When looking through my Spam folder, I have run across a few messages with β.batβ files attached to them. Most messages have had different content in the message to entice a victim to open the attachment. I started to investigate each of the attachments and found they were Windows Binaries, and at least two had PNG files in the resources. After doing this initial triage, I wanted to see if the payload of these pieces of malware is encoded in this PNG data and how it was encoded.
I started with a sample named βBank Statement.batβ with the .NET code that is the least obfuscated and will visit another sample in a later post. In this post, I will reverse engineer the .NET code and uncover the process to extract out the payload encoded in a PNG file embedded in the binary.
Detailed Analysis
First thing, I took a look at the properties of the attached file and determined it was a .NET compiled binary with some suspicious properties such as having a copyright field listing βApple, Inc.β Some more of the metadata details are shown below.
Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2020-Apr-20 14:27:35
Comments: QuartzCore 227
CompanyName: Apple Inc
FileDescription: QuartzCore
FileVersion: 3.0.0.0
InternalName: Ly2kW4nOksU0vgv.exe
LegalCopyright: Β© 2020 Apple Inc. All rights reserved.
OriginalFilename: Ly2kW4nOksU0vgv.exe
ProductName: QuartzCore
ProductVersion: 3.0.0.0
Assembly Version: 5.4.1.0
Matching compiler(s):
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ 8.0
.NET executable -> Microsoft
Next I ran a binwalk to see if there are is any other obvious hidden content within this file and found there is a PNG file embedded within the binary.
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 Microsoft executable, portable (PE)
19329 0x4B81 PNG image, 290 x 290, 8-bit/color RGBA, non-interlaced
19407 0x4BCF Zlib compressed data, compressed
357216 0x57360 Copyright string: "CopyrightAttribute"
I opened the file in ilSpy and extracted the PNG file from the resources of the binary. When looking at the extracted PNG file I found visually it looks like encoded data. After seeing this image I started to investigate the original binary file to find routines used to decode the PNG file into what I assumed is the payload of the malware. I started to look at the file further in dnSpy and started at the entry point of the binary.
Starting at the entry point method and following the flow through a few more methods, finally finding the start of the decoder functionality. The method below shows the initial routines that load the decoder.
The first items I noticed were the variables text and test2 are references to the PNG resource data. The next variable of note is test3 which looks like it could be a password. This method also contains a blob of encoded data (shown in the HexToString() call on line 9) that has various bytes swapped. Once the blob of data is decoded and returned to its original values then transformed into a string that is next decoded from Base64 into is DLL. The DLL when loaded is named CoreFunctions.dll.
After CoreFunctions.dll is loaded the method βCoreFunctions.Mainβ is executed. There are four parameters passed to this method, the first two references the PNG data, third what looks like a password, and finally the path to the full binary file. These are the variables I made a note of earlier. This method runs a few routines that decode the PNG data. Next, letβs walk through these method calls:
- Read_R reads the PNG file resource into a bitmap object.
- Reverse creates an array of each columnβs BRGA (Blue, Red, Green, Alpha) color values.
- XOR_DEC decodes the values using XOR rotating through the key βXAdgWkKβ that is XORβed against the last byte of the PNG data.
The image below shows the calls to these methods. They are high lighted in red by the breakpoints.
Once the PNG resource data is decoded into its executable binary data, it is loaded and executed in memory without writing any data to disk.
I have written a python script (that is at the end of this post), that recreates the decoding process and takes in the export of the resourceβs PNG data and the key to decodes the payload.
Once this process is completed the decoded payload is named βReZer0V2β in the metadata of the binary data. I have not done much analysis on the main payload yet other than executing the sample in a sandbox. The sandbox run can be viewed at the following Anyrun link:
https://app.any.run/tasks/577824dc-7d69-4551-86df-9892dc48c49e
I may do further analysis of this sample however this appears to be a few posts out there about this payload:
New AgentTesla variant steals WiFi credentials
Hackers Stealing WiFi Password Using New AgentTesla Malware
New Coronavirus-themed attack uses fake WHO chief emails
Wrap up
I found this an interesting sample to dissect and understand the method used to encode the PNG data and in the future to see if it can be used to decode a second sample I have with a similarly encoded PNG file. The follow-up post about that sample βW.H.O.batβ will be posted up soon. A theory I have about this sample is that it was sent out prematurely and was not fully obfuscated nor was the phishing content of the message fully completed for the campaign, however, it is just a guess.
Sample Download
https://malshare.com/sample.php?action=detail&hash=09cc3eff1d2d8503722bb195ec45d885
IOCs
SHA256: 9253368d34d7342b7c40c42d2df8a862b55bff9e197b92c18a8cdf46a3279c37
SHA1: 9e104d7c818df8e3c47609852580e3f94eb6be53
MD5: 09cc3eff1d2d8503722bb195ec45d885
Decoding Script
|
|