Retour 
We recently published an overview blog about the CloudFanta malware campaign that uses the Sugarsync cloud storage app to deliver malware capable of stealing user credentials and monitoring online banking activities. This blog will detail the technical aspects of CloudFanta.
Although CloudSquirrel and CloudFanta malware are not similar, we believe that both malware campaigns are deployed by the same actor based on the following similarities.
- Use of cloud services to download and deliver the malware and its payloads.
- Infecting users by downloading malicious payloads (32-bit and 64-bit executables) for performing data exfiltration.
- Targeting Brazilian users with the usage of similar file names such as NF-9944132-br.PDF.jar and the parameters used to communicate with the C&C server.
Propagation / Delivery of CloudFanta
CloudFanta malware typically arrives on the user’s machine as an attachment or a link via a spear phishing email that lures the victim to execute the file or click on the link.
The Sugarsync URL we observed delivering CloudFanta malware was at https://www[.]sugarsync[.]com/pf/D3202366_07280196_66523?directDownload=true.
The downloaded zip archive “NF-9944132-br.zip” contained a downloader JAR file “NF-9944132-br.PDF.jar” with the dual extension “.PDF.jar.” The files retrieved by this downloader JAR are detected by Netskope Threat Protection as Backdoor.Generckd.3549404, Backdoor.Generckd.3540808, Backdoor.Generckd.18673650, Backdoor.Generckd.3542220 and Gen:Variant.Symm.60013.
The visual depiction of protection from CloudFanta malware with Netskope Threat Protection is shown below.
Visual depiction of protection from CloudFanta malware with Netskope Active Threat Protection
Analysis of the Downloader JAR file
The JAR file contained the downloader functionality in the class file “Fanta_Uva.class” and was also packaged with several other class files to hinder the analysis as shown in Figure 1.
Figure 1: Files present inside the package of NF-9944132-br.PDF.jar
The decompiled code of “Fanta_Uva.class” illustrating the downloader functionality is shown in Figure 2.
Figure 2: Decompiled code of Fanta_Uva.class
Figure 2 illustrates that the malware retrieves the address of the local host and its hostname using the Java class “InetAddress” and creates a folder with the host name in the location “C:UsersPublic.” The malware then begins to download additional files to this location using a list of hard-coded Sugarsync links with the direct download parameter. Before downloading the files, the malware checks for the location “C:\Program Files (x86).” If the location is found, the malware downloads the files p64.png, pg.png and s64.png, else the malware downloads the files p32.png, pg.png and s32.png. We believe that the location check is performed to determine if the victim is using a 64-bit or 32-bit operating system.
The downloaded files which appear to be PNG images have the file sizes ranging from 2MB to 9MB, which is very unusual for a normal PNG file. The downloaded files are in fact executable DLL files carrying a png extension as shown in Figure 3. Malware authors have typically used this technique for bypassing network security devices such as next-gen firewalls, intrusion detection systems, etc.
Figure 3: DLL files downloaded with .png extension from the hard-coded Sugarsync URL’s
These DLL files are renamed with the hostname and then appended with the extensions .twerk, tt.twerk and ff.twerk. For example, if the hostname is Admin, the files are created in the location “C:UsersPublicAdmin” as shown in Figure 4.
