Threat Level: green Handler on Duty: Remco Verhoef

SANS ISC: Internet Storm Center - SANS Internet Storm Center Internet Storm Center


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Latest Diaries

Truncating Payloads and Anonymizing PCAP files

Published: 2018-08-15
Last Updated: 2018-08-16 05:44:51 UTC
by Xavier Mertens (Version: 1)
0 comment(s)

Sometimes, you may need to provide PCAP files to third-party organizations like a vendor support team to investigate a problem with your network. I was looking for a small tool to anonymize network traffic but also to restrict data to packet headers (and drop the payload). Google pointed me to a tool called ‘TCPurify’. 

It’s an old tool (last updated in 2008) but it still makes the job! The original website is offline but it is possible to find it using the Internet Archive[1]. They are two main features that are interesting with TCPurify:

  • It truncates almost all packets immediately after the last recognized header (IP or Ethernet), removing all data payload before storing the packet.
  • It has the capability of randomizing some or all IP addresses (based on the network portion of the address) to mask exactly where packets are where or to while still retaining some general idea. 

The latest source code is available also through the Intenet Archive. I did not find any package ready for latest Linux distributions so, let's install it the old-way: compilation! The installation is straightforward on a standard UNIX system. The only requirement is the libpcap and C header files:

# apt-get install libpcap-dev
# wget https://web.archive.org/web/20130701155216/http://irg.cs.ohiou.edu/~eblanton/tcpurify/tcpurify-0.11.2.tar.gz
# tar xvf tcpurify-0.11.2.tar.gz
# cd tcpurify-0.11.2
# ./configure
# make install

Now, you have a single executable available in /usr/local/bin. There are different ways to use TCPurify: it can listen to packets from an interface:

# tcpurify -i eth1 -o /tmp/capture.pcap

Or from another PCAP file:

# tcpurify -r /tmp/source.pcap -o /tmp/destination.pcap

What about the anonymization of the packets? There are different modes offered: “none” (does nothing, default), “nullify” (replace all IP addresses with 0.0.0.0) or ‘table’. This one is the most interesting. It allows defining which subnets will be anonymized using filters. Those filters are save in a map file to be able to reconstruct the original PCAL if required later.

Filters are defined like this:

subnet/netmask/xformmask

Example:

192.168.0.0/0xffff0000/0xffff

This will randomize IP addresses from 192.168.0.0/16 except the network & broadcast addresses (example: '192.168.1.2' will be anonymized to '192.168.123.43')

The ‘table’ mode requires an extra argument, 'mapfile' which will point to the filename that will contain the mappings.

Here is an example of usage:

# tcpurify -i eth1 -o /tmp/test.pcap table 192.168.0.0/0xffff0000/0xffff mapfile=/tmp/test.map
^C

The tool looks a very light tcpdump clone and does not allow to fine-tune the capture session. The most important missing option is the non-support for BPF filters. This means that you can’t restrict the traffic when reading from an interface. But you could collect traffic via a regular tcpdump and then anonymize it:

# tcpdump -i eth1 -w /tmp/test.pcap port 80
# tcpurify -r /tmp/test.cap -o /tmp/test_anonymized.pcap table 192.168.0.0/0xffff0000/0xffff mapfile=/tmp/test.map

The tool is not perfect and does not follow modern standards. For example, it does not allow reading PCAP data from stdin and writing to stdout but it can be helpful in many cases. It deserve to be added to your toolbox.

[1] https://web.archive.org/web/20140203210616/irg.cs.ohiou.edu/~eblanton/tcpurify/

Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key

0 comment(s)

More malspam pushing password-protected Word docs for AZORult and Hermes Ransomware

Published: 2018-08-15
Last Updated: 2018-08-15 22:32:54 UTC
by Brad Duncan (Version: 1)
0 comment(s)

Introduction

This is a follow-up to a previous diary from last month on malicious spam (malspam) distributing password-protected Word docs with malicious macros designed to infect vulnerable Windows computers with ransomware.

Details

Today, I found five examples of malspam with password-protected Word docs using 1234 as the password.  The Word doc had a malicious macro that retrieved AZORult malware.  The AZORult malware conducted callback traffic, then the infected host retrieved Hermes ransomware.


Shown above:  Screen shot of a malspam example from today (1 of 2).


Shown above:  Screen shot of a malspam example from today (2 of 2).


Shown above:  Opening the password-protected Word doc on a Windows host.


Shown above:  After entering the password, a victim must enable macros.


Shown above:  Traffic from an infection filtered in Wireshark.


Shown above:  Desktop of an infected Windows host.

Indicators

Malspam information from 5 email samples: 

  • Date:  Wednesday 2018-08-15
  • Received: from  180connection.org ([46.161.42.24])
  • Received: from  10000tables.org ([46.161.42.9])
  • Received: from  160h.com ([46.161.42.21])
  • Received: from  135798.com ([46.161.42.18])
  • Received: from  whygavs.net ([46.161.42.20])
  • From:  Karan Fabiano =?UTF-8?B?wqA=?= <billing@180connection.org>
  • From:  Eloisa Liechty =?UTF-8?B?wqA=?= <ticket@10000tables.org>
  • From:  "Edgar Blanding =?UTF-8?B?wqA=?=" <mail@160h.com>
  • From:  "Jackqueline Wroblewski =?UTF-8?B?wqA=?=" <admin@135798.com>
  • From:  "Toni Cerulli =?UTF-8?B?wqA=?=" <help@whygavs.net>
  • Subject:  Invoice Due
  • Attachment name:  Invoice.doc

Network traffic:

  • 209.141.59.124 port 80 - 209.141.59.124 - GET /azo.exe
  • 149.129.216.194 port 80 - briancobert.com - POST /index.php (AZORult traffic)
  • 149.129.216.194 port 80 - briancobert.com - POST /index.php (AZORult traffic)
  • 209.141.59.124 port 80 - 209.141.59.124 - GET /hrms.exe

Associated malware:

Contact info from the decryption instructions:

  • primary email:  4234234fdssdfdsaf@tutanota.com 
  • reserve email:  decryptsupport1@cock.li 

Final words

As usual, properly-administered and up-to-date Windows hosts are not likely to get infected.  System administrators and the technically inclined can also implement best practices like Software Restriction Policies (SRP) or AppLocker to prevent these types of infections.

Pcap and malware associated with today's diary can be found here.

---
Brad Duncan
brad [at] malware-traffic-analysis.net

0 comment(s)

If you have more information or corrections regarding our diary, please share.

Recent Diaries

Microsoft August 2018 Patch Tuesday
Aug 14th 2018
2 days ago by Johannes (0 comments)

New Extortion Tricks: Now Including Your (Partial) Phone Number!
Aug 13th 2018
3 days ago by DidierStevens (2 comments)

A URL shortener handy for phishers
Aug 12th 2018
4 days ago by DidierStevens (1 comment)

Peeking into msg files - revisited
Aug 12th 2018
4 days ago by DidierStevens (2 comments)

Hunting SSL/TLS clients using JA3
Aug 10th 2018
6 days ago by Remco (0 comments)

View All Diaries →

Latest Discussions

Port 41302 UDP
created Aug 16th 2018
15 hours ago by Alvaro (1 reply)

Pfsense Dshield Log sending Issue
created Aug 10th 2018
6 days ago by Anonymous (0 replies)

Splunk query returns fewer results than expected
created Jul 30th 2018
2 weeks ago by Anonymous (0 replies)

Threat Feed Feedback
created Jul 26th 2018
3 weeks ago by TravisMcW (0 replies)

Windows Long File Path
created Jul 19th 2018
4 weeks ago by Shishir (0 replies)

View All Forums →

Latest News

View All News →

Top Diaries

Wide-scale Petya variant ransomware attack noted
Jun 27th 2017
1 year ago by Brad (6 comments)

Using a Raspberry Pi honeypot to contribute data to DShield/ISC
Aug 3rd 2017
1 year ago by Johannes (16 comments)

Maldoc with auto-updated link
Aug 17th 2017
11 months ago by Xme (2 comments)

Second Google Chrome Extension Banker Malware in Two Weeks
Aug 29th 2017
11 months ago by Renato (0 comments)

Detection Lab: Visibility & Introspection for Defenders
Dec 15th 2017
8 months ago by Russ McRee (2 comments)