We have had a break from Trickbot hitting the UK in last week or so, that generally means that the criminals are experimenting with new delivery systems. The reappearance on Monday 25 June 2018 confirms this. I am not sure how successful this new system will be because it uses an exploit CVE-2018-8174 ( which only affected Internet Explorer) which was fixed in May 2018 windows updates, so I doubt there are enough vulnerable systems around that makes this worthwhile continuing with the campaign.
Instead of the usual word docs with either macros, embedded ole objects or using the Microsoft equation editor exploits, they have switched to a multi-faceted download system, with several redirects & roadblocks that involves directly delivering a VBS delivered via a look-a-like or typo-squatted site that imitates a genuine HMRC site.
I am quite surprised that they are still sticking to this method of infection, but there must be enough low hanging fruit to make it cost effective.
This example is an email containing the subject of “Important : Outstanding Amount ” pretending to come from HMRC but actually coming from a look-a-like or typo-squatted domain “[email protected]” with link in the email body is today’s latest spoof of a well-known company, bank or public authority eventually delivering Trickbot banking Trojan
Today we start with a fake Barclays Bank Email, that has a link to that will eventually download or automatically run a VBS file. which downloads the Trickbot binary ( see malware section below)
This is only designed to work in Internet Explorer and the criminals have set up the delivery chain to specifically exclude any recipient using Google Chrome or Firefox browsers, where you get this message when following the link in the email.
Unfortunately you are using an old browser or version that is unsupported by our platform, HM Revenue & Customs recommends use the latest version of Internet Explorer.
When I tried to use Internet Explorer I got a simple page saying “is IE ” and nothing else. But after seeing the naming convention yesterday, I now know how to get the malware & payload chain.
You can now submit suspicious sites, emails and files via our Submissions system
Email Details
From: HM Revenue & Customs <[email protected]>
Date: Tue 26/06/2018 11:47
Subject: Important : Outstanding Amount
Body content:
Outstanding Amount £31,369.64
Date 26 June 2018
Our ref 2389890:00041273:002
You do not appear to have paid the full amount due as shown on the attached Statement of Liabilities.
Please follow this link for more details.
https://payert-gov.uk/sidp/[email protected]&?n2389890KJBDS*(@WWWW
About this notice
If you agree the amount is due , then you need to pay in full now. Go to www.hmrc.gov.uk/payert/index.htm
It is possible that this E-mail has been received by you in error. If so, please note that it may contain confidential information, and we ask that you notify the author by replying to it, then delete it immediately, and take no further action as a result of receiving it. Although we take care by ensuring that any files attached to E-mails sent from our office have been checked with up-to-date virus detection software, you should carry out your own virus check before opening any attachment. We accept no liability for any loss or damage which may be caused by software viruses.
All content is available under the Open Government Licence v3.0.
HMRC has not been hacked or had their email or other servers compromised. They are not sending the emails to you. They are just innocent victims in exactly the same way as every recipient of these emails.
What has happened is that the criminals sending these have registered various domains that look like genuine Company, Bank, Government or message sending services.
Normally there is one newly registered domain using 4 separate IP addresses and servers to send the emails that imitate Companies House, HMRC, another Government department, a Bank, file hosting service or a message sending service that can easily be confused with the genuine organisation in some way. Some days however we do see dozens or even hundreds of fake domains.
Today’s examples of the spoofed domains are, as usual, registered via Godaddy as registrar .
- payert-gov.uk160.153.196.19
- hmrcmailgov.uk hosted on & sending emails via 185.224.131.245 hosted-by.spectraip.net Sneek Friesland NL AS62068 SpectraIP B.V. | 185.2.29.204 nld-net-ip.as51430.net Amsterdam North Holland NL AS51430 AltusHost B.V|95.211.148.242 NL AS60781 LeaseWeb Netherlands B.V. | 191.101.26.165 Edmond Oklahoma US AS20454 SECURED SERVERS LLC
Update for a change Godaddy are on the ball and the domains are all coming up as suspended ( or at least the DNS are being directed to ns1.suspended-for.spam-and-abuse.com and ns2.suspended-for.spam-and-abuse.com which should help to prevent any more users being infected. However there will still be several hours where the DNS has been cached and the sites are still available.
Malware Details
Today we start with a fake Barclays Bank Email, that has a link to which redirects to which then redirects to VirusTotal | Anyrun |
This encoded vbs downloads the Trickbot binary from one of these 2 sites via an encoded powershell script embedded in the VBS. VirusTotal
Note the exploit is actually contained within the VBS. I am pretty sure that the vbs autoruns when visiting the site in a vulnerable version of Internet Explorer with no user interaction whatsoever, except following g the original link in the email.
They have also changed to C:\Users\User Name\AppData\Roaming\mspainter as the folder location to run the malware and store the config files. Today we have Gtag ser 0626
IOC:
https://payert-gov.uk/sidp/[email protected]&?n2389890KJBDS*(@WWWW
https://payert-gov.uk/second.html
https://payert-gov.uk/script.vbs
MD5 b00a095c2e78ca9f854d9b9341fcdf11
SHA-1 1eda425ed99c0210055ccf3df5dec89e99638002
http://woodbeei.com/mar.bin
http://zicombd.com/mar.bin
MD5 08f7bd9ef4eb5a7f41ece67bc5a71116
SHA1 8e1ba36d84e16f1d3baa44135910610d4c15a344
payert-gov.uk 160.153.196.19