Netskope debuts as a Leader in the 2024 Gartner® Magic Quadrant™️ for Single-Vendor Secure Access Service Edge Get the report

close
close
  • Why Netskope chevron

    Changing the way networking and security work together.

  • Our Customers chevron

    Netskope serves more than 3,400 customers worldwide including more than 30 of the Fortune 100

  • Our Partners chevron

    We partner with security leaders to help you secure your journey to the cloud.

A Leader in SSE.
Now a Leader in Single-Vendor SASE.

Learn why Netskope debuted as a leader in the 2024 Gartner® Magic Quadrant™️ for Single-Vendor Secure Access Service Edge

Get the report
Customer Visionary Spotlights

Read how innovative customers are successfully navigating today’s changing networking & security landscape through the Netskope One platform.

Get the eBook
Customer Visionary Spotlights
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling
Your Network of Tomorrow

Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.

Get the white paper
Your Network of Tomorrow
Introducing the Netskope One Platform

Netskope One is a cloud-native platform that offers converged security and networking services to enable your SASE and zero trust transformation.

Learn about Netskope One
Abstract with blue lighting
Embrace a Secure Access Service Edge (SASE) architecture

Netskope NewEdge is the world’s largest, highest-performing security private cloud and provides customers with unparalleled service coverage, performance and resilience.

Learn about NewEdge
NewEdge
Netskope Cloud Exchange

The Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.

Learn about Cloud Exchange
Netskope video
The platform of the future is Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Next Gen SASE Branch is hybrid — connected, secured, and automated

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch
People at the open space office
Designing a SASE Architecture For Dummies

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope achieves FedRAMP High Authorization

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud
Netskope GovCloud
  • Resources chevron

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through security service edge (SSE)

  • Events and Workshops chevron

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined chevron

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

The Convergence of CIO & CISO Roles
Join host Max Havey on the latest episode of Security Visionaries as he sits down with guest Jadee Hanson, CISO at Vanta.

Play the podcast
The Convergence of CIO & CISO Roles
Latest Blogs

Read how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky
SASE Week 2023: Your SASE journey starts now!

Replay sessions from the fourth annual SASE Week.

Explore sessions
SASE Week 2023
What is SASE?

Learn about the future convergence of networking and security tools in today’s cloud dominant business model.

Learn about SASE
  • Company chevron

    We help you stay ahead of cloud, data, and network security challenges.

  • Leadership chevron

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Customer Solutions chevron

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification chevron

    Netskope training will help you become a cloud security expert.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain
Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn about Professional Services
Netskope Professional Services
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working

CloudFanta Malware Campaign Technical Analysis

Oct 25 2016
Tags
Cloud Best Practices
Cloud Malware
Cloud Security
Netskope Threat Research Labs
Tools and Tips

We recently published an overview blog about the CloudFanta malware campaign that uses the Sugarsync cloud storage app to deliver malware capable of stealing user credentials and monitoring online banking activities. This blog will detail the technical aspects of CloudFanta.

Although CloudSquirrel and CloudFanta malware are not similar, we believe that both malware campaigns are deployed by the same actor based on the following similarities.

  • Use of cloud services to download and deliver the malware and its payloads.
  • Infecting users by downloading malicious payloads (32-bit and 64-bit executables) for performing data exfiltration.
  • Targeting Brazilian users with the usage of similar file names such as NF-9944132-br.PDF.jar and the parameters used to communicate with the C&C server.

Propagation / Delivery of CloudFanta

CloudFanta malware typically arrives on the user’s machine as an attachment or a link via a spear phishing email that lures the victim to execute the file or click on the link.

The Sugarsync URL we observed delivering CloudFanta malware was at https://www[.]sugarsync[.]com/pf/D3202366_07280196_66523?directDownload=true.

The downloaded zip archive “NF-9944132-br.zip” contained a downloader JAR file “NF-9944132-br.PDF.jar” with the dual extension “.PDF.jar.” The files retrieved by this downloader JAR are detected by Netskope Threat Protection as Backdoor.Generckd.3549404, Backdoor.Generckd.3540808, Backdoor.Generckd.18673650, Backdoor.Generckd.3542220 and Gen:Variant.Symm.60013.

The visual depiction of protection from CloudFanta malware with Netskope Threat Protection is shown below.

depiction

Visual depiction of protection from CloudFanta malware with Netskope Active Threat Protection

Analysis of the Downloader JAR file

The JAR file contained the downloader functionality in the class file “Fanta_Uva.class” and was also packaged with several other class files to hinder the analysis as shown in Figure 1.

figure1

Figure 1: Files present inside the package of NF-9944132-br.PDF.jar

The decompiled code of “Fanta_Uva.class” illustrating the downloader functionality is shown in Figure 2.

figure2

Figure 2: Decompiled code of Fanta_Uva.class

Figure 2 illustrates that the malware retrieves the address of the local host and its hostname using the Java class “InetAddress” and creates a folder with the host name in the location  “C:UsersPublic.” The malware then begins to download additional files to this location using a list of hard-coded Sugarsync links with the direct download parameter. Before downloading the files, the malware checks for the location “C:\Program Files (x86).” If the location is found, the malware downloads the files p64.png, pg.png and s64.png, else the malware downloads the files p32.png, pg.png and s32.png. We believe that the location check is performed to determine if the victim is using a 64-bit or 32-bit operating system.

The downloaded files which appear to be PNG images have the file sizes ranging from 2MB to 9MB, which is very unusual for a normal PNG file. The downloaded files are in fact executable DLL files carrying a png extension as shown in Figure 3. Malware authors have typically used this technique for bypassing network security devices such as next-gen firewalls, intrusion detection systems, etc.

figure3

Figure 3: DLL files downloaded with .png extension from the hard-coded Sugarsync URL’s

These DLL files are renamed with the hostname and then appended with the extensions .twerk, tt.twerk and ff.twerk. For example, if the hostname is Admin, the files are created in the location “C:UsersPublicAdmin” as shown in Figure 4.

figure4

Figure 4: Files dropped in the machine with the hostname “Admin”

The malware also creates an empty file named “i5” and a file named “id” containing the string “al” which is subsequently used as a parameter to connect the C&C server. At the end, the downloader JAR executes the DLL with the export function “Nath” using windows rundll32.exe as shown in Figure 5.

figure5

Figure 5: Execution of the DLL file with export function “Nath”

Analysis of the DLL files

The functionality of the 32-bit and the 64-bit DLL files are identical. We have used the 32-bit version of the DLL files with the host name “Admin” for analysis.

Analysis of the file – Adminff.twerk

On execution of the Adminff.twerk with export function “Nath,” it connects to the C&C server as shown in Figure 6.

figure6

Figure 6: Connection to the C&C server by the DLL file, Adminff.twerk

The POST request notifies the C&C server that the victim has been infected. The details of the IP address of infected users are collected and stored in the file, “cnt.txt” on the C&C server with the URL path “/conts/al/” as shown in Figure 7.

figure7

Figure 7: Files present in the directory /conts/al of the C&C server.

The C&C server also contained a file named “go.php” with several commands as shown in Figure 8.

figure8

Figure 8: Parameters used by go.php in the C&C

The commands translate to the following:

  • ‘View’  – displays the access list
  • ‘Clean’  – empties the list
  • ‘Amount’ – shows the number of unique hits
  • ‘All’ – extra command to include repeated access

Adminff.twerk contained two more URL paths containing “mn” and “pz” which could be used to connect to the C&C server. However in our analysis, Adminff.twerk used the URL path that contained “al,” which was created by the downloader JAR file to connect to the C&C server as shown in figure 9.

figure9

Figure 9: URL paths al, mn, pz used by the C&C

Adminff.twerk executes the file, Admintt.twerk, containing the export function “Certeza” using rundll32.exe as shown in Figure 10.

figure10

Figure 10: Execution of the DLL file with export function “Certeza”

Figure 10 also shows the creation of registry keys in the following locations:

  • “HKUS-1-5-21-1960408961-1425521274-839522115-1003SoftwareMicrosoftWindowsCurrentVersionRunWin7” for the Adminff.twerk
  • “HKUS-1-5-21-1960408961-1425521274-839522115-1003SoftwareMicrosoftWindowsCurrentVersionRunWin” for Admintt.twerk

Analysis of the file Admintt.twerk

On execution of Admintt.twerk which contains the export function “Certeza,” it connects to the C&C server and retrieves files from the URL paths “/xx/config/nf.txt” and “/xx/config/msg.txt” as shown in Figure 11.

figure11

Figure 11: Admintt.twerk retrieving two files from the C&C server

This malware can harvest email credentials – email address, username, and password for various email services from the victim and can upload them to the C&C server. The strings present in the Admintt.twerk binary analyzed by Netskope Threat Research Labs indicate several email address that are being monitored with an intent of stealing user credentials as shown in Figure 12.

figure12

Figure 12:  Strings showing the data collected and uploaded to the C&C server.

If the monitored email service is accessed from an infected machine, the victim’s email login page would be redirected to a phished login page to acquire the credentials. In our analysis, the malware presented us the phished Gmail login page as shown in Figure 13.

figure13

Figure 13: Phished Gmail login page displayed to the victim

On entering the login details the victim’s credentials are uploaded to the C&C server as shown in Figure 14. The victim is then redirected to the original Gmail login page.

figure14

Figure 14: Infected user credentials uploaded to the C&C server.

All the credentials collected from the victims using gmail.com are saved in the file “gm.txt” in the C&C server. The C&C server also hosted several other files containing email address and credentials of infected users as shown in Figure 15.

figure15

Figure 15: Files present in the directory /xx of the C&C server

If the string present in the “id” file created by the Downloader JAR file is “mn,” Admintt.twerk will connect to another C&C server for sending the victim’s email credentials. This C&C server also hosted several files containing email credentials as shown in Figure 16.

figure16

Figure 16: Files present in the directory /xx of the other C&C server

At the time of publishing, we found the servers contained more than 26,000 email addresses and credentials collected from the infected users.

The config folder of the C&C server contained a HTML page “Comprovante-029.html” as shown in Figure 17.

figure17

Figure 17: Comprovante-029.html present in the location /xx/config of the C&C server

The URLs referred by the hyperlinks of the html page are as shown in Figure 18.

figure18

Figure 18: URLs present in the file Comprovante-029.html

The data in the HTML page is used as template for the file, “msg.txt” with bit.ly links. This file “msg.txt” was also present in the config folder. The bit.ly links redirect to sugarsync cloud storage service for delivering the JAR file and continuing the malware infection. We also observed the bit.ly links are upadated on daily basis with a change of date in msg.txt. For example the message displayed when we analyzed the C&C server recently is shown in Figure 19.

figure19

Figure 19: Message disp