An unusually Swift(tay) malware delivery tactic

10 February 2017

While doing some background research into recent reporting by Dr Web on a newly identified version of Mirai, we made an interesting discovery. VirusTotal behavioural analyses for the Windows Mirai hashes provided by Dr Web indicated that each sample used HTTP GET requests to download text files from three subdomains on what appeared to be a threat actor controlled site (f4321y[.]com). Each sample also used HTTP GET requests to request the infected hosts IP from pubyun[.]com and, significantly, to download an image file from a Chinese social media site. Interest piqued, we took a look at the file and discovered that it was an image of Taylor Swift carrying an embedded portable executable (PE) file. Examination of the PE indicated that it was a malicious executable named WPD.exe, which was found to be classified as a remote access trojan (RAT).

 

Windows Mirai Taylor

Figure 1 - Image downloaded by Windows Mirai malware samples.

We decided to dig a little further and examine the passive DNS data for the C2 domain identified by Dr Web. This indicated that it was hosted on and IP address which also hosts another domain (mykings[.]pw) with three subdomains named identically to those on the Windows Mirai C2 domain. Further examination turned up 25 further malware samples which were found to behave very similarly to those identified by Dr Web. All sent HTTP GET request to request host IPs from pubyun[.]com and to download text files from subdomains of mykings[.]pw. Several of these samples were also found to be sending DNS requests to f4321y[.]com. In addition to these behaviors, many of these samples also pulled identical images of Taylor Swift carrying a second malicious PE file from another Chinese social media site. The chart below provides a graphical representation of these connections.   

 Mirai C2 Link Analysis

Figure 2 - Link chart of entities involved in malware delivery campaign.

Based on the information we’ve been able to assemble, it appeared likely that whoever was responsible for the Windows Mirai operation identified by Dr Web has also been using linked infrastructure (and pictures of Taylor Swift) to distribute and operate a RAT and at least 25 other malware samples. The scale of this distribution operation was not known at the time of writing, but compilation and signature signing timestamps on many of the malicious files indicated that many of the malicious executables identified were created in February 2017, suggesting that at the time of writing, this element of the distribution operation was relatively recent. It remains to be seen whether any further information on this campaign will Swiftly emerge. 

 

IOC appendix

Windows Mirai samples identified by Dr Web

9575d5edb955e8e57d5886e1cf93f54f52912238

f97e8145e1e818f17779a8b136370c24da67a6a5

42c9686dade9a7f346efa8fdbe5dbf6fa1a7028e

938715263e1e24f3e3d82d72b4e1d2b60ab187b8

 

Image files 

1a606f84d7d9cb247a733db0d1f970436064da512603a207d17b7b79dd1af538

9e416e2412e70fdb599b80af5d4a73b762b7d771fcdef32ed3ff280813b58d9b

 

PE files 

4554f2e9c3f1e25186716e597a29d2b7ae141c228dc851200839a4e6c149c5ba

115b8d3f908c01c185e2b1b9b3389bc6501860de97b4f232b848445a3e48cc85

4856706c088f66965d714fe09af22ee56d84483278582ff3dd8f98bc3c5862ab

bdad4a77b678fda8328b2fae290e525a553c490214d43df377dbeb3132879673

93bf864cfc6540e7fa4dd416373e3173ef613f5a7680bd395ba362e3bbff3d1c

2de4851dcaaa4b5ed8421a0c72ceed64497c147d85cbfb1928d6baf7760c0c46

301ef54e284864b246010bd085fb5d12ca8e6fd92daaa362e60f64af2d9c194a

2d8cd23e33e56ab396960a0d426c232f6d8905e2ac5833f37c412b699135f6ce

 

C2 infrastructure

f4321y[.]com

mykings[.]pw

60[.]250[.]76[.]52

 

Malware linked to identified C2

210986d3d18f6cebba30d85e3d89d559

62270a12707a4dcf1865ba766aeda9bc

3ee9f93e1f8515c44411530d6d902dbf

93ccd8225c8695cade5535726b0dd0b6

5707f1e71da33a1ab9fe2796dbe3fc74

10164584800228de0003a37be3a61c4d

481aa11eb5504ab70dc02d5c829b9199

bce5c1569b6f44dac35d14cd2c5e44f8

1713d083aafbf7e8408e6cedfed42524

2d411f5f92984a95d4c93c5873d9ae00

8008aa6cc33086f0c5f055f0a2ff6e4e

55d860d8d21dd7ab051084beb61abd45

43e7580e15152b67112d3dad71c247ec

9098e520c4c1255299a2512e5e1135ba

e7761db0f63bc09cf5e4193fd6926c5e

297d1980ce171ddaeb7002bc020fe6b6

c88ece9a379f4a714afaf5b8615fc66c

c289c15d0f7e694382a7e0a2dc8bdfd8

a3c09c2c3216a3a24dce18fd60a5ffc2

fb7b79e9337565965303c159f399f41b

91a12a4cf437589ba70b1687f5acad19

104917a5a5671daec0bcc73f884d8ba3

ad0496f544762a95af11f9314e434e94

9fd02ee6c10fef2dcc365a6d9077f614

7fa0227ff6f5d077b11d7eba8fa8e398