Cyble – EvilCoder Project Selling Multiple Dangerous Tools Online

Sophisticated XWorm RAT with Ransomware and HNVC Attack Capabilities

During a routine threat-hunting exercise, Cyble research labs discovered a dark web post where a malware developer was advertising a powerful Windows RAT.

This post redirected us to the website of the malware developer, where multiple malicious tools are being sold. The below figure shows the malware developer’s website.

The developer is selling tools to create malware, hide existing malware, crypto money grabber PowerShell scripts, etc.

We have mentioned all the tools posted by the malware developer and the possible impact of these tools on victim systems. The following table shows these tools and their corresponding functionalities.

We searched for EvilCoder Project samples in the wild and identified a few active instances of XWorm, indicating that XWorm is a more prevalent and sophisticated variant. The malware is a .NET compiled binary, using multiple persistence and defense evasion techniques.

The malicious binary can drop multiple malicious payloads at various system locations, can add and modify registry entries, and can execute commands. Figure 2 shows the XWorm builder panel as shown on the developer’s site.

Technical Analysis

XWorm is a .NET binary whose size is 45.5 KB. The file details of “XWorm.exe” are:

Upon execution, the malware sleeps for one second and performs various checks such as checking for a mutex, detecting virtual machines, emulators, debugger, sandbox environments, and Anyrun. If any of these instances are present, the malware terminates itself.

The malware enumerates the installed programs in the users’ machine and checks for strings, VMWare, and VirtualBox. If these are present, the malware terminates itself, as shown in the figure below.

The malware uses the tick count of the machine to detect emulators. The malware then calls the CheckRemoteDebuggerPresent() method to identify the debugger’s presence in the user’s machine.

The malware can also detect the sandbox environment if “SbieDll.dll” is present in the system. The malware specifically checks if it is running in the Anyrun sandbox environment by checking the response text from ip-api.com.

If the response is set to “True, ” it terminates its execution. The figure below shows the anti-analysis code snippet.

To establish persistence, the malware drops itself into the start-up folder. The malware also copies itself into the “AppData” folder and creates a scheduled task entry.

Finally, the malware creates an autorun entry in the registry to ensure the malware executes whenever the system restarts. The figure below shows the persistence activities performed by the malware.

After establishing persistence, the malware initiates communication with the C&C server. Then, the malware creates a new thread that collects and sends system details to the  C&C domain system6458[.]ddns[.]net on Port 6666.

Exfiltrated details include information such as processor count, UserName, MachineName, OSVersion, Malware version, date of malware creation, administrative privileges, webcam details, and antivirus programs installed in the system.

All the important information such as C&C, encryption key, filename, and mutex name is stored in a public class, “Settings,” as shown in the figure below.

After the initial communication, the malware waits for instructions from the C&C server. The malware can perform multiple tasks such as keylogging, screen capture, auto-update, self-destructing, running scripts, and ransomware operations.

The malware has the routine Read(), which receives AES encrypted commands from the C&C, which are then decrypted and used to perform associated operations. Some of these important operations are discussed in the following section. The below figure shows the code snippet of malware that performs DDoS and Clipper operations.

The malware has a routine to perform file folder operations like create files/folder, show, or hide files/folder, exfiltrate files, etc. The figure below shows the file operation routines.

The following figure shows the keylogging, screen capture, and mouse operations, along with corresponding commands.

The malware author also provides an encryption routine for ransomware operations, as shown below.

This malware also has a routine for performing a Hidden Virtual Network Computing (HVNC) attack. HVNC is a tactical means for malware to control a remote machine without the victim’s knowledge. The figure below shows the routine for performing an HVNC attack.

Conclusion

This post showcases that even a malware developer with minimum or no responsibility can develop malicious programs and sell them to various forums for monetary gains.

To get more customers, the malware developers provide multiple highly impactful and dangerous features such as ransomware, HVNC, etc., to TAs.

We have observed similar trends earlier, where malware developers provide highly sophisticated tools to cybercriminals for their own financial gain.

We will continue monitoring the latest threat actors and trends across the surface, deep and dark web and keep our readers informed.

Our Recommendations

We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:  

How to prevent malware infection?

• Download and install software only from official app stores like Play Store or the iOS App Store.
• Use a reputed antivirus and internet security software package on your connected devices, such as PCs, laptops, and mobile devices.
• Use strong passwords and enforce multi-factor authentication wherever possible.
• Enable biometric security features such as fingerprint or facial recognition for unlocking the mobile device where possible.
• Be wary of opening any links received via SMS or emails delivered to your phone.
• Ensure that Google Play Protect is enabled on Android devices.
• Be careful while enabling any permissions.
• Keep your devices, operating systems, and applications updated.

How to identify whether you are infected?

• Regularly check the Mobile/Wi-Fi data usage of applications installed on mobile devices.
• Keep an eye on the alerts provided by Antiviruses and Android OS and take necessary actions accordingly.

MITRE ATT&CK® Techniques 

Indicators of Compromise (IOCs) 

Related

Source: https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/