X-Labs

June 10, 2015

Large Malvertising Campaign Leads to Angler EK & Bunitu Malware

Nicholas Griffin Security Researcher

Websense® Security Labs™ researchers have been monitoring a mass scale malvertising campaign that leads to <a href=http://blog.websense.com/security-labs/angler-exploit-kit-%E2%80%93-oper... target="_blank">Angler Exploit Kit</a>. The attack has affected users browsing to many popular sites, including CNN Indonesia, the official website of Prague Airport, Detik, AASTOCKS, RTL Television Croatia, and the Bejewled Blitz game on Facebook. According to<a href="http://www.similarweb.com/" target="_blank"> SimilarWeb</a>, these sites have a combined total of at least 50 million visitors per month.

Image 1. Heatmap of geographical locations affected by this malvertizing campaign in May 2015

The following are some of the key features of this campaign:

<ul>
<li> Revive Adserver scripts are injected with code</li>
</ul>

<ul>
<li> The injected code is evasive and stealthy</li>
</ul>

<ul>
<li> Angler Exploit Kit infects the victim's machine with malware</li>
</ul>

<ul>
<li> The Bunitu trojan has been used</li>
</ul>

<ul>
<li> At least 50 million users per month are at risk
<ul>
</ul>
</li>
</ul>

Websense customers are protected against this threat via real-time analytics with ACE, the Websense <a href="http://www.websense.com/content/websense-advanced-classification-engine.... rel="nofollow" target="_blank">Advanced Classification Engine</a>, at the different <a href="http://www.websense.com/content/seven-stages-recon.aspx?cmpid=slbl" rel="nofollow" target="_blank">stages</a> of the attack detailed below:

<ul>
<li>Stage 2 (Lure) – ACE has protection against websites injected with malicious content.</li>
<li>Stage 3 (Redirect) – ACE has protection against known redirects associated with this campaign.</li>
<li>Stage 4 (Exploit Kit) – ACE has protection against the Angler Exploit Kit and exploit delivery content via real-time analytics.</li>
<li>Stage 5 (Dropper) – ACE has protection against known Bunitu samples.</li>
<li>Stage 6 (Call Home) – ACE has detection for command and control infrastructure known to be associated with Bunitu. </li>
</ul>

<h3>What is Revive Adserver?</h3>

Revive Adserver is an open source advertising technology formerly known as OpenX Source. It allows businesses to host and manage their own advertising services rather than relying on third party services, and it is common for multiple websites to use the same Revive Adserver script.

We have seen compromised Revive Adserver scripts used in malvertising <a href="http://blogs.websense.com/security-labs/dissecting-cleartripcom-website-... target="_blank">in the past</a>, and seemingly this continues to be a target of interest for cybercriminals.

Note: To clarify, OpenX (www.openx.com) is an enterprise software company which in 2013 sold OpenX Source to Revive Adserver. Revive Adserver (www.revive-adserver.com) built a new open source project on the original OpenX Source. Neither OpenX (the company) nor Revive Adserver currently support OpenX Source software, but many instances of OpenX Source are still in use and vulnerable to this malvertising exploit.

<h3>Angler Exploit Kit Strikes Again</h3>

The code injected into the compromised Revive Adserver scripts in this campaign have been seen to lead to the very prevalent Angler Exploit Kit. The injected code is not always sent when the script is requested, making it difficult to detect with automated analysis tools. In addition, Angler Exploit Kit will only serve up the malicious exploit code once per IP in a 24 hour period or so.

Since April we have seen compromised Revive Adserver scripts being used by several highly popular websites, including CNN Indonesia, Detik, Prague Airport, AASTOCKS, RTL Television Croatia, and the official Bejewled Blitz game on Facebook. Some of these only seem to contain the injected code for 24 hours, whilst others have remained compromised for weeks. Recently, we saw an interesting infection chain from the popular Croatian website Forum[.]hr (Alexa 15 in Croatia) which has been using a compromised Revive Adserver script from third-party advertiser ads3.monitor[.]hr

Image 2, 3 & 4. A compromised advertizing script on ads3.monitor[.]hr displays a legitimate advert whilst malicious code executes in the background

The injected code led to a redirect, and then to Angler Exploit Kit which exploited the latest Adobe Flash Player vulnerability (CVE-2015-3090). Recently the exploit kit has been distributing CryptoWall 3.0, Bedep and Necurs but we saw a different payload, a trojan known as 'Bunitu'.

<h3>Bunitu Malware Turns Your Machine into a Zombie</h3>

The Bunitu malware dropped by Angler caused our infected machine to act as a proxy, in theory allowing our computer's network connection to be used for subsequent malicious activity. Cybercriminals often use this tactic in order to hide their tracks from authorities, behind legitimate users' machines. The SHA1 for the sample we saw is 004e9a3ea2670a76ee90067ff29816c31908e552.

Bunitu drops and loads a DLL within its own process which opens two random ports on the infected machine for a SOCKS5 proxy and an HTTP proxy, and in our case these were ports 8322 & 56100 respectively. It contains a hard-coded call home/command-and-control IP of 85.17.142[.]21:53 which it tries to contact twice in order to report our infection and which ports it has opened on our machine:

Image 5. Bunitu calling home and reporting an infection, along with which proxy ports are opened on the infected machine

The malware also has back-up infrastructure in case the hard-coded call home server is not available. It attempts to resolve nsb.quixjoumnf[.]com, resulting in an IP of 110.201.214[.]114. The hexadecimal value of this IP address is represented in memory as 0x72D6C96E, and Bunitu then XORs this value against a hard-coded value of 0x16EC1A31, resulting in 0x643AD35F. This final value is the hexadecimal representation of another IP, 95.211.58[.]100 which is used as a call home by Bunitu after the initial two attempts to the hard-coded server. This routine can be seen in the following image:

Image 6. Bunitu XOR routine for resolving IP addresses

There are also two more back-up addresses that Bunitu can resolve if nsb.quixjoumnf[.]com does not resolve; here is a representation of how the call home infrastructure is determined:

Bunitu regularly sends heartbeats to its C&C so that it can be determined which machines are currently active and infected.

<h3>Summary</h3>

Advertising networks continue to be a point of focus for cybercriminals, opening up avenues to infect millions of users with minimal effort. The growing nature of evasion, stealth, and variation employed in the malicious code means that it's more important now than ever to deploy a security solution capable of stopping threats at multiple points in the <a href="http://www.websense.com/content/seven-stages-recon.aspx?cmpid=slbl" target="_blank">7 stages kill chain</a>.

<h3>Appendix</h3>

Indicators of compromise can be found below.

Payloads (SHA1)

SWF Exploit: feb33f3a3ac53203697d2b04ddbefa038b199a21

Bunitu EXE:  004e9a3ea2670a76ee90067ff29816c31908e552

Bunitu DLL:  fc512fc9ad3501aecf8fab06d2c76447879520d0

Command-and-Control

nsb.quixjoumnf[.]com

ns1.quixjoumnf[.]com

ns0.quixjoumnf[.]com

85.17.142[.]21:53

95.211.58[.]100:53

95.211.233[.]121:53

46.183.216[.]247:53

Nicholas Griffin

Security Researcher

About Forcepoint

Forcepoint is the leading user and data protection cybersecurity company, entrusted to safeguard organizations while driving digital transformation and growth. Our solutions adapt in real-time to how people interact with data, providing secure access while enabling employees to create value.

Learn more about Forcepoint

Large Malvertising Campaign Leads to Angler EK & Bunitu Malware

Nicholas Griffin

About Forcepoint

Sign up for the latest from our research and development team

To the Point Cybersecurity

X-Labs

Get insight, analysis & news straight to your inbox

You are here

Nicholas Griffin

About Forcepoint

Sign up for the latest from our research and development team