Resurgence of the Feodo banking Trojan on a government network

Andrew Tsonchev, Director of Cyber Analysis | Monday October 2, 2017

Famous malware like Zeus, Conficker, and CryptoLocker are still some of the most common threats globally. By repurposing and repackaging known threats like these, attackers can create unknown variants that bypass signature-based security tools.

For instance, an older class of banking Trojans – known as Feodo – recently cropped up again on the network of a local US government. However, this particular strain had a key differentiator.

Darktrace detected the malware when it first was downloaded onto the government’s network. After analysis, the malware was found to be consistent with two well-documented Trojans in the Feodo family: Dridex and Emotet.

Traditionally, Trojans in the Feodo family will infect just a single device, but this attack immediately began propagating on the network, spreading to over 200 devices in a matter of hours.

The incident is part of an emerging trend of similar infections, suggesting that the Feodo family of Trojans is undergoing a resurgence, but this time retooled with ability to rapidly spread across the network.

Darktrace first detected the threat when an internal device made a series of anomalous SSL connections to IPs with self-signed certificates. The abnormal connections were a deviation from what Darktrace’s AI algorithms had learned to be normal, triggering Darktrace to raise the first in a series of alerts.

Time: 2017-04-26 11:38:05 [UTC]
Source: 172.16.14.39
Destination: 76.164.161.46
Destination Port: 995
Protocol: SSL
Version: TLSv12 [Considered HIGH security]
Cipher: TLS_RSA_WI TH_AES_256_ GCM_SHA384 [Considered HIGH security]
UID: CbenK822ViUMxJok00

The identical IP certificate subject and issuer:
Subject: CN=euwtrdjuee.biz,OU=Tslspyqh Dfxdekt Brftapckwr,O=Kaqt Aooscr LLC.,street=132 Vfjteuadivm Fklhnxdmza.,L=Elqazgap Nvax,ST=XI,C=PO
Issuer: CN=euwtrdjuee.biz,OU=Tslspyqh Dfxdekt Brftapckwr,O=Kaqt Aooscr LLC.,street=132 Vfjteuadivm Fklhnxdmza.,L=Elqazgap Nvax,ST=XI,C=PO

The device proceeded to download an anomalous ZIP file from an unusual external server. The email purported to be a notification from FedEx, and the file was disguised as an attachment containing tracking numbers. The download was nearly identical to the malicious files usually seen in Dridex and Emotet infections.

Time: 2017-04-28 16:01:03 [UTC]
Source: 172.16.14.39
Destination: 89.38.128.232
Destination Port: 80/tcp
Protocol: HTTP
Path: hxxp://XX[.]ro/UPS__Ship__Notification__Tracking__Number__2SM099383266006810/Y0894C/FEDEX-TRACK/track-tracknumbers-673639733202/
Filename: fedex-track-tracknumbers-133977976498-language-en.zip
Mime Type: application/zip

After downloading the ZIP, the device wrote an executable file to a second device via SMB. This strongly suggested that the infection was spreading, and quickly.

Time: 2017-04-28 16:52:57 [UTC]
Source: 172.16.14.39
Destination: 172.16.10.41
Destination Port: 445/tcp
Protocol: SMB
Action: write
Filename: tptzfqa.exe
Path: \\PU12881\C$
Write Size: 65536
UID: Cxq64s3tCi1vq4Uo00

The graph shows the internal connectivity of the initial device. The spike in activity, which includes numerous alerts due to unusual behavior, occurs immediately following the SMB write made by the original device.

Devices across the network started to mimic this activity by performing the same type of SMB write, each time with the same amount of data – 65536B – and a random string of characters followed by the .exe filetype.

Meanwhile, the initial device was flagged for making a large number of SMB and Kerberos login attempts. At this point, the infection had spread to over 200 devices, which were all attempting to bruteforce passwords using the same credentials as the original device, in addition to standard usernames like ‘Administrator’ and ‘misadmin’.

Bruteforcing over SMB is consistent with lateral movement seen in recent instances of Emotet, in which the Trojan was seen with new, built-in functionality designed for network propagation.

As the malware continued to spread in the government network, devices began making anomalous SSL connections without SNI (Server Name Indication).

This series of anomalies represented a massive deviation from the network’s normal ‘pattern of life’, causing the Enterprise Immune System to raise three high-priority alerts in real time: one alert for the SMB session bruteforce, another for the Kerberos activity, and another for the anomalous SSL connections without SNI.

The final anomaly occurred when devices made a flurry of unusual DNS requests for DGA-generated domains, often involving rare TLDs such as .biz and .info. The DNS requests illustrate a sophisticated method to disguise communications to the attacker’s command and control centers. Darktrace’s AI algorithms deemed this domain fluxing activity to be highly unusual compared to ordinary behavior, thus raising one final alert before the security team was able to intervene.

A sample of the DNS requests:

15:33:00 hd12530.mi.SALTEDHAZE.org made a successful DNS request for rbqfkjjemttqumeobxb.org to dc1-2012.mi.[REDACTED].org
15:33:10 hd12530.mi.SALTEDHAZE.org made a successful DNS request for tmmiqtsdnkjdcqr.biz to dc1-2012.mi.SALTEDHAZE.org
15:33:20 hd12530.mi.SALTEDHAZE.org made a successful DNS request for mehqdlodsgggehchxdwfsmmoq.biz to dc1-2012.mi.SALTEDHAZE.org

Taken on their own, each of these anomalies could be explained as an isolated incident or perhaps a false-positive. But taken together, they form a broader picture of a widespread and aggressive infection, in which an external hacker had taken control of over 200 devices and was using them to attempt to harvest the users’ banking credentials and transfer funds into their own account.

In accordance with the Feodo family of banking Trojans, the malware was likely attempting to steal banking credentials by intercepting web form submissions. Yet, by adding the ability to spread through the network, the attacker was able to create a completely novel attack type that circumvented the perimeter security controls and infected over 200 devices.

As the threat progressed, the Enterprise Immune System raised real-time alerts and revealed in-depth details on the nature of the compromise. Using this information, the government’s security team was able to remediate the situation before any banking credentials could be stolen.

To learn more about the threats Darktrace finds, check out our Threat Use Cases page which discusses a host of other novel infections that were stopped by the Enterprise Immune System.

Blog Archive

Thursday January 10, 2019
Monday December 3, 2018
Thursday November 22, 2018
Thursday October 25, 2018
Thursday October 4, 2018
Monday August 20, 2018
Monday July 16, 2018
Friday June 22, 2018
Wednesday May 9, 2018
Monday April 16, 2018
Wednesday March 7, 2018
Tuesday February 13, 2018
Friday February 2, 2018
Monday January 22, 2018
Friday December 8, 2017
Monday November 27, 2017
Monday October 30, 2017
Wednesday October 25, 2017
Thursday October 12, 2017
Monday October 2, 2017
Monday September 18, 2017
Monday July 31, 2017
Thursday June 29, 2017
Wednesday June 21, 2017
Wednesday May 17, 2017
Monday May 8, 2017
Wednesday April 5, 2017
Monday March 6, 2017
Monday February 13, 2017
Monday January 30, 2017
Monday January 9, 2017
Friday December 16, 2016
Monday December 5, 2016
Friday November 18, 2016
Friday November 4, 2016
Monday October 24, 2016

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. Justin is one of the US’s leading cyber intelligence experts, and his insights have been widely reported in leading media outlets, including Wall Street Journal, CNN, the Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. He has a technical background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. He was most recently featured on BBC World, BBC Morning and Al Jazeera to comment on the news regarding the GRU.

Max Heinemeyer

Max is a cyber security expert with over eight years’ experience in the field specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. He was a member of the German Chaos Computer Club, working as a white hat hacker in penetration testing and red teaming engagements. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.