<img height="1" width="1" alt="" style="display:none" src="https://www.facebook.com/tr?id=619966238105738&amp;ev=PixelInitialized">

Analyzing Furtim: Malware that Avoids Mass-Infection

Overview

Recently we came across a new malware strain, first discovered by @hFireF0X, and at point of discovery, it was not detected by any of the 56 anti-virus programs tested by VirusTotal service.

It is not yet known who is behind this malware, and as no string in the file disclosed its original name we code-named it “Furtim”, which is the Latin translation for “stealthy”. In fact, Furtim, as we’ll show, goes through great lengths to avoid being caught by security parties. For example, Furtim won’t install itself if it identifies on the target machine one of an extensive list of security products (both common and esoteric), sandbox or virtualization environments.

These threat actors would rather give up on a target, than take the chance of being exposed.

Given these interesting facts, we decided to perform a deep analysis of this new malware sample.

 


Figure1- Furtim on VirusTotal

Initial Look

Furtim arrives as a binary file, originally named “native.dll”.

The file is a driver. It is supposed to be loaded by the kernel.

It weighs 295 KB and timestamped October 22, 2015.

Figure2-Furtim Properties

Packing and protection

This sample does not come packed. It could be that this is attributed to the fact that driver packers are a lot less common than regular executable packers.

Protection mechanisms are in place, though.

Calls are made dynamically using a large structure that contains function pointers, strings are obfuscated and the binary contains other encrypted parts.

Anti-debugging is not present. It could be that the reason is that the debugging process for drivers is more complex, so Furtim’s authors simply chose not to integrate this malware-feature.

Running Furtim (directly)

We use Windows’ sc tool to create a service for our driver.

Initially we tried to run it in Kernel mode using:

sc create native binPath= native.dll type= kernel

The command returns an error and appears to do nothing to little.

Running Furtim (with a debugger this time)

Let’s decide now to let the sample do some of its work under the context of a debugger.

First, we’ll change the first byte of the program to an INT 3 instruction, opcode 0xCC.

Then we’ll attach Windbg in kernel debugging mode to the machine. Finally, we can run the sample using the sc tool again:

sc start native

… And the debugger stops at the entry point.

Structure handling and string deobfuscation

Using IDA, we can see the big constructor-like function that built the global structure used for function calls. Note that not only imported function pointers are placed in this struct but it is also used for local calls, making IDA’s cross-reference view useless at the beginning.

Figure3-Furtim IDA

We can also see the loop that decrypts strings.

Figure4-Furtim decrypt

Letting these two important parts run reveals plaintext strings and a struct full of function pointers.

Figure5 - Furtim function pointers

How Furtim avoids security products

The strings bring us to understand what this sample is looking for.

In a nutshell, Furtim searches the infected machine for any trace of a security program. The authors went to great lengths by including no less than 400 registry entries or service executable names of security programs. These include the well-known ones and also very rare, some on the verge of esoteric programs. The code screenshot below includes a snapshot of some of these registry key names.
If one of these programs is found, and sometimes even a trace of it is enough, the sample quits.

Figure6-Furtim list of security programs

Virtualization environments are also checked thoroughly. Furtim is aware of all major virtualization and sandboxing environments and will not run if one of them is detected.

We’ve also noticed that Furtim is aware to DNS filtering services due to its scanning of the network interfaces on the infected machine, and replacing any known filtering nameserver to public nameservers offered by Google and Level3 Communications.

Finally, access to nearly 250 security related sites, such as AV update sites, are blocked by replacing Windows’ hosts file (the actual list of blocked sites appears at the end of this post). The blocked sites list also includes technical help sites such as BleepingComputer.com.

Decrypting code

If Furtim decides that no threat of exposure is present on the victim machine, it will read an encrypted hard-coded part of itself, decrypt it and write it to the disk.

This file is an ordinary user-mode executable named “rdpinst.exe”.

The dumped file will be added to the registry RunOnce key:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce

Certain measures are taken in order to ensure that the RunOnce key is not ignored by the Group policy and normal boot sequence is enforced using various Windows’ tools. This kind of behavior is very rare for malware, indicating that the developers were very thorough in their attack plan.

In certain situations the malware will also call for a system reboot following this installation.

Dropped binary

Stealth is again top-priority.

The new dropped binary runs and immediately commits some changes to the registry, mainly to the Policies key values. This effectively blocks the user from accessing the command line and task manager, tools that may reveal the malware’s process running the background or may provide means to kill it.

Figure7-Furtim disables cmd

Figure8 - Furtim disables Task Manager

rdpinst.exe collects unique information about the machine it is running on, such as computer name and Windows’ installation date, encrypts them and sends them to a Russian-domain server. Testing the Russian domain resolves to quite a few IP addresses, most of which are located in the Ukraine.

The request sent contains the “Accept-Language” header which is set to “ru” (for Russian) which further points to the direction of this malware’s origin. It is important to note, however, that relying on attributes, such as IP and Language, is never certain.

Communication with the server is done over HTTP and data is encrypted using RC2 Algorithm with a predefined key.

Figure9-Furtim communication

The server stores the received details about the infected machine to ensure that the payload is sent only once. In fact, even if the infected machine sends the unique information from a different IP, the C&C server will know not to re-send this payload and will return 404 error on any of these subsequent requests. This is possibly done to prevent security researchers and AV companies trying to collect the samples from the server by repeating previous requests or running the sample multiple times.

The server then responds with the following 3 binary files to be executed by the dropped executable.

File #1: Power Saving Configuration

Availability is also important to the authors.

The first downloaded binary uses the powercfg configuration tool to change the power saving features of the infected machine. Automatic sleep mode and hibernation are disabled to ensure the system is always up and running unless manually shut down by a user.

On the face of it, if the power configurations are changed, a security savvy person would notice. However, the threat actors considered that if they’ve already reached this stage, then the user is less security-conscious.

File #2: Pony Stealer

The second binary is downloaded from a server in UK. It is named Pony20.exe and as its name implies, it contains “Pony Stealer”. This malware is a run-once type, it steals saved passwords and credentials from various installed programs and sends them back to a server where they are conveniently organized in a searchable web platform for easy access.

File #3: Yet to be resolved

We do know that a third binary is downloaded. It is identified as generic by certain AVs, possibly due to the fact that it is packed. We have yet to analyze it to completely understand what it does. We do know though, that it communicates back a list of certain discovered processes to another Russian server. These processes belong to virtualization environments and security products. On the face of it, Furtim would not have installed were these processes in place, however, this double check is done as a second precautionary step.

We’ll update once we figure out this missing part.

Conclusion and thoughts

The fact that Furtim has to be installed suggests that an infection method other than the usual “double-click and infect” method was used.

It seems that this malware goes to great lengths to remain stealthy and undetected. It is obvious that these threat actors would rather avoid infecting a target than taking the chance of exposure.

The low detection rate of VirusTotal can be considered at least a partial success in this field.

Sites Blocked by Furtim

account.norton.com

www.gmer.net

www.yeabests.cc

bleepingcomputer.com

www.bleepingcomputer.com

malekal.com

www.malekal.com

accounts.comodo.com

activation.adtrustmedia.com

activation-v2.kaspersky.com

auth.ff.avast.com

avstats.avira.com

backup1.bullguard.com

buddy.bitdefender.com

c2.dev.drweb.com

antivirus.baidu.com

cdn.static.malwarebytes.org

csasmain.symantec.com

definitionsbd.lavasoft.com

dm.kaspersky-labs.com

dnsscan.shadowserver.org

download.bitdefender.com

download.bullguard.com

download.comodo.com

download.eset.com

download.geo.drweb.com

downloadnada.lavasoft.com

downloads.comodo.com

downloads.lavasoft.com

www.reasoncoresecurity.com

reasoncoresecurity.com

drweb.com

ec.sunbeltsoftware.com

emupdate.avast.com

esetnod32.ru

zillya.ua

www.zillya.ua

expire.eset.com

gms.ahnlab.com

go.eset.eu

i1.c.eset.com

i2.c.eset.com

i3.c.eset.com

i4.c.eset.com

iploc.eset.com

ipm.avira.com

ipm.bitdefender.com

ksn4-12.kaspersky-labs.com

ksn-file-geo.kaspersky-labs.com

ksn-info-geo.kaspersky-labs.com

ksn-ipm-1.kaspersky-labs.com

ksn-kas-geo.kaspersky-labs.com

ksn-kddi.kaspersky-labs.com

ksn-pbs-geo.kaspersky-labs.com

ksn-stat-geo.kaspersky-labs.com

ksn-tboot-1.kaspersky-labs.com

ksn-tcert-geo.kaspersky-labs.com

ksn-tpcert-1.kaspersky-labs.com

ksn-url-geo.kaspersky-labs.com

ksn-verdict-geo.kaspersky-labs.com

licenseactivation.security.comodo.com

license.avira.com

license.nanoav.ru

license.trustport.com

licensing.security.comodo.com

login.bullguard.com

login.norton.com

metrics.bitdefender.com

mirror01.gdata.de

my.bitdefender.com

newton.norman.com

nimbus.bitdefender.net

niufour.norman.no

niuone.norman.no

niuseven.norman.no

o2.norton.com

omni.avg.com

oms.symantec.com

p003.sb.avast.com

p.filseclab.com

www.filseclab.com

ping.avast.com

premium.avira-update.com

program.avast.com

proxy.eset.com

redirect.avira.com

reg03.eset.com

register.k7computing.com

resolver1.bullguard.ctmail.com

resolver2.bullguard.ctmail.com

resolver3.bullguard.ctmail.com

resolver4.bullguard.ctmail.com

resolver5.bullguard.ctmail.com

rol.pandasecurity.com

360totalsecurity.com

www.360totalsecurity.com

secure.comodo.net

shasta-rrs.symantec.com

shop.esetnod32.ru

slcw.ff.avast.com

spoc-pool-gtm.norton.com

s.program.avast.com

static2.avast.com

static.avg.com

stats.norton.com

stats.qalabs.symantec.com

store.lavasoft.com

su.ff.avast.com

support.norton.com

symantec.tt.omtrdc.net

threatnet.threattrack.com

trace.eset.com

tracking.lavasoft.com

ts-crl.ws.symantec.com

ts.eset.com

uc.cloud.avg.com

um01.eset.com

um21.eset.com

update2.bullguard.com

update.avg.com

update.bullguard.com

update.eset.com

updates.agnitum.com

updates.k7computing.com

updates.sunbeltsoftware.com

upgrade.bitdefender.com

upgr-mmxiii-p.cdn.bitdefender.net

upgr-mmxiv.cdn.bitdefender.net

v7.stats.avast.com

versioncheck.eset.com

vl.ff.avast.com

wam.pandasecurity.com

webprot.avgate.net

webprot.avira.com

webprot.avira.de

wsmy.pandasecurity.com

www5.avira.com

www.avira.com

download.sp.f-secure.com

www.bullguard.com

www.esetnod32.ru

www.k7-russia.ru

www.lavasoft.com

www.mks.com.pl

www.nanoav.ru

www.pandasecurity.com

www-secure.symantec.com

www.sunbeltsoftware.com

www.trustport.com

kaspersky.ru

www.kaspersky.ru

avast.ru

www.avast.ru

freeavg.com

www.freeavg.com

free.avg.com

www.free.avg.com

avira.com

z-oleg.com

www.z-oleg.com

bitdefender.com

www.bitdefender.com

bullguard.com

personalfirewall.comodo.com

www.personalfirewall.comodo.com

comodo.com

www.comodo.com

www.drweb.com

www.emsisoft.ru

emsisoft.ru

avescan.ru

www.avescan.ru

escanav.com

www.escanav.com

escan.com

www.escan.com

f-prot.com

www.f-prot.com

f-secure.com

www.f-secure.com

gdatasoftware.com

ru.gdatasoftware.com

www.gdata.de

gdata.de

ikarussecurity.com

www.ikarussecurity.com

malwarebytes.org

www.malwarebytes.org

nanoav.ru

symantec.com

www.symantec.com

norton.com

www.norton.com

ru.norton.com

agnitum.ru

www.agnitum.ru

cloudantivirus.com

www.cloudantivirus.com

pandasecurity.com

www.rising.com.cn

rising.com.cn

rising-global.com

www.rising-global.com

www.rising-russia.com

rising-russia.com

freerav.com

www.freerav.com

safensoft.ru

www.safensoft.ru

trustport.com

www.trustport-ru.ru

virustotal.com

www.virustotal.com

zillya.com

www.zillya.com

anti-virus.by

www.anti-virus.by

sophos.com

www.sophos.com

www.freedrweb.com

freedrweb.com

www.avirus.ru

www.avg.com

avg.com

mcafee.com

www.mcafee.com

siteadvisor.com

www.siteadvisor.com

support.kaspersky.ru

www.comss.ru

comss.ru

www.spyware-ru.com

spyware-ru.com

virusinfo.info

www.virusinfo.info

forum.esetnod32.ru

www.forum.esetnod32.ru

forum.drweb.com

www.forum.drweb.com

forum.virlab.info

www.forum.virlab.info

spybot.info

www.spybot.info

winpatrol.com

www.quickheal.com

quickheal.com

www.winpatrol.com

av.download.avg.com

 

CATEGORIES

FEATURED ARTICLES

tag cloud