Full article508 words · extracted from arstechnica.com · click to collapse
The execution flow of LitterDrifter.
Credit:
Check Point Research
The execution flow of LitterDrifter.
Credit:
Check Point Research
Worms are forms of malware that spread without requiring a user to take any action. As self-propagating software, worms are notorious for explosive growth at exponential scales. Stuxnet, the worm created by the US National Security Agency and its counterpart from Israel, has been a cautionary tale for spy agencies. Its creators intended Stuxnet to infect only a relatively small number of Iranian targets participating in that country’s uranium enrichment program. Instead, Stuxnet spread far and wide, infecting an estimated 100,000 computers worldwide. Non-USB-activated worms such as NotPetya and WannaCry have infected even more.
LitterDrifter provides a similar means for spreading. Check Point researchers explained:
The core essence of the Spreader module lies in recursively accessing subfolders in each drive and creating LNK decoy shortcuts, alongside a hidden copy of the “trash.dll” file.
trash.dll is distributed as a hidden file in a USB drive together with a decoy LNK.
trash.dll is distributed as a hidden file in a USB drive together with a decoy LNK.
Upon execution, the module queries the computer’s logical drives using Windows Management Instrumentation (WMI), and searches for logical disks with the MediaType value set to null, a method often used to identify removable USB drives.
LitterDrifter’s spreader component.
Credit:
Check Point Research
LitterDrifter’s spreader component.
Credit:
Check Point Research
For each logical drive detected, the spreader invokes the createShortcutsInSubfolders function. Within this function, it iterates the subfolders of a provided folder up to a depth of 2.
For every subfolder, it employs the CreateShortcut function as part of the “Create LNK” action, which is responsible for generating a shortcut with specific attributes. These shortcuts are LNK files that are given random names chosen from an array in the code. This is an example of the lure’s names from an array in one of the samples that we investigated:("Bank_accоunt", "постановa", "Bank_accоunt", "службовa", "cоmpromising_evidence"). The LNK files use wscript.exe **** to execute “trash.dll” with specified arguments " ""trash.dll"" /webm //e:vbScript //b /wm /cal ". In addition to generating the shortcut, the function also creates a hidden copy of “trash.dll” in the subfolder.
The function in the Spreader component used to iterate subfolders.
Credit:
Check Point Research
The function in the Spreader component used to iterate subfolders.
Credit:
Check Point Research
The techniques described are relatively simple, but as evidenced, they’re plenty effective, so much so that they have allowed it to break out of its previous Ukrainian-only targeting domain to a much bigger realm. People who want to know if they’ve been infected can check the Check Point post’s indicators of compromise section, which lists file hashes, IP addresses, and domains used by the malware.
“Comprised of two primary components—-a spreading module and a C2 module—it’s clear that LitterDrifter was designed to support a large-scale collection operation,” Check Point researchers wrote. “It leverages simple, yet effective techniques to ensure it can reach the widest possible set of targets in the region.”