Zurück 
Netskope Threat Research Labs detected an Adware family named, ‘CapitalInstall’ delivered from Microsoft Azure blob storage whose IP range was allow listed by the multiple customers. The malware was identified via telemetry that recently alerted us on a high number of detections. These detections were related to multiple customers in the health and retail sector that recently deployed Netskope Advanced Threat Protection. Before this deployment, the binaries were shared in multiple apps internally across several enterprise users, external users, public, and anyone with a cloud share link. These binaries, which claimed to provide keys and licenses related to popular software, were downloaded in the victims’ machines and synced to cloud storage apps. These files were in turn shared across several users who needed the keys and licenses of that software. Using our clustering mechanism, we also identified similar strains of CapitalInstall across several other customer instances which we detected in the past. This particular variant of CapitalInstall installers were delivered from the same Microsoft Azure blob storage URL and packaged with a bundled adware named ‘Linkury’.
This post describes our discovery and analysis of CapitalInstall and concludes with some recommendations to help protect and remediate such threats.
Netskope Detection
Netskope Advanced Threat Protection detects CapitalInstall samples we identified as SilentInstall.Gen.
Disclosure
The Azure blob storage URL delivering CapitalInstall was reported to Microsoft on 19 November 2018.
Discovery
As mentioned earlier, since the detections were considerably high in number, our Outbreak Detection System triggered malware alerts as shown in Figure 1.
Figure 1: Malware alerts from telemetry
Figure 1 illustrates a surge in the malware alerts from telemetry across several customer instances. The spikes above 100 were caused by the customers that recently deployed Netskope Threat Protection.
After analysis, we confirmed that the detections were related to several known malware, including potentially harmful and unwanted applications. A specific strain,’CapitalInstall’ packaged with an Adware family named ‘Linkury’ with a considerably high number of detections caught our attention. Several samples related to this malware family resident in cloud storage apps were shared across internal and external users and any user with the cloud share link.
Since the detections were high in number and shared across several users, we performed a deeper investigation leading us to the discovery of the Microsoft Azure blob storage link IP range allow listed by the customers that was delivering CapitalInstall binaries.
Delivery
After analyzing all the CapitalInstall binaries related to Linkury, we identified the delivery mechanism to be drive-by-download links from a website that claim to provide keys and licenses related to popular softwares. The drive-by-download links were attributed to several TLDs, which all proceed to fetch the Linkury binary from the same Azure blob storage link, intie[.]blob.core.windows.net.
CapitalInstall – Linkury
CapitalInstall is associated to a family of potentially unwanted applications (PUPs) that the victim might have inadvertently installed in the machine. The application’s network traffic can be easily identified by the User-Agent, ‘InstallCapital’ that is most commonly used by the installers. An example of the packet capture is shown in Figure 2.
Figure 2: User-Agent: InstallCapital
The potentially unwanted applications are packaged with bundlewares lik