Netskope wurde im Gartner® Magic Quadrant™ 2024 für Security Service Edge als Leader ausgezeichnet. Report abrufen

Schließen
Schließen
  • Warum Netskope? Chevron

    Verändern Sie die Art und Weise, wie Netzwerke und Sicherheit zusammenarbeiten.

  • Unsere Kunden Chevron

    Netskope bedient mehr als 3.000 Kunden weltweit, darunter mehr als 25 der Fortune 100

  • Unsere Partner Chevron

    Unsere Partnerschaften helfen Ihnen, Ihren Weg in die Cloud zu sichern.

Immer noch am Höchsten in der Ausführung.
Immer noch am Weitesten in der Vision.

Erfahren Sie, warum Netskope im Gartner® Magic Quadrant ™ 2024 zum dritten Mal in Folge zum Leader für Security Service Edge ernannt wurde.

Report abrufen
Netskope wird im ® Magic Quadrant ™ für Security Service Edge 2024 als führend eingestuft. Grafik für Menü
Wir helfen unseren Kunden, auf alles vorbereitet zu sein

Unsere Kunden
Lächelnde Frau mit Brille schaut aus dem Fenster
Die partnerorientierte Markteinführungsstrategie von Netskope ermöglicht es unseren Partnern, ihr Wachstum und ihre Rentabilität zu maximieren und gleichzeitig die Unternehmenssicherheit an neue Anforderungen anzupassen.

Erfahren Sie mehr über Netskope-Partner
Gruppe junger, lächelnder Berufstätiger mit unterschiedlicher Herkunft
Ihr Netzwerk von morgen

Planen Sie Ihren Weg zu einem schnelleren, sichereren und widerstandsfähigeren Netzwerk, das auf die von Ihnen unterstützten Anwendungen und Benutzer zugeschnitten ist.

Whitepaper lesen
Ihr Netzwerk von morgen
Vorstellung der Netskope One-Plattform

Netskope One ist eine cloudnative Plattform, die konvergierte Sicherheits- und Netzwerkdienste bietet, um Ihre SASE- und Zero-Trust-Transformation zu ermöglichen.

Erfahren Sie mehr über Netskope One
Abstrakt mit blauer Beleuchtung
Nutzen Sie eine Secure Access Service Edge (SASE)-Architektur

Netskope NewEdge ist die weltweit größte und leistungsstärkste private Sicherheits-Cloud und bietet Kunden eine beispiellose Serviceabdeckung, Leistung und Ausfallsicherheit.

Mehr über NewEdge erfahren
NewEdge
Netskope Cloud Exchange

Cloud Exchange (CE) von Netskope gibt Ihren Kunden leistungsstarke Integrationstools an die Hand, mit denen sie in jeden Aspekt ihres Sicherheitsstatus investieren können.

Erfahren Sie mehr über Cloud Exchange
Netskope-Video
  • Edge-Produkte von Security Service Chevron

    Schützen Sie sich vor fortgeschrittenen und cloudfähigen Bedrohungen und schützen Sie Daten über alle Vektoren hinweg.

  • Borderless SD-WAN Chevron

    Stellen Sie selbstbewusst sicheren, leistungsstarken Zugriff auf jeden Remote-Benutzer, jedes Gerät, jeden Standort und jede Cloud bereit.

  • Secure Access Service Edge Chevron

    Netskope One SASE bietet eine Cloud-native, vollständig konvergente SASE-Lösung eines einzelnen Anbieters.

Die Plattform der Zukunft heißt Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) und Private Access for ZTNA sind nativ in einer einzigen Lösung integriert, um jedes Unternehmen auf seinem Weg zum Secure Access Service zu unterstützen Edge (SASE)-Architektur.

Netskope Produktübersicht
Netskope-Video
Next Gen SASE Branch ist hybrid – verbunden, sicher und automatisiert

Netskope Next Gen SASE Branch vereint kontextsensitives SASE Fabric, Zero-Trust Hybrid Security und SkopeAI-Powered Cloud Orchestrator in einem einheitlichen Cloud-Angebot und führt so zu einem vollständig modernisierten Branch-Erlebnis für das grenzenlose Unternehmen.

Erfahren Sie mehr über Next Gen SASE Branch
Menschen im Großraumbüro
Entwerfen einer SASE-Architektur für Dummies

Holen Sie sich Ihr kostenloses Exemplar des einzigen Leitfadens zum SASE-Design, den Sie jemals benötigen werden.

Jetzt das E-Book lesen
Steigen Sie auf marktführende Cloud-Security Service mit minimaler Latenz und hoher Zuverlässigkeit um.

Mehr über NewEdge erfahren
Beleuchtete Schnellstraße mit Serpentinen durch die Berge
Ermöglichen Sie die sichere Nutzung generativer KI-Anwendungen mit Anwendungszugriffskontrolle, Benutzercoaching in Echtzeit und erstklassigem Datenschutz.

Erfahren Sie, wie wir den Einsatz generativer KI sichern
ChatGPT und Generative AI sicher aktivieren
Zero-Trust-Lösungen für SSE- und SASE-Deployments

Erfahren Sie mehr über Zero Trust
Bootsfahrt auf dem offenen Meer
Netskope erhält die FedRAMP High Authorization

Wählen Sie Netskope GovCloud, um die Transformation Ihrer Agentur zu beschleunigen.

Erfahren Sie mehr über Netskope GovCloud
Netskope GovCloud
  • Ressourcen Chevron

    Erfahren Sie mehr darüber, wie Netskope Ihnen helfen kann, Ihre Reise in die Cloud zu sichern.

  • Blog Chevron

    Erfahren Sie, wie Netskope die Sicherheits- und Netzwerktransformation durch Security Service Edge (SSE) ermöglicht

  • Events und Workshops Chevron

    Bleiben Sie den neuesten Sicherheitstrends immer einen Schritt voraus und tauschen Sie sich mit Gleichgesinnten aus

  • Security Defined Chevron

    Finden Sie alles was Sie wissen müssen in unserer Cybersicherheits-Enzyklopädie.

Security Visionaries Podcast

Becoming a Non-executive Director
In this episode host Emily Wearmouth welcomes guests Richard Starnes, CISO of Six Degrees, and Homaira Akbari, President and CEO of AKnowledge Partners, for a conversation about the role of a non-executive director (NED).

Podcast abspielen
Podcast: So werden Sie Non-Executive Director
Neueste Blogs

Lesen Sie, wie Netskope die Zero Trust- und SASE-Reise durch Security Service Edge (SSE)-Funktionen ermöglichen kann.

Den Blog lesen
Sonnenaufgang und bewölkter Himmel
SASE Week 2023: Ihre SASE-Reise beginnt jetzt!

Wiederholungssitzungen der vierten jährlichen SASE Week.

Entdecken Sie Sitzungen
SASE Week 2023
Was ist Security Service Edge?

Entdecken Sie die Sicherheitselemente von SASE, die Zukunft des Netzwerks und der Security in der Cloud.

Erfahren Sie mehr über Security Service Edge
Kreisverkehr mit vier Straßen
  • Unternehmen Chevron

    Wir helfen Ihnen, den Herausforderungen der Cloud-, Daten- und Netzwerksicherheit einen Schritt voraus zu sein.

  • Leadership Chevron

    Unser Leadership-Team ist fest entschlossen, alles zu tun, was nötig ist, damit unsere Kunden erfolgreich sind.

  • Kundenlösungen Chevron

    Wir sind für Sie da, stehen Ihnen bei jedem Schritt zur Seite und sorgen für Ihren Erfolg mit Netskope.

  • Schulung und Zertifizierung Chevron

    Netskope-Schulungen helfen Ihnen ein Experte für Cloud-Sicherheit zu werden.

Unterstützung der Nachhaltigkeit durch Datensicherheit

Netskope ist stolz darauf, an Vision 2045 teilzunehmen: einer Initiative, die darauf abzielt, das Bewusstsein für die Rolle der Privatwirtschaft bei der Nachhaltigkeit zu schärfen.

Finde mehr heraus
Unterstützung der Nachhaltigkeit durch Datensicherheit
Denker, Architekten, Träumer, Innovatoren. Gemeinsam liefern wir hochmoderne Cloud-Sicherheitslösungen, die unseren Kunden helfen, ihre Daten und Mitarbeiter zu schützen.

Lernen Sie unser Team kennen
Gruppe von Wanderern erklimmt einen verschneiten Berg
Das talentierte und erfahrene Professional Services-Team von Netskope bietet einen präskriptiven Ansatz für Ihre erfolgreiche Implementierung.

Erfahren Sie mehr über professionelle Dienstleistungen
Netskope Professional Services
Mit Netskope-Schulungen können Sie Ihre digitale Transformation absichern und das Beste aus Ihrer Cloud, dem Web und Ihren privaten Anwendungen machen.

Erfahren Sie mehr über Schulungen und Zertifizierungen
Gruppe junger Berufstätiger bei der Arbeit

New Formbook Campaign Delivered Through Phishing Emails

Mar 11 2022

Summary

Since the beginning of 2022, the unfolding geopolitical conflict between Russia and Ukraine has resulted in the discovery of new malware families and related cyberattacks. In January 2022, a new malware named WhisperGate was found corrupting disks and wiping files in Ukrainian organizations. In February 2022, another destructive malware was found in hundreds of computers in Ukraine, named HermeticWiper, along with IsaacWiper and HermeticWizard.

Aside from new malware families and novel attacks, previously known malware families continue to be used against organizations in Ukraine and throughout the world. Recently, Netskope Threat Labs came across an interesting phishing email addressed to high-ranking government officials in Ukraine containing Formbook (a.k.a. XLoader), which is a well-known malware operating in the MaaS (Malware-as-a-Service) model. This malware provides full control over infected machines, offering many functionalities such as stealing passwords, grabbing screenshots, downloading, and executing additional malware, among others.

The email seems to be part of a new spam campaign, since there were multiple emails with the same subject and body addressed to other recipients. Most of them contain an infected spreadsheet encrypted with the “VelvetSweatshop” password, which is a known Formbook behavior. The infected spreadsheet delivers the threat through vulnerability described under CVE-2017-11882 and CVE-2018-0798. However, the email addressed to government officials in Ukraine contains a .NET executable, responsible for loading Formbook in a multi-stage chain:

Formbook infection chain

In this blog post, we will analyze all the layers from the email attachment to the last Formbook payload.

Phishing Email 

The infection flow starts with a generic phishing email that uses a common technique, tricking the victim into downloading the payload by pretending to be a shipping invoice.

Screenshot of phishing email containing malicious attachment.
Phishing email containing a malicious attachment.

The attachment is a compressed file containing the first Formbook stage.

Screenshot of Email attachment carrying Formbook.
Email attachment carrying Formbook.

Also, as we mentioned previously, we found similar emails delivering malicious spreadsheets, so we believe that this is part of a new spam campaign delivering multiple threats.

Screenshot of similar phishing email with a malicious attachment.
Similar phishing email with a malicious attachment.

Analysis – Summary

Before executing the last file (Formbook), the malware is divided into multiple stages, which we have summarized below.

  1. Stage 01 is a loader, responsible for decoding and executing the next stage;
  2. Stage 02 is another loader, responsible for obtaining the encrypted bytes of Stage 03 from the resources of Stage 01, decrypting and executing it;
  3. Stage 03 is a known packer/loader named CyaX-Sharp, responsible for decrypting and executing the last stage;
  4. Stage 04 is the Formbook payload, which injects itself into other processes, as described later in this analysis.
Diagram showing a summary of Formbook loading process
Summary of Formbook loading process

Analysis – Stage 01


The first stage is a .NET executable likely compiled on February 21, 2022. This file is a loader, responsible for decoding and executing the next stage.

Screenshot of binary details of the first stage.
Binary details of the first stage.

Once we decompile the file, we can see that the real executable name is “VarArgMet.exe”. This stage doesn’t contain any code obfuscation but does contain an obfuscated string and an encrypted resource which we will discuss later.

Screenshot of first stage decompiled.
First stage decompiled.

Also, this file seems to be an infected version of a public .NET project named PlaylistPanda, created in 2009. Looking at the entry point, we can see the same code that is published in the PlaylistPanda public repository, where the MainForm function is called, followed by InitializeComponent.

Example of entry point of the first stage.
Entry point of the first stage.

In this malicious version, the InitializeComponent function contains the main code of the first stage. Once running, the code reads an obfuscated and base64 encoded string stored in a variable named x121312x121312, which contains the next stage. Once it’s deobfuscated and decoded, the file is passed as an argument to the function Springfield.  

Furthermore, this loader contains a lot of junk code that will never be executed, possibly to confuse analysts and slow down analysis.

Example of loader’s main code, decoding and executing the next stage.
Loader’s main code, decoding and executing the next stage.

The Springfield function then loads the second stage as a .NET assembly, which is saved in a variable named DebuggerVisualizer.

Example of second stage being loaded as a .NET assembly.
Second stage being loaded as a .NET assembly.

The DebuggerVisualizer variable is then passed as an argument to the EraInfo function, which executes the second stage by calling the CreateInstance function with the payload and three strings as arguments:

  • 5A6F6E654964656E746974795065726D697373696F6E417474726962 (ZoneIdentityPermissionAttrib)
  • 6F513037 (oQ07)
  • PlaylistPanda
Example of second stage being executed.
Second stage being executed.

Analysis – Stage 02


The second stage is a .NET DLL, likely compiled on February 16, 2022. This file is another loader responsible for executing the third stage, which is stored in the resources of the first stage.

Screenshot of binary details of the second stage.
Binary details of the second stage.

Once we decompile the file, we can see that the real name is “SpaceChemSolver.dll”. This file doesn’t have any sort of code obfuscation or protection. The entry point of this stage is the RunCore function, which is called within SharpStructures.Main.

Screenshot of second stage’s name.
Second stage’s name.

This code is responsible for loading and executing the third stage, which is encrypted and stored as a resource named ZoneIdentityPermissionAttrib in the first stage (PlaylistPanda), masqueraded as a bitmap image.

Example of third stage execution flow.
Third stage execution flow.

After loading the fake image from the first stage resources, the function ConstructionResponse is responsible for decrypting the binary using XOR operations with the string “oQ07”.

Screenshot of the function that decrypts the third stage.
Function that decrypts the third stage.

Once decrypted, the second stage loads the third stage as a .NET assembly, like we saw previously, executing a function named yjO9HynvmD.

Example of third stage being loaded.
Third stage being loaded.

Analysis – Stage 03 (CyaX-Sharp)

The third stage is yet another .NET file, but this time it’s protected with .NET Reactor. The compilation date is also near the other files, on February 21, 2022. This file is a known loader/packer named CyaX-Sharp, which is commonly used to deliver malware like AgentTesla and Warzone RAT.

Screenshot of binary details of the third stage.
Binary details of the third stage.

Before executing the payload, this packer offers many functionalities such as Virtual Machine and Sandbox detection. These features can be enabled or disabled through configuration, which is stored in a string within the binary.

Screenshot of CyaX-Sharp configuration string.
CyaX-Sharp configuration string.

Once it’s running, it starts by parsing the configuration string and then calling the functions related to the features for which the option is enabled.

Screenshot of CyaX-Sharp main function.
CyaX-Sharp main function.

The malware checks if there’s another instance running through a Mutex object named “WuhpBQuQigdPUFFvzgV”.

Screenshot of Mutex created by the third stage.
Mutex created by the third stage.

Then, the malware checks if the process is running with administrative privileges, and it adds the path of the executable to the exclusion list of Microsoft Defender.

Screenshot of simple Windows Defender bypass.
Simple Windows Defender bypass.

In this specific file, the Virtual Machine and Sandbox verification are disabled. However, just to demonstrate how it works, this malware is able to detect virtualized environments by checking the presence of specific values in the Windows Registry, used by software like VirtualBox and VMware.

Screenshot of functionality to detect virtualized environments.
Functionality to detect virtualized environments.

For sandbox detection, the malware searches for common file names, loaded modules, and windows titles.

Screenshot of functionality to detect sandboxes.
Functionality to detect sandboxes.

CyaX-Sharp also offers a feature to download and execute additional payloads, which is also disabled in this sample.

Screenshot of functionality to download and execute additional payloads.
Functionality to download and execute additional payloads.

It then copies itself to AppData, as “YtGUemuxgzC.exe”.

Screenshot of malware copying itself to AppData.
Malware copying itself to AppData.

The permission of this file is then changed to avoid anyone from deleting it.

Example of changing recently copied AppData permission.
Changing recently copied AppData permission.

To execute this copy, a very simple persistence technique is implemented via Windows scheduled tasks.

Example of malware’s persistence.
Malware’s persistence.

The final stage is then loaded from a resource named “fVkXSK7E”, which contains the encrypted bytes of Formbook.

Example of CyaX-Sharp loading the final stage.
CyaX-Sharp loading the final stage.

Before decrypting the payload, CyaX-Sharp builds the path string of the executable that will be used to inject Formbook. In this case, the malware is configured to use “vbc.exe”.

Formbook is then decrypted through bitwise operations using the bytes of the string “SUASbkTWociWWQ”.

Screenshot of CyaX-Sharp decrypting Formbook.
CyaX-Sharp decrypting Formbook.

Formbook is injected into “vbc.exe” via Process Hollowing, which we have already explained in more detail in this analysis. All the APIs are loaded dynamically via GetProcAddress and LoadLibraryA APIs.

Screenshot of APIs related to Process Hollowing.
APIs related to Process Hollowing.

We can find Formbook fully decrypted by inspecting the “vbc.exe” process memory, or by dumping the bytes once it’s decrypted in the third stage.

Screenshot of Formbook injected into “vbc.exe”
Formbook injected into “vbc.exe”

Analysis – Stage 04 (Formbook)

The last stage is Formbook, which is an infostealer sold as a service (MaaS) on hacking-related forums since 2016. This malware provides many functionalities, such as:

  1. Grabbing keystrokes (Keylogger);
  2. Grabbing screenshots;
  3. Grabbing HTTP(s) forms from network requests;
  4. Stealing data from the clipboard;
  5. Stealing data from common software, such as browsers, email, and ftp clients;
  6. Shutdown/Reboot the OS;
  7. Download and execute additional files;
  8. Remotely execute commands;
  9. Encrypted C2 communication;

The malware is written in ASM/C, and the compilation timestamp seems to be altered, as it indicates it was created in 2003.

Screenshot of binary details of Formbook payload.
Binary details of Formbook payload.

The primary entry point of Formbook is straightforward. Once running, it calls the main function which is named “InjectMaliciousPayload” in this IDA database. Most of the strings are obfuscated using the “Stack Strings” technique, which can be defeated with FLOSS. A list of decoded strings for this sample can be found in our GitHub repository.

Screenshot of Formbook’s primary entry point.
Formbook’s primary entry point.

It then executes a sequence of functions to assess the environment and determine whether it’s going to run, by verifying the presence of blacklisted processes and usernames, for example.

Screenshot of Formbook anti-analysis mechanisms.
Formbook anti-analysis mechanisms.

After the anti-analysis mechanisms, Formbook proceeds by creating and injecting itself into a randomly chosen process from Windows directory. In this case, it is injected into “svchost.exe”.

Screenshot of Formbook injecting itself into another process.
Formbook injecting itself into another process.

Also, another instance is injected into “explorer.exe”, responsible for the C2 communication. We found 65 different domains in this sample, where 64 are only used as decoys.

Screenshot of Formbook trying to connect to domains.
Formbook trying to connect to domains.

The real C2 of this sample is “www.biohackingz[.]one”.

Screenshot of Formbook C2 communication.
Formbook C2 communication.

This domain was first seen on February 21, 2022 on VirusTotal.

Screenshot of analysis of the C2 domain.
Analysis of the C2 domain.

Once the communication is established, Formbook parses the data to determine the action that needs to be taken.

Screenshot of part of the function that parses the C2 response.
Part of the function that parses the C2 response.

Conclusions

Formbook is an infostealer, available via the Malware-as-a-Service model since 2016, often used by non-experienced people as it’s sold as a service at a reasonable price. Although it’s a simple threat, it contains many layers and techniques to slow down analysis and bypass detection engines. Regardless of the cheap price, Formbook can be quite dangerous as it provides full access to infected systems. Netskope Threat Labs will keep monitoring this new campaign as well as others that may emerge.

Protection

Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

  • Netskope Threat Protection
    • Win32.Trojan.FormBook
    • Win32.Spyware.Noon
    • Win32.Malware.Heuristic
    • ByteCode-MSIL.Malware.Heuristic
  • Netskope Advanced Threat Protection provides proactive coverage against this threat.
    • Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
    • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox

IOCs

All the IOCs related to this campaign and the Yara rules can be found in our GitHub repository.

author image
Gustavo Palazolo
Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection. He is currently working on the Netskope Research Team, discovering and analyzing new malware threats.

Stay informed!

Subscribe for the latest from the Netskope Blog