{"id":90568,"date":"2021-11-24T16:32:35","date_gmt":"2021-11-24T11:02:35","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=90568"},"modified":"2023-02-15T16:29:13","modified_gmt":"2023-02-15T10:59:13","slug":"anydesk-software-exploited-to-spread-babuk-ransomware","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/anydesk-software-exploited-to-spread-babuk-ransomware\/","title":{"rendered":"Anydesk Software Exploited to Spread Babuk Ransomware"},"content":{"rendered":"\r\n

We generally see that ransomware attacks<\/a> are deployed through exploits, unsolicited malicious emails (malspam), or malicious Microsoft Office documents. Attackers trick the unsuspecting users into enabling macros, etc. Apart from these usual attack techniques, we came across a new way of using Anydesk software fake websites to spread Babuk ransomware. Anydesk is a remote-control tool that allows users to access remote computers and other devices running the host applications.
Babuk Ransomware is recently very active. Its tactics for encryption are not much different from other ransomware families. Over time, ransomware releases new variants and improves its attack mechanisms to target new victims.<\/p>\r\n

\"\"
Fig 1. Initial Vector of infection<\/figcaption><\/figure>\r\n

When the user tries to download the Anydesk software from an unknown suspicious link, a fake website appears, which allows you to download Anydesk software. This fake website looks like the original Anydesk website. When the user clicks for downloading Anydesk software, ransomware is also downloaded as it is bundled with Anydesk software in the form of a self-extracting archive (in this case, it is in no setup files). It does so for evasion purposes.<\/p>\r\n

For, e.g., If Anydesk is searched in Microsoft or Bing, we get the following result. The first website is not related to the official Anydesk application, and After clicking on the setelog website, ads.htm redirects to a malicious website that downloads ransomware.<\/p>\r\n

\"\"
Fig 2. Searching Anydesk application<\/figcaption><\/figure>\r\n

Similarly, we have found one more suspicious link for the Anydesk application, which is mentioned below.
URL:
https[:]\/\/Anydesk1[.]websiteseguro[.]com\/downloads\/windows\/?_ga=2.165501695.1936674747.1628634255-780551265.1627305233<\/em><\/strong>
Downloaded File Name: Setup_Anydesk.exe

<\/p>\r\n

\"\"
Fig 3. After Clicking on the downloaded file, an installation window appears<\/figcaption><\/figure>\r\n

We analyzed the downloaded archive and discovered that it has a clean Anydesk setup along with a Babuk downloader, a RAT file, and a REG file.<\/p>\r\n

\"\"
Fig 4. Files present inside an archive<\/figcaption><\/figure>\r\n

Understanding the Infection Process<\/strong>
When a user clicks on the downloaded archive, which pretends to be an Anydesk software application, other files in the bundle get dropped silently. The above image shows an Allakore Rat client named bthudtaskt.exe, a Babuk downloader called mdnsFULLHD.exe, and one registry file named Anydesk. Reg is fallen in the Startup folder without user interaction. Clean Anydesk application is dropped at the desktop, and it gets installed. All the dropped files in the startup folder are executed through PowerShell and their activity in the background.<\/p>\r\n

Anydesk.Reg:<\/strong>
\"\"
Anydesk. reg file disables user account control by setting the value of EnableLUA by 0. It also disables windows defender by setting the value of DisableAntiSpyware by 1. Malware also disables real-time protection by setting values by 1.<\/p>\r\n


Allakore RAT Client:<\/strong>
AllaKore Rat is an open-source simple Remote Access Tool written in Delphi and has a very high resemblance with code found on GitHub.
\"\"
Babuk Downloader launches the Allakore Rat, and it makes TCP requests, as shown below.<\/p>\r\n


\"\"

Babuk Downloader:<\/strong>
The ‘mdnsFULLHD.exe’ file is PE32 executable for MS Windows, and it is Delphi compiled. It is immense (~ 12MB) as it has most of the code to impair the defences. It launches the Allakore Rat \u00f9sing PowerShell cmdlet Set-preference, making TCP requests as shown above image.
It adds the below paths in exclusion for the Windows Defender modules through the PowerShell cmdlet Set-MpPreference to hide all the malware components from Windows Defender.<\/p>\r\n

\"\"<\/p>\r\n


For eg:
cmd.exe \/c PowerShell -Command Add-MpPreference -ExclusionPath “C:\\Users\\XXX\\Contacts”
cmd.exe \/c PowerShell -Command Add-MpPreference -ExclusionPath “C:\\Users\\XXX\\Links” etc
Above are excluded by executing cmd.exe. The malware also excludes the below drives.<\/p>\r\n

\"\"
It has a list of AVs, as shown below, and it checks if any of the antivirus product is installed in the system.<\/p>\r\n

\"\"<\/p>\r\n


If any antivirus processes are running on the system, the below prompt appears, asking the user to intervene and uninstall the product. If the user clicks on the Next button, the control panel opens for uninstalling the software, and in the background, the malware checks whether it is uninstalled.<\/p>\r\n

\"\"<\/p>\r\n

The malware disables Task manager, and it undermines all the modules of Windows Defender.
Further digging into the file revealed that malware sent an HTTP request to download the bat file and .exe file. The domain used are:
“hxxp:\/\/suporte01928492.redirectme.net\/Update7\/Update.bat.rar”<\/em>
“hxxp:\/\/suporte01928492.redirectme.net\/Update7\/Update.exe.rar”<\/em>
These downloaded files are saved in:
“C:\\Users\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup” folder. Malware creates these files and names according to the user name and then executes both the files silently using PowerShell.
Files created: .exe and .bat
E.g., if the username is ABC, the file name is ABC.exe and ABC.bat in the folder mentioned above.

Update.bat<\/strong><\/p>\r\n