Security experts at Fortinet uncovered a new strain of the Vawtrak banking Trojan is implementing an obscuring mechanism based on the Tor2Web service.
The authors of the banking Trojan Vawtrak are adopting a new tactic to hide the traffic to its servers, they are exploiting the Tor2Web service to masquerade malicious connections. In the past, criminal crews behind the Vawtrak malware exploited steganography to avoid detection and some strain of malware were served using Microsoft macros.
In February 2015, security experts discovered variants of the banking trojan VAWTRAK that were coupling the use of Macros and the abuse Windows PowerShell to improve the malicious agent.
Now researchers at Fortinet uncovered a new strain of Vawtrak that was hiding its servers in Tor2Web to evade detection. The Tor2Web service allows users to access Tor resources without using a classic Tor client, but simply using a common browser. Of course, by accessing the Tor network from the Tor2Web service users are traceable.
The researchers explained that Vawtrak implements a smart Domain Name Generator that allows the malware to refer the C&C servers.
The experts discovered a collection of DWORD value hard coded in the Vawtrak source code that used them as a seed to generate the domain name.
To generate the corresponding domain name, Vawtrak uses the seed to generate the pseudo-randomized characters of the domain name.
“The malware, which also goes by the name Neverquest, has a handful of DWORD values which correspond to domain names. The malware uses the values to generate randomized domain names, which ultimately wind up linking back to tor2web.org strings. The technique bucks the malware’s usual trend of using fixed command and control servers in its variants.” wrote Raul Alvarez, a researcher with Fortinet. “If you know where to look, though, tracking and hunting these servers is hard, but possible,”
Vawtrak is rapidly evolving, developers implemented advanced web-inject and data stealing capabilities, criminal crews are using it to siphon several kind of information, including social security numbers and PINs, later its creators customized it to hit banks and retailers.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.