CloudFanta Malware Campaign Technical Analysis

We recently published an overview blog about the CloudFanta malware campaign that uses the Sugarsync cloud storage app to deliver malware capable of stealing user credentials and monitoring online banking activities. This blog will detail the technical aspects of CloudFanta.

Although CloudSquirrel and CloudFanta malware are not similar, we believe that both malware campaigns are deployed by the same actor based on the following similarities.

• Use of cloud services to download and deliver the malware and its payloads.
• Infecting users by downloading malicious payloads (32-bit and 64-bit executables) for performing data exfiltration.
• Targeting Brazilian users with the usage of similar file names such as NF-9944132-br.PDF.jar and the parameters used to communicate with the C&C server.

Propagation / Delivery of CloudFanta

CloudFanta malware typically arrives on the user’s machine as an attachment or a link via a spear phishing email that lures the victim to execute the file or click on the link.

The Sugarsync URL we observed delivering CloudFanta malware was at https://www[.]sugarsync[.]com/pf/D3202366_07280196_66523?directDownload=true.

The downloaded zip archive “NF-9944132-br.zip” contained a downloader JAR file “NF-9944132-br.PDF.jar” with the dual extension “.PDF.jar.” The files retrieved by this downloader JAR are detected by Netskope Threat Protection as Backdoor.Generckd.3549404, Backdoor.Generckd.3540808, Backdoor.Generckd.18673650, Backdoor.Generckd.3542220 and Gen:Variant.Symm.60013.

The visual depiction of protection from CloudFanta malware with Netskope Threat Protection is shown below.

Visual depiction of protection from CloudFanta malware with Netskope Active Threat Protection

Analysis of the Downloader JAR file

The JAR file contained the downloader functionality in the class file “Fanta_Uva.class” and was also packaged with several other class files to hinder the analysis as shown in Figure 1.

Figure 1: Files present inside the package of NF-9944132-br.PDF.jar

The decompiled code of “Fanta_Uva.class” illustrating the downloader functionality is shown in Figure 2.

Figure 2: Decompiled code of Fanta_Uva.class

Figure 2 illustrates that the malware retrieves the address of the local host and its hostname using the Java class “InetAddress” and creates a folder with the host name in the location  “C:UsersPublic.” The malware then begins to download additional files to this location using a list of hard-coded Sugarsync links with the direct download parameter. Before downloading the files, the malware checks for the location “C:\Program Files (x86).” If the location is found, the malware downloads the files p64.png, pg.png and s64.png, else the malware downloads the files p32.png, pg.png and s32.png. We believe that the location check is performed to determine if the victim is using a 64-bit or 32-bit operating system.

The downloaded files which appear to be PNG images have the file sizes ranging from 2MB to 9MB, which is very unusual for a normal PNG file. The downloaded files are in fact executable DLL files carrying a png extension as shown in Figure 3. Malware authors have typically used this technique for bypassing network security devices such as next-gen firewalls, intrusion detection systems, etc.

Figure 3: DLL files downloaded with .png extension from the hard-coded Sugarsync URL’s

These DLL files are renamed with the hostname and then appended with the extensions .twerk, tt.twerk and ff.twerk. For example, if the hostname is Admin, the files are created in the location “C:UsersPublicAdmin” as shown in Figure 4.

Figure 4: Files dropped in the machine with the hostname “Admin”

The malware also creates an empty file named “i5” and a file named “id” containing the string “al” which is subsequently used as a parameter to connect the C&C server. At the end, the downloader JAR executes the DLL with the export function “Nath” using windows rundll32.exe as shown in Figure 5.

Figure 5: Execution of the DLL file with export function “Nath”

Analysis of the DLL files

The functionality of the 32-bit and the 64-bit DLL files are identical. We have used the 32-bit version of the DLL files with the host name “Admin” for analysis.

Analysis of the file – Adminff.twerk

On execution of the Adminff.twerk with export function “Nath,” it connects to the C&C server as shown in Figure 6.

Figure 6: Connection to the C&C server by the DLL file, Adminff.twerk

The POST request notifies the C&C server that the victim has been infected. The details of the IP address of infected users are collected and stored in the file, “cnt.txt” on the C&C server with the URL path “/conts/al/” as shown in Figure 7.

Figure 7: Files present in the directory /conts/al of the C&C server.

The C&C server also contained a file named “go.php” with several commands as shown in Figure 8.

Figure 8: Parameters used by go.php in the C&C

The commands translate to the following:

• ‘View’  – displays the access list
• ‘Clean’  – empties the list
• ‘Amount’ – shows the number of unique hits
• ‘All’ – extra command to include repeated access

Adminff.twerk contained two more URL paths containing “mn” and “pz” which could be used to connect to the C&C server. However in our analysis, Adminff.twerk used the URL path that contained “al,” which was created by the downloader JAR file to connect to the C&C server as shown in figure 9.

F