MalwareBazaar Database

Malicious Windows executable - spyware, dropper

Incident Response Informaiton:
Network:
DNS Requests for "mail.roofmartlk.com", "aol.com", and "eglaftb1n8ya"
Contacted "162.144.12.187"
Antivirus:
Unpacked files and memory dump detected "Fugrafa" and "Symmi" strains of malware
Packed version was frequently detected as some form of PUA or trojan
Malicious processes: "payment advise-pdf.exe", "omari.pif", "cmd.exe", "svchost.exe"

Background Context:
This malware sample was submitted to Malware Bazaar and can be viewed here" https://bazaar.abuse.ch/sample/1cdadad999b9e70c87560fcd9821c2b0fa4c0a92b8f79bded44935dd4fdc76a5/". When submitted the malware was flagged as "VegaLocker" - a ransomware strain that has recently been attacking the healthcare industry. My analysis of this malware has NOT shown that the malware is VegaLocker, rather that the malware is actually installing spyware (more details below). The malware was sent as an attachment in a malspam email that is using "covid-19" as a lure.

Initial Static Analysis:
Windows executable, PE32 executable

ClamAV Detections: "PUA.Win.Packer.Upolyx-12", "PUA.Win.Packer.Upx-6", "PUA.Win.Adware.Slugin-6803969-0", "PUA.Win.Adware.Slugin-6840354-0"
VirusTotal Rate: 43/73 engines detected this file as malicious
MD5: ab8ec4451b4a5930854293f229063a03
SHA256: 1cdadad999b9e70c87560fcd9821c2b0fa4c0a92b8f79bded44935dd4fdc76a5

Packed with UPX - clearly has a second .exe contained inside

Interesting strings: "oleaut32.dll", "127.0", "192.168.", "GetProcAddress", "LoadLibraryA"

Dynamic Analysis:
The dynamic malware analysis engine I used is VMRay Analyzer. I also attempted to detonate the malware in one of my own virtual machines - a work in progress.
You can view the full breakdown of VMRay's analysis here: "https://www.vmray.com/analyses/1cdadad999b9/report/overview.html". VMRay concluded that the file is absolutely malicious, and classified the malware as a keylogger, dropper, and spyware. The antivirus that the analyzer detected the unpacked file and flagged it as "Gen.Variant.Fugrada.33553". The antivirus also flagged the dropped file "omari.dll" as being part of "Gen.Variant.Symmi.55851". The automated analyzer detected that the malware was capturing keyboard input, studying the web-browser and different applications on the local OS, and overall just collecting large amounts of data.
In a virtual machine on my lab computer, I also attempted to detonate the malware - to varying degrees of success. Initially, the malware immediately detected that it was in a lab environment and not only refused to run, but the executable actually deleted itself. This is by far the most advanced piece of malware that I have ever run in a sandbox.

Conclusion:
Many attackers have been using the covid-19 virus to great success as the theme for their malspam campaigns. It is unknown if this campaign and attached malware are specifically targetted at the healthcare industry or just normal users. I do not know why the malware was submitted with the tag of "VegaLocker" as this malware is clearly different. I know that many submissions to Malware Bazaar are through automated honeypots and perhaps the machine just flagged the wrong file as being the cause of a ransomware infection. It is also possible that the dropper may study the user, and wait to download and execute VegaLocker ransomware. More studying in a hands-on sandbox will be required to conclude if the dropper is just waiting to do more.
According to the quick tests run by my static analysis tool (Malware-Dismantle.py, look for it on GitHub), the file is a packed executable capable of being run on most Windows machines. The executable is packed with UPX. The ClamAV scan that was looking for as many signatures as possible confirmed that the file is malicious, flagging signatures that it is indeed packed, and that the scanned file may be adware (kinda a strange detection, but adware has been getting more and more sneaky lately). Curiously, ClamAV flagged the file with various PUA detections - something that could cause the detections to be overlooked. According to the VirusTotal query, the file was indeed malicious as 43/73 antivirus engines detected it. Some of the interesting strings that I found tied the executable to a frequently abused .dll, suggested that the program may seek to analyze the local network, and further confirmed that the executable is packed.
VMRay Analyzer provided a large amount of information detailing the execution of this malicious file. VMRay is well known for having virtual environments that can fool malware into executing. The full report generated by VMRay (including network activity, execution details, files, etc) is available here: "https://www.vmray.com/analyses/1cdadad999b9/report/overview.html". In my own execution, I had difficulties getting the malware to execute. I need to work on my local lab analysis environment.
Dynamic analysis has shown that this is a malicious form of spyware, which also acts as a dropper.
Also, this is my first full analysis report of real malware. Please let me know if you have any suggestions or advice.