Bladabindi Malware Abusing Pastebin.com as Infection Vector

Earlier, malware authors kept their payloads on Command and Control (C&C) servers or compromised websites. And to do this, they had to setup their C&C server or compromise a genuine website. But now, they don’t need to bother about such things, as they have started using genuine file sharing sites like “Pastebin.com” which allows user to store malware in plain-text. Pastebin.com is a well-known website where users can store plain text.

While analyzing malware samples, we found that the malware is downloading the “Base64” encoded text from pastebin.com. On decoding this Base64 data, we received an executable file which is the main payload of the malware. Most of these executables are from “Bladabindi” family.

The downloader enters into the user’s computer using various techniques like spam emails and social engineering. In this report, we will see how pastebin.com is misused with analysis of one malware sample.

Analysis of Bladabindi (MD5: 0C34D70FF9DD1BA3B7BFE9F4FBA8F010)

The file is an Auto-it installer. On execution, it drops two executable files at “C:\Documents and Settings\[user]\Local Settings” and executes the same. The dropped files are as follows:

1. TempWinToFlash.exe: Genuine tool used to create bootable USB with any Windows Setup from a DVD/ISO
2. TempWindows.exe: Copies itself in “%temp%” as system.exe and executes it. Now this system.exe downloads Base64 encoded file from “pastebin.com\download.php?i=pejXu40a” decodes it and injects the decoded executable in self-process. Thereafter, all activities are carried out by this downloaded file.

This Base64 Encoded file on Pastebin.com looks like the below figure 1.

After Base64 decode it is .Net file as below.

Activity of Main_Component.exe (In memory component)

This component is developed using Microsoft Visual Basic.Net.

Auto-run

It copies system.exe in “Startup” folder as 12ce4e06a81e8d54fd01d9b762f1b1bb.exe

Registry changes for Auto-run

It adds the following auto-run registry entry:

1. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\

12ce4e06a81e8 d54fd01d9b762f1b1bb:  “%temp%\system.exe”

2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\

12ce4e06a81e8d54fd01d9b762f1b1bb : “%temp%\system.exe”

Other Registry Changes

It also adds the following registry entry:

HKEY_CURRENT_USER\Environment\SEE_MASK_NOZONECHECKS = 1

Further it saves downloaded Base64 encoded data in registry such as:

HKEY_CURRENT_USER\Software\12ce4e06a81e8d54fd01d9b762f1b1bb\f8c065f4e758233f0d12dc9b8cf7a2ce = [Base64_Encoded_Main_Payload]

Bypass Firewall:

It executes the following command to bypass Firewall:

netsh firewall add allowedprogram  [Path_Of_system.exe] ENABLE

Main Activity

This backdoor gathers the following data and sends it to C&C server:

• Computer name
• User name
• OS version
• Date of installation

It provides the following RAT functionalities to the attacker:

• Keylogging
• Capturing screenshots
• Bypassing Firewall
• Process Management: start new process or kill any process
• Registry Management: get or set registry key/value
• Provides remote shell access to the attacker
• Downloading and executing files
• Updating current RAT
• Compressing files for uploading
• Deleting self-copies

The main payload of the virus saves all keystrokes in the registry as shown in figure 3.

Encryption and decryption

The malware sends all data in Base64 encoded format. Except files are uploaded after ZIP compression.

The backdoor supports following commands:

Tricks used by the malware to avoid detection and cleaning

1. Critical process

It makes itself as a critical process to prevent it from being stopped. The infected system may crash with a stop code 0x000000F4 if the malware process is interrupted. This can make it difficult to clean the computer when the malware is running.

2. Registry resident non executable payload

Downloaded file is never saved on the disk, but it gets saved in the registry. The next time the system is booted, the downloaded file is read from the registry and decoded; the decoded executable is then injected into the system.exe process.

3. Bypass automated analysis or make analysis difficult

The first component mentioned above (0C34D70FF9DD1BA3B7BFE9F4FBA8F010) is an auto-it installer. The Auto-It script contains the following code:

Due to this code, it will not show any malicious activity when any one of these monitoring tools is running. This enables the malware to bypass automated analysis. It also makes it difficult for analysts to manually analyze the sample.

Statistics about the “pastebin.com”

The main payload is stored in Base64 encoded format. We have found more than 100 Base64 encoded files on “pastebin.com”. Almost all of these files are malicious. Interestingly, 90% of them belong to the same malware family i.e., Bladabindi. The Bladabindi samples have been listed below:

Quick Heal Detection

Conclusion

Malware authors are abusing “pastebin.com” for spreading different malware families. As per our analysis among all these families, “Bladabindi” RAT is spreading rapidly. More than 7500 users have been infected via pastebin.com since 2015. As the main payload is never stored on the disk, it is difficult to detect such malware.

Acknowledgment

Subject Matter Experts

• Prakash Galande
• Sagar Daundkar
  – Threat Research & Response Team