals to push various types of malware.

My Online Security reported about a recent wave earlier this month on 2017-11-10.  These resume-themed emails contain Word documents with malicious macros, and the macros are designed to infect your Windows computer.  Recent macros associated with this campaign have used 89.248.169[.]136/bigmac.jpg to retrieve malware used to infect a victim's computer.  When I checked, that URL returned a Windows executable file, and it has hosted different types malware since it was first reported back in October 2017.

Emails from this most recent wave of malspam have been submitted to VirusTotal as recently as Saturday 2017-11-18.  I collected some of these messages and generated an infection in my lab.  Today's diary reviews recent emails from this wave of malspam, and it examines the associated infection traffic.


Shown above:  Flow chart for the infection traffic.

What's the malware this time?

Last month on 2017-10-08, My Online Security reported Word documents from this malspam were pushing GlobeImposter ransomware.  However, on 2017-11-18, Word documents from this malspam were pushing Smoke Loader (sometimes spelled as single word: SmokeLoader).  Smoke Loader is a malware downloader, and it's also known as Sharik or Dofoil.


Shown above:  Smoke Loader sample identified as Dofoil by Microsoft.

I've seen different malware downloaded by Smoke Loader, but during Saturday's 2017-11-18 infection, the follow-up malware was Zeus Panda Banker.

The emails

Send dates show as Wednesday 2017-11-15 or Thursday 2017-11-16, but emails from this malspam were received through Saturday 2017-11-18.  Each email had a similar message body, but with random names for the sender and email attachments.  All emails from this malspam had the same subject line: Website Job Application.


Shown above:  Screenshot from a spreadsheet tracker.


Shown above:  Screenshot from one of the emails.


Shown above:  Attachment from one of the emails.

The traffic

The Smoke Loader sample didn't run on a virtual machine (VM), and it didn't do anything when submitted to publicly available sandboxes like www.reverse.it.  I had to generate infection traffic on a physical Windows host.

From a physical host in my lab, the Word document macro downloaded Smoke Loader, and Smoke Loader downloaded Zeus Panda Banker.  Network traffic and the associated alerts confirmed this activity.


Shown above:  Traffic from an infection filtered in Wireshark.


Shown above:  Alerts from the traffic in Sguil on Security Onion using Suricata and the EmergingThreats Pro ruleset.


Shown above:  Post-infection alerts for Zeus Panda Banker using Snort 2.9.11 and the Snort Subscription ruleset.

Indicators

The following traffic to legitimate domains was generated by Smoke Loader:

  • www.bing.com - GET /
  • support.microsoft.com - POST /kb/2460049
  • java.com - POST /help
  • java.com - GET /en/download/help/index.xml
  • java.com - GET /en/download/help/
  • go.microsoft.com - POST /fwlink/?LinkId=133405
  • msdn.microsoft.com - GET /vstudio

The following traffic to malicious domains was noted during the infection.

Word macro downloading Smoke Loader:

  • 89.248.169[.]136 port 80 - 89.248.169[.]136 - GET /bigmac.jpg

Smoke Loader traffic for check-in and downloading follow-up malware:

  • 145.249.104[.]14 port 80 - securityupdateserver3[.]com - POST /blog/wp.php

HTTPS/SSL/TLS traffic caused by Zeus Panda Banker:

  • 27.102.67[.]144 port 443 - gromnes[.]top

The following file hashes were noted for Word documents from this malspam:

The following file hash was noted for Smoke Loader from this infection:

The following file hash was noted for Zeus Panda Banker from this infection:

Final words

Malspam uses a variety of attachments and techniques to distribute malware.  I've seen a lot of Word attachments from malspam in recent weeks, and malicious Office macros are a common method.  However, these macros are fairly obvious, and educated users can easily avoid them.  Additionally, system administrators and the technically inclined can implement best practices like Software Restriction Policies (SRP) or AppLocker to prevent these types of infections.

Email, malware, and traffic samples for today's diary can be found here.

---
Brad Duncan
brad [at] malware-traffic-analysis.net

Keywords:
0 comment(s)

Comments

Login here to join the discussion.


Top of page
Diary Archives