Kaspersky Securelistpublished Aug 29, 09:55 UTC (Aug 29, 2014)ingested Sep 10, 06:23 UTC@Securelist

Sinkholing the Backoff POS Trojan

highMalwareimportance 42

Indicators of compromiseauto-extracted · verify before use · export allAll →

Type	Indicator	Context
domain	888.ru	71c72fd7fcad54a0f8d0 C&C domains and hostnames: 00000000000.888[.]ru 10000000000.888[.]ru adobephotoshop11111[.]com adobephoto
domain	adobephotoshop11111.com	ns and hostnames: 00000000000.888[.]ru 10000000000.888[.]ru adobephotoshop11111[.]com adobephotoshop22222[.]com domain12827312[.]com helloflash
domain	adobephotoshop22222.com	000.888[.]ru 10000000000.888[.]ru adobephotoshop11111[.]com adobephotoshop22222[.]com domain12827312[.]com helloflashplayers12345[.]com helloja
domain	domain12827312.com	88[.]ru adobephotoshop11111[.]com adobephotoshop22222[.]com domain12827312[.]com helloflashplayers12345[.]com hellojavaplayers12345[.]com
domain	helloflashplayers12345.com	p11111[.]com adobephotoshop22222[.]com domain12827312[.]com helloflashplayers12345[.]com hellojavaplayers12345[.]com ilovereservdom213ada2[.]ru io
domain	hellojavaplayers12345.com	222[.]com domain12827312[.]com helloflashplayers12345[.]com hellojavaplayers12345[.]com ilovereservdom213ada2[.]ru iownacarservice[.]ru iownacars
domain	ilovereservdom213ada2.ru	om helloflashplayers12345[.]com hellojavaplayers12345[.]com ilovereservdom213ada2[.]ru iownacarservice[.]ru iownacarservice1[.]com msframework1[
domain	iownacarservice1.com	12345[.]com ilovereservdom213ada2[.]ru iownacarservice[.]ru iownacarservice1[.]com msframework1[.]com msframework1[.]ru msframeworkx64[.]com
domain	iownacarservice.ru	]com hellojavaplayers12345[.]com ilovereservdom213ada2[.]ru iownacarservice[.]ru iownacarservice1[.]com msframework1[.]com msframework1[.]
domain	msframework1.com	dom213ada2[.]ru iownacarservice[.]ru iownacarservice1[.]com msframework1[.]com msframework1[.]ru msframeworkx64[.]com msframeworkx86[.]c
domain	msframework1.ru	nacarservice[.]ru iownacarservice1[.]com msframework1[.]com msframework1[.]ru msframeworkx64[.]com msframeworkx86[.]com msframeworkx86[
domain	msframeworkx64.com	iownacarservice1[.]com msframework1[.]com msframework1[.]ru msframeworkx64[.]com msframeworkx86[.]com msframeworkx86[.]ru msoffice365net[.
domain	msframeworkx86.com	m msframework1[.]com msframework1[.]ru msframeworkx64[.]com msframeworkx86[.]com msframeworkx86[.]ru msoffice365net[.]com nullllllllllll[.
domain	msframeworkx86.ru	msframework1[.]ru msframeworkx64[.]com msframeworkx86[.]com msframeworkx86[.]ru msoffice365net[.]com nullllllllllll[.]com ollygo030233[.]
domain	msoffice365net.com	frameworkx64[.]com msframeworkx86[.]com msframeworkx86[.]ru msoffice365net[.]com nullllllllllll[.]com ollygo030233[.]com ollygo030233[.]ru
domain	nullllllllllll.com	frameworkx86[.]com msframeworkx86[.]ru msoffice365net[.]com nullllllllllll[.]com ollygo030233[.]com ollygo030233[.]ru pop3smtp5imap2[.]com
domain	ollygo030233.com	frameworkx86[.]ru msoffice365net[.]com nullllllllllll[.]com ollygo030233[.]com ollygo030233[.]ru pop3smtp5imap2[.]com pop3smtp5imap3[.]c
domain	ollygo030233.ru	soffice365net[.]com nullllllllllll[.]com ollygo030233[.]com ollygo030233[.]ru pop3smtp5imap2[.]com pop3smtp5imap3[.]com pop3smtp5imap4[
domain	pop3smtp5imap2.com	m nullllllllllll[.]com ollygo030233[.]com ollygo030233[.]ru pop3smtp5imap2[.]com pop3smtp5imap3[.]com pop3smtp5imap4[.]ru reservedomain123
domain	pop3smtp5imap3.com	m ollygo030233[.]com ollygo030233[.]ru pop3smtp5imap2[.]com pop3smtp5imap3[.]com pop3smtp5imap4[.]ru reservedomain12312[.]ru total-updates
domain	pop3smtp5imap4.ru	ollygo030233[.]ru pop3smtp5imap2[.]com pop3smtp5imap3[.]com pop3smtp5imap4[.]ru reservedomain12312[.]ru total-updates[.]com C&C IPs: 146.
domain	reservedomain12312.ru	p3smtp5imap2[.]com pop3smtp5imap3[.]com pop3smtp5imap4[.]ru reservedomain12312[.]ru total-updates[.]com C&C IPs: 146.185.233.32 81.4.111.176
domain	total-updates.com	mtp5imap3[.]com pop3smtp5imap4[.]ru reservedomain12312[.]ru total-updates[.]com C&C IPs: 146.185.233.32 81.4.111.176 95.211.228.249 217.1
ipv4	146.185.233.32	4[.]ru reservedomain12312[.]ru total-updates[.]com C&C IPs: 146.185.233.32 81.4.111.176 95.211.228.249 217.174.105.86
ipv4	217.174.105.86	s[.]com C&C IPs: 146.185.233.32 81.4.111.176 95.211.228.249 217.174.105.86
ipv4	81.4.111.176	omain12312[.]ru total-updates[.]com C&C IPs: 146.185.233.32 81.4.111.176 95.211.228.249 217.174.105.86
ipv4	95.211.228.249	ru total-updates[.]com C&C IPs: 146.185.233.32 81.4.111.176 95.211.228.249 217.174.105.86
md5	01f0d20a1a32e535b950428f5b5d6e72	3b955e134ae281d09a467e420a d1d544dbf6b3867d758a5e7e7c3554bf 01f0d20a1a32e535b950428f5b5d6e72 fc041bda43a3067a0836dca2e6093c25 4956cf9ddd905ac3258f9605cf
md5	05f2c7675ff5cda1bee6a168bdbecac0	b9280bf3a8ceb366997488486e c0d0b7ffaec38de642bf6ff6971f4f9e 05f2c7675ff5cda1bee6a168bdbecac0 9ee4c29c95ed435644e6273b1ae3da58 0607ce9793eea0a42819957528
md5	0607ce9793eea0a42819957528d92b02	675ff5cda1bee6a168bdbecac0 9ee4c29c95ed435644e6273b1ae3da58 0607ce9793eea0a42819957528d92b02 97fa64dfaa27d4b236e4a76417ab51c1 82d811a8a76df0cda3f34fdcd0
md5	0b464c9bebd10f02575b9d9d3a771db3	6c28ccf43e569cb21a6122a97e cc640ad87befba89b440edca9ae5d235 0b464c9bebd10f02575b9d9d3a771db3 d0c74483f20c608a0a89c5ba05c2197f b1661862db623e05a2694c483d
md5	0b7732129b46ed15ff73f72886946220	dfaa27d4b236e4a76417ab51c1 82d811a8a76df0cda3f34fdcd0e26e27 0b7732129b46ed15ff73f72886946220 30c5592a133137a84f61898993e513db aa68ecf6f097ffb01c981f09a2
md5	12c9c0bc18fdf98189457a9d112eebfc	daaffa02ffecd6c7747ffa030e 3ff0f444ef4196f2a47a16eeec506e93 12c9c0bc18fdf98189457a9d112eebfc 14cca3ad6365cb50751638d35bdb84ec d0f3bf7abbe65b91434905b695
md5	14cca3ad6365cb50751638d35bdb84ec	44ef4196f2a47a16eeec506e93 12c9c0bc18fdf98189457a9d112eebfc 14cca3ad6365cb50751638d35bdb84ec d0f3bf7abbe65b91434905b6955203fe 38e8ed887e725339615b28e60f
md5	17e1173f6fc7e920405f8dbde8c9ecac	580843cb0c0f4baff57db8962e b08d4847c370f79af006d113b3d8f6cf 17e1173f6fc7e920405f8dbde8c9ecac 874cd0b7b22ae1521fd0a7d405d6fa12 ea0c354f61ba0d88a422721cae
md5	29e0259b4ea971c72fd7fcad54a0f8d0	f6f097ffb01c981f09a21aef32 bbe534abcc0a907f3c18cfe207a5dfca 29e0259b4ea971c72fd7fcad54a0f8d0 C&C domains and hostnames: 00000000000.888[.]ru 10000000000
md5	30c5592a133137a84f61898993e513db	a8a76df0cda3f34fdcd0e26e27 0b7732129b46ed15ff73f72886946220 30c5592a133137a84f61898993e513db aa68ecf6f097ffb01c981f09a21aef32 bbe534abcc0a907f3c18cfe207
md5	337058dca8e6cbcb0bc02a85c823a003	c5e332df3af78823ca4a655ae8 8a019351b0b145ee3abe097922f0d4f6 337058dca8e6cbcb0bc02a85c823a003 842e903b955e134ae281d09a467e420a d1d544dbf6b3867d758a5e7e7c
md5	38e8ed887e725339615b28e60f3271e4	ad6365cb50751638d35bdb84ec d0f3bf7abbe65b91434905b6955203fe 38e8ed887e725339615b28e60f3271e4 7b027599ae15512256bb5bc52e58e811 5cdc9d5998635e2b91c0324465
md5	3ff0f444ef4196f2a47a16eeec506e93	an.Win32.Agent.ahgxs MD5s: 684e03daaffa02ffecd6c7747ffa030e 3ff0f444ef4196f2a47a16eeec506e93 12c9c0bc18fdf98189457a9d112eebfc 14cca3ad6365cb50751638d35b
md5	4956cf9ddd905ac3258f9605cf85332b	0a1a32e535b950428f5b5d6e72 fc041bda43a3067a0836dca2e6093c25 4956cf9ddd905ac3258f9605cf85332b f5b4786c28ccf43e569cb21a6122a97e cc640ad87befba89b440edca9a
md5	5cdc9d5998635e2b91c0324465c6018f	887e725339615b28e60f3271e4 7b027599ae15512256bb5bc52e58e811 5cdc9d5998635e2b91c0324465c6018f 821ac2580843cb0c0f4baff57db8962e b08d4847c370f79af006d113b3
md5	684e03daaffa02ffecd6c7747ffa030e	bhh Trojan.Win32.Agent.ahhee Trojan.Win32.Agent.ahgxs MD5s: 684e03daaffa02ffecd6c7747ffa030e 3ff0f444ef4196f2a47a16eeec506e93 12c9c0bc18fdf98189457a9d11
md5	6a0e49c5e332df3af78823ca4a655ae8	b7b22ae1521fd0a7d405d6fa12 ea0c354f61ba0d88a422721caefad394 6a0e49c5e332df3af78823ca4a655ae8 8a019351b0b145ee3abe097922f0d4f6 337058dca8e6cbcb0bc02a85c8
md5	7b027599ae15512256bb5bc52e58e811	7abbe65b91434905b6955203fe 38e8ed887e725339615b28e60f3271e4 7b027599ae15512256bb5bc52e58e811 5cdc9d5998635e2b91c0324465c6018f 821ac2580843cb0c0f4baff57d
md5	821ac2580843cb0c0f4baff57db8962e	99ae15512256bb5bc52e58e811 5cdc9d5998635e2b91c0324465c6018f 821ac2580843cb0c0f4baff57db8962e b08d4847c370f79af006d113b3d8f6cf 17e1173f6fc7e920405f8dbde8
md5	82d811a8a76df0cda3f34fdcd0e26e27	9793eea0a42819957528d92b02 97fa64dfaa27d4b236e4a76417ab51c1 82d811a8a76df0cda3f34fdcd0e26e27 0b7732129b46ed15ff73f72886946220 30c5592a133137a84f61898993
md5	842e903b955e134ae281d09a467e420a	51b0b145ee3abe097922f0d4f6 337058dca8e6cbcb0bc02a85c823a003 842e903b955e134ae281d09a467e420a d1d544dbf6b3867d758a5e7e7c3554bf 01f0d20a1a32e535b950428f5b
md5	874cd0b7b22ae1521fd0a7d405d6fa12	47c370f79af006d113b3d8f6cf 17e1173f6fc7e920405f8dbde8c9ecac 874cd0b7b22ae1521fd0a7d405d6fa12 ea0c354f61ba0d88a422721caefad394 6a0e49c5e332df3af78823ca4a
md5	8a019351b0b145ee3abe097922f0d4f6	4f61ba0d88a422721caefad394 6a0e49c5e332df3af78823ca4a655ae8 8a019351b0b145ee3abe097922f0d4f6 337058dca8e6cbcb0bc02a85c823a003 842e903b955e134ae281d09a46
md5	97fa64dfaa27d4b236e4a76417ab51c1	9c95ed435644e6273b1ae3da58 0607ce9793eea0a42819957528d92b02 97fa64dfaa27d4b236e4a76417ab51c1 82d811a8a76df0cda3f34fdcd0e26e27 0b7732129b46ed15ff73f72886
md5	9ee4c29c95ed435644e6273b1ae3da58	ffaec38de642bf6ff6971f4f9e 05f2c7675ff5cda1bee6a168bdbecac0 9ee4c29c95ed435644e6273b1ae3da58 0607ce9793eea0a42819957528d92b02 97fa64dfaa27d4b236e4a76417
md5	aa68ecf6f097ffb01c981f09a21aef32	129b46ed15ff73f72886946220 30c5592a133137a84f61898993e513db aa68ecf6f097ffb01c981f09a21aef32 bbe534abcc0a907f3c18cfe207a5dfca 29e0259b4ea971c72fd7fcad54
md5	b08d4847c370f79af006d113b3d8f6cf	5998635e2b91c0324465c6018f 821ac2580843cb0c0f4baff57db8962e b08d4847c370f79af006d113b3d8f6cf 17e1173f6fc7e920405f8dbde8c9ecac 874cd0b7b22ae1521fd0a7d405
md5	b1661862db623e05a2694c483dce6e91	9bebd10f02575b9d9d3a771db3 d0c74483f20c608a0a89c5ba05c2197f b1661862db623e05a2694c483dce6e91 ffe53fb9280bf3a8ceb366997488486e c0d0b7ffaec38de642bf6ff697
md5	bbe534abcc0a907f3c18cfe207a5dfca	2a133137a84f61898993e513db aa68ecf6f097ffb01c981f09a21aef32 bbe534abcc0a907f3c18cfe207a5dfca 29e0259b4ea971c72fd7fcad54a0f8d0 C&C domains and hostnames:
md5	c0d0b7ffaec38de642bf6ff6971f4f9e	62db623e05a2694c483dce6e91 ffe53fb9280bf3a8ceb366997488486e c0d0b7ffaec38de642bf6ff6971f4f9e 05f2c7675ff5cda1bee6a168bdbecac0 9ee4c29c95ed435644e6273b1a
md5	cc640ad87befba89b440edca9ae5d235	9ddd905ac3258f9605cf85332b f5b4786c28ccf43e569cb21a6122a97e cc640ad87befba89b440edca9ae5d235 0b464c9bebd10f02575b9d9d3a771db3 d0c74483f20c608a0a89c5ba05
md5	d0c74483f20c608a0a89c5ba05c2197f	d87befba89b440edca9ae5d235 0b464c9bebd10f02575b9d9d3a771db3 d0c74483f20c608a0a89c5ba05c2197f b1661862db623e05a2694c483dce6e91 ffe53fb9280bf3a8ceb3669974
md5	d0f3bf7abbe65b91434905b6955203fe	bc18fdf98189457a9d112eebfc 14cca3ad6365cb50751638d35bdb84ec d0f3bf7abbe65b91434905b6955203fe 38e8ed887e725339615b28e60f3271e4 7b027599ae15512256bb5bc52e
md5	d1d544dbf6b3867d758a5e7e7c3554bf	dca8e6cbcb0bc02a85c823a003 842e903b955e134ae281d09a467e420a d1d544dbf6b3867d758a5e7e7c3554bf 01f0d20a1a32e535b950428f5b5d6e72 fc041bda43a3067a0836dca2e6
md5	ea0c354f61ba0d88a422721caefad394	3f6fc7e920405f8dbde8c9ecac 874cd0b7b22ae1521fd0a7d405d6fa12 ea0c354f61ba0d88a422721caefad394 6a0e49c5e332df3af78823ca4a655ae8 8a019351b0b145ee3abe097922
md5	f5b4786c28ccf43e569cb21a6122a97e	da43a3067a0836dca2e6093c25 4956cf9ddd905ac3258f9605cf85332b f5b4786c28ccf43e569cb21a6122a97e cc640ad87befba89b440edca9ae5d235 0b464c9bebd10f02575b9d9d3a
md5	fc041bda43a3067a0836dca2e6093c25	dbf6b3867d758a5e7e7c3554bf 01f0d20a1a32e535b950428f5b5d6e72 fc041bda43a3067a0836dca2e6093c25 4956cf9ddd905ac3258f9605cf85332b f5b4786c28ccf43e569cb21a61
md5	ffe53fb9280bf3a8ceb366997488486e	83f20c608a0a89c5ba05c2197f b1661862db623e05a2694c483dce6e91 ffe53fb9280bf3a8ceb366997488486e c0d0b7ffaec38de642bf6ff6971f4f9e 05f2c7675ff5cda1bee6a168bd

Full article679 words · extracted from securelist.com · click to collapse

There is currently a lot of buzz about the Backoff point-of-sale Trojan that is designed to steal credit card information from computers that have POS terminals attached.

Trustwave SpiderLab, which originally discovered this malware, posted a very thorough analysis in July. The U.S. Secret Service, in partnership with DHS, followed up with an advisory.

Although very thorough, the existing public analyses of Backoff are missing a very relevant piece of information: the command-and-control (C&C) servers. However, if you have access to the samples it isn’t hard to extract this information. At the end of this document, you can find a full list together with other IOCs (indicators of compromise).

Backoff malware configuration, with C&Cs

We sinkholed two C&C servers that Backoff samples used to communicate with their masters. These C&C servers are used by certain samples that were compiled from January – March 2014. Over the past few days, we observed over 100 victims in several countries connecting to the sinkhole.

Statistics:

There were several interesting victims among them:

A global freight shipping and transport logistics company with headquarters in North America.
A U.K.-based charitable organization that provides support, advice and information to local voluntary organizations and community groups.
A payroll association in North America.
A state institute connected with information technology and communication in Eastern Europe.
A liquor store chain in the U.S.
An ISP in Alabama, U.S.
A U.S.-based Mexican food chain.
A company that owns and manages office buildings in California, U.S.
A Canadian company that owns and operates a massive chain of restaurants.

There are also a lot of home user lines, mostly in the U.S. and Canada, connecting to the sinkhole. This is to be expected as many smaller businesses generally tend to run those rather than dedicated corporate connections.

Conclusions

The success of Backoff paints a very bleak picture of the state of point-of-sale security. Our sinkhole covers less than 5% of the C&C channels and the sinkholed domains only apply to certain Backoff samples that were created in the first quarter of this year. Yet, we’ve seen more than 85 victims connecting to our sinkhole.

Most of these victims are located in North America and some of them are high profile. Taking into account the U.S. Secret Service statement, it’s a pretty safe bet that the number of Backoff infections at businesses in North America is well north of 1,000.

Since its appearance last year, Backoff has not changed dramatically. The author created both non-obfuscated and obfuscated samples. This was likely done to defeat the security controls on the targeted networks. However, the defenses running on a PoS terminal and/or network should not have been affected by this. This speaks volumes about the current state of PoS security, and other cybercriminals are sure to have taken note.

It’s very clear that PoS networks are prime targets for malware attacks. This is especially true in the US, which still doesn’t support EMV chip-enabled cards. Unlike magnetic strips, EMV chips on credit cards can’t be easily cloned, making them more resilient. Unfortunately, the US is adopting chip and signature, rather than chip and PIN. This effectively negates some of the added security EMV can bring.

This may prove another costly mistake. Not adopting EMV along with the rest of the world is really haunting retail in the U.S. and the situation is not likely to change anytime soon.

IOCs / C&Cs:

Trojan file paths:

%APPDATA%\AdobeFlashPlayer\mswinsvc.exe %APPDATA%\AdobeFlashPlayer\mswinhost.exe %APPDATA%\AdobeFlashPlayer\Local.dat %APPDATA%\AdobeFlashPlayer\Log.txt %APPDATA%\mskrnl %APPDATA%\nsskrnl %APPDATA%\winserv.exe %APPDATA%\OracleJava\javaw.exe %APPDATA%\OracleJava\javaw.exe %APPDATA%\OracleJava\Local.dat %APPDATA%\OracleJava\Log.txt

Kaspersky names for the Trojans:

HEUR:Trojan.Win32.Invader HEUR:Trojan.Win32.Generic Backdoor.Win32.Backoff Trojan.Win32.Agent.ahhia Trojan.Win32.Agent.agvmh Trojan.Win32.Agent.aeyfj Trojan-Spy.Win32.Recam.qq Trojan-Dropper.Win32.Sysn.ajci Trojan.Win32.Bublik.covz Trojan-Dropper.Win32.Dapato.dddq Trojan.Win32.Agent.agufs Trojan.Win32.Agent.ahbhh Trojan.Win32.Agent.agigp Trojan.Win32.Agent.aeqsu Trojan.Win32.Agent.ahgxs Trojan.Win32.Inject.mhjl Trojan.Win32.Agent.ahbhh Trojan.Win32.Agent.ahhee Trojan.Win32.Agent.ahgxs

MD5s:

684e03daaffa02ffecd6c7747ffa030e 3ff0f444ef4196f2a47a16eeec506e93 12c9c0bc18fdf98189457a9d112eebfc 14cca3ad6365cb50751638d35bdb84ec d0f3bf7abbe65b91434905b6955203fe 38e8ed887e725339615b28e60f3271e4 7b027599ae15512256bb5bc52e58e811 5cdc9d5998635e2b91c0324465c6018f 821ac2580843cb0c0f4baff57db8962e b08d4847c370f79af006d113b3d8f6cf 17e1173f6fc7e920405f8dbde8c9ecac 874cd0b7b22ae1521fd0a7d405d6fa12 ea0c354f61ba0d88a422721caefad394 6a0e49c5e332df3af78823ca4a655ae8 8a019351b0b145ee3abe097922f0d4f6 337058dca8e6cbcb0bc02a85c823a003 842e903b955e134ae281d09a467e420a d1d544dbf6b3867d758a5e7e7c3554bf 01f0d20a1a32e535b950428f5b5d6e72 fc041bda43a3067a0836dca2e6093c25 4956cf9ddd905ac3258f9605cf85332b f5b4786c28ccf43e569cb21a6122a97e cc640ad87befba89b440edca9ae5d235 0b464c9bebd10f02575b9d9d3a771db3 d0c74483f20c608a0a89c5ba05c2197f b1661862db623e05a2694c483dce6e91 ffe53fb9280bf3a8ceb366997488486e c0d0b7ffaec38de642bf6ff6971f4f9e 05f2c7675ff5cda1bee6a168bdbecac0 9ee4c29c95ed435644e6273b1ae3da58 0607ce9793eea0a42819957528d92b02 97fa64dfaa27d4b236e4a76417ab51c1 82d811a8a76df0cda3f34fdcd0e26e27 0b7732129b46ed15ff73f72886946220 30c5592a133137a84f61898993e513db aa68ecf6f097ffb01c981f09a21aef32 bbe534abcc0a907f3c18cfe207a5dfca 29e0259b4ea971c72fd7fcad54a0f8d0

C&C domains and hostnames:

00000000000.888[.]ru 10000000000.888[.]ru adobephotoshop11111[.]com adobephotoshop22222[.]com domain12827312[.]com helloflashplayers12345[.]com hellojavaplayers12345[.]com ilovereservdom213ada2[.]ru iownacarservice[.]ru iownacarservice1[.]com msframework1[.]com msframework1[.]ru msframeworkx64[.]com msframeworkx86[.]com msframeworkx86[.]ru msoffice365net[.]com nullllllllllll[.]com ollygo030233[.]com ollygo030233[.]ru pop3smtp5imap2[.]com pop3smtp5imap3[.]com pop3smtp5imap4[.]ru reservedomain12312[.]ru total-updates[.]com

C&C IPs:

146.185.233.32 81.4.111.176 95.211.228.249 217.174.105.86

Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/sinkholing-the-backoff-pos-trojan/66305/