Fudcrypt using H-Worm from WSH RAT

Fudcrypt builder, like WSH RAT builder uses HWorm. The last version of the builder from 24th of September provides some interesting insight:

 

In the case of Fudcrypt, compared with WSHRAT, the HWorm payload, in VBS, is not included as a resource, but is pull from a remote URL. This payload is then obfuscated with a routine. The code of the routing is below:

The interesting part is that the plain text payload (HWorm) contains  "live:unknown.sales64". Unknown.sales64 is the actor behind WSHRAT and the skype ID is always in the header of the HWorm in VBS and JS.

The User-agent is also "WSHRAT" .

In terms of the code and functionality of the HWorm used by Fudcrypt, is not the latest version used in WSH RAT. It is possible Fudcrypt actors don't have access to the latest version of the WSHRat where the newer code is used

With Fudcrypt it is also possible to 'crypt' Java files. In order to do that, the builder contains the full Java JRE environment:

The code to create and 'crypts' the  Java code works in a similar way than the VBS.

WSH RAT - Analysis of the code

Analysis of the code - capabilities of WSH RAT

In previous post I wrote about the link between WSH RAT and some other crypter services so in this post I'm going to dig a bit in the analysis on the code.

In essence, WSH RAT generates malicious JS or VBS based on the HWorm, and a good write-up about the functionalities of version  2.0 of HWorm has been recently done by StrangerealIntel  in this post, but I will add a couple of interesting things.


WSH RAT builder

I took a look to one of the WSH RAT builders from a few months back (a version from July).
The builder acts as well as the C2.

The first interesting aspect is that the malicious payload, which it is HWorm, (both in VBS or JS) is included in the resources.

WSH RAT plugins

All the additional plugins for RDP, filemanager, offline-keylogger, etc, are linked to a URL which are part of the builder itself. This means that the plugins are allocated in a system owned by the developer of the builder, so the criminal using the builder doesn't have any control on the plugins being pushed to the infected system:

In the post from StrangerealIntel  the additional plugins are hosted in the domain "doughnut-snack[.]live" which is registered with the account unknown.sales64@gmail.com.  

Unknow.sales64 is the Skype ID of the person behind the builder who sells the service in wshsoftware[.]site


Password stealer

The password stealer capability is based on the PasswordStealer tool from @trestacon github  https://github.com/tresacton/PasswordStealer. 

Download and Execute / Upload and Execute

WSH Rat is used to deploy additional malware. As mentioned previously, the builder is also acting as the C2. 

The additional payload can be pushed in two different ways: downloading the file from an external URL, or uploading the file through the WSH builder. Code for both methods are below:

WSH RAT and the link to unknowcrypter and Fudcrypt

There are plenty of malspam campaigns using the the code "MT103" from SWIFT to claim some kind of payments. 

                                     




However, recently there was one in particular using some malicious JavaScript as an attachment quite interesting. Some samples of the campaign can be found here and here 

The payload in those campaigns delivered the malware "wsh RAT".  This malware family is quite new, however the actor behind is not new at all, but linked to some other crypters services mentioned in this blog.

Analysis of the code - overlap with Uknowncrypter and Fudcrypt

While I did the analyses of the sample here I found several interesting points which I will detail here.

The obfuscation mechanism used is very similar in terms of the 'algorithm' and base64 encoding to the one used in unknowcrypter and Fudcrypter 

The final decoded payload leads to some interesting indicators.

This code is similar  Vjw0rm  which is used by unknowcrypter. Also, the host "unknownsoft.duckdns[.]org" was used by uknowncrypter at some point.  

But the most interesting aspect is the skype ID "unknown.sales64"

The skype ID is linked to the domain http[:]//www.wshsoftware[.]site where WSH RAT is sold.

The capabilities of this RAT are described in the website:

A full video of the capabilities of this RAT is also linked in the main website

https://youtu.be/rdG16vk9qNQ

According to the video and some screenshots the malicious payload can be generated in VBS and JS

Unknowcrypter generates JavaScript code while Fudcrypt VBS code, however the code in essence was the same in both cases, as showed in the post here 

The domain wshsoftware[.]site has been registered with the email address stonexevans@gmail[.]com

This same email address was used to register the domain "fudcrypt[.]com" which was used to sell Fudcrypt service at some point

So "WSH RAT", "unknowcrypter" and "Fudcrypt" are linked between them

In the next blog I will dig into the code and capabilities of the malware

Unknowncrypter, the crypter twin of Fudcrypt: another Crypter-as-a-Service for Java and JS

Last week I wrote about a Crypter-as-a-Service named Fudcrypt which obfuscates Java RATs in VBS scripts. However, this is not the only service being used by threat actors to deliver encrypted Java RATs.

A few days ago there was a new "The Story of Manuel’s Java RAT"  which basically linked two different campaigns using same JRAT malware. In one of the campaigns there were JAR files attached to the emails, whereas in the other campaign the attachment were JS (JavaScript) dropping a JAR file. The JS campaign is the interesting part as this is linked to a Crypter-as-a-Service named Unknowcrypter.

Unknowcrypter and Fudcrypt are strongly linked and either the actor creating both services is the same or they are working together.

Unknowncrypter is announced in several underground forums as a crypter for Java and JS. There is even in Youtube some videos on how to use the crypter.

In order to use the service and encrypt Java/JS files it is necessary to use a windows application and a valid account.





The sample from the campaign "The Story of Manuel’s Java RAT" 5b7192be8956a0a6972cd493349fe2c58bc64529aa1f62b9f0e2eaebe65829be 
is the perfect candidate to be dissected. 

Looking at the JS code, the first interesting part is the "obfuscation" function for the payload. 





The variable hp_pavilion is the final payload which it is base64 encoded.

It basically uses the same substitution mechanism than fudcrypt, but written in JS instead of VBS and using different characters and strings.  

Below is the snippet code from fudcrypt:





After decoding the payload stored in hp_pavilion, there is again another round of base64 encoded strings, which are stored in LongText1 and LongText








LongText1 is just a base64 encoded and the output is a JS script which I will analyse later.
LongText is the malicious payload, the Java RAT, which it is base64 encoded but some characters needs to be swapped, in this case "#@>" with "A".  

This is the exact same behaviour than in Fudcrypt:

Then, the script checks if Java Run Environment is installed. If not, this is download from  hxxp://www.thegoldfingerinc[.]com/images/jre.zip





 Fudcrypt does exactly the same and in the same manner. See the code from fudcrypt




Lastly, the Java RAT is made persistent via the Registry key "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ntfsmgr which it is the same exactly registry key name used by fudcrypt.




The remaining part is the script linked to the LongText1. This is script, after deobfuscation,  leads to a JS script which is a worm name vjw0rm.


 Although this code is not used, it has C2 capabilities.


To summarise: unknowncrypter and fudcrypter are the same crypter service but using to different script languages as output for the obfuscation. The only difference is the C2 capabilities which are gathered by two different malware, one for JS while the other is for VBS.


The analysis of the JavaRAT payload, which it is Adwind, is here

Fudcrypt: the service to crypt Java RAT through VBS scripts and Houdini malware

The existence of services to encrypt and obfuscate malware in order to avoid antivirus detection is nothing new at all. In this blog I wrote about a couple of services, qthelegend and qrypter, that obfuscate Java RATs like Adwind.

A few weeks back there was an interesting campaign against some financial institutions using some Java RAT and some VBS scripts. It turned out that this campaign used some crypt service named fudcrypt. This service is announced in several underground forums as "fully undetected crypt" service and used to have a website where it could be bought for a few dollars.




The are even some youtube videos on how to encrypt files with this crypt service. For example here. 
The author of this malware claims that he is able to install Java JRE in victims which do not have Java installed so the JAR payload can be executed.



Although the main website fudcrypt[.]com is not anymore active, the service can still be bought via some underground forums.

In order to use the service and to obfuscated the payload, the author provides a windows application. This application checks for a valid license

 



As mentioned before Fudcrypt is still active as a service and some actors are using it so I'm going to analyse how it works with a recent sample 
ef9c50fd15493937d5ee3366a58e41cd3ca1d9fb386fe578aea700c8f54f0f1a. This sample was detected only by a few AV when it was analysed three days ago:



The file is a VBS script which it is 929K and it has a variable named "pillow" which it is the payload.


The payload is in base64 encoded, but according to some functions in the code there are some characters that need to be swapped before decoding.  This is "#(" with "m".

The base64 decoded payload is another VBS script which I've uploaded here

This script contains two other base64 encoded payloads stored in two variables: longText1 and longText.







Both of them are base64 encoded, however for the second one it is necessary (again) to swapped some characters:




It turns out that the second base64 encoded variable is a binary JAR file, which in essence is the final Java Rat payload. The JAR file is stored in %appdata% as ntfsmgr.jar. A copy of the file is here and a dynamic analysis is here. In essence, the payload is Adwind malware and the C2 is in jsbc-pcs.linkpc[.]net:1604


                         

The code checks via some registry keys if Java is already installed. If it is not installed, a copy is downloaded from this URL: hxxp://www.thegoldfingerinc[.]com/images/jre.zip





Then, the dowloaded java is installed and persistence to run the Java RAT is pushed via the registry key  HKCU\Software\Microsoft\Windows\CurrentVersion\Run 




There is still one remaining script which I did not analyse yet. This is the one stored in longText1. This script again has a base64 encoded payload with leads to another VBS script. A copy of both VBS script are here and here

Looking at the last deobfuscate VBS script, the beginning of the script matches the Houdini Malware. Also the C2 pm2bitcoin[.]com is well known, however this C2 is not the one used, but goz.kingdaddy[.]pw. 

The domain goz.kingdaddy[.]pw is not active but has been registered a few days ago





A good analysis on how the Houdini malware works was done 5 years ago by FireEye/Mandiant here. 

In essence this crypt service is using some already known malware, Houdini, Although the final JAR payload is in the initial  obfuscated VBS  it would be possible that payload is pushed via the Houdini VBS script via the C2.