By Maarten Van Horenbeeck

Over the last few months, a relatively significant number of RAR files have shown up in various targeted attacks we've looked at. Archivers are very interesting targets. Generally, you upgrade software when you require new functionality, or when the software informs you that an upgrade has been made available.

WinRAR, a very popular archiver, hasn't really added significant new functionality to its feature set. The reason is quite easy to understand: you expect your archiver to create archives. It doesn't need to do much more. It also doesn't trigger you to upgrade all that often. Over all, it's a useful tool, but it remains just that. A tool.

This may explain the following little graph, which shows you the different pieces of software that were targeted in one ongoing attack, focused against one organization, which we've been tracking for quite some time now:

Quite popular indeed, WinRAR.

Winrar has been affected by quite a few vulnerabilities in the versions leading up to WinRAR 3.6. In February of this year, a vulnerability was found in the handling of password encrypted RAR archives using the unrar command line tool. Another bug, identified in 2006, was rooted in incorrect handling of LHA archives by WinRAR. In 2005, two bugs in Winrar 3.51 each allowed an attacker to create malicious RAR files which then executed code on affected systems.

Yesterday, an interesting sample called "pictures.rar" was attached to an otherwise benign e-mail message. To people using the vast majority of file scanning based AV solutions, the file didn't even look all that suspicious. Below is a list of coverage at the time of distribution. Note that the engines which did identify the file actually share engines:

AhnLab-V3 2007.11.24.0 2007.11.23 -
AntiVir 7.6.0.34 2007.11.25 -
Authentium 4.93.8 2007.11.24 -
Avast 4.7.1074.0 2007.11.25 -
AVG 7.5.0.503 2007.11.25 -
BitDefender 7.2 2007.11.25 -
CAT-QuickHeal 9.00 2007.11.24 -
ClamAV 0.91.2 2007.11.25 -
DrWeb 4.44.0.09170 2007.11.25 -
eSafe 7.0.15.0 2007.11.21 -
eTrust-Vet 31.3.5324 2007.11.24 -
Ewido 4.0 2007.11.25 -
FileAdvisor 1 2007.11.25 -
Fortinet 3.14.0.0 2007.11.25 -
F-Prot 4.4.2.54 2007.11.25 -
F-Secure 6.70.13030.0 2007.11.25 Exploit.Win32.WinRar.g
Ikarus T3.1.1.12 2007.11.25 Exploit.Win32.WinRar.g
Kaspersky 7.0.0.125 2007.11.25 Exploit.Win32.WinRar.g
McAfee 5170 2007.11.23 -
Microsoft 1.3007 2007.11.25 -
NOD32v2 2684 2007.11.25 -
Norman 5.80.02 2007.11.23 -
Panda 9.0.0.4 2007.11.25 -
Prevx1 V2 2007.11.25 -
Rising 20.19.61.00 2007.11.25 -
Sophos 4.23.0 2007.11.25 -
Sunbelt 2.2.907.0 2007.11.24 -
Symantec 10 2007.11.25 -
TheHacker 6.2.9.141 2007.11.24 -
VBA32 3.12.2.5 2007.11.23 -
VirusBuster 4.3.26:9 2007.11.25 -
Webwasher-Gateway 6.0.1 2007.11.25 -

When opened on a recent WinRAR 3.6, the application refused to open the file. On an older WinRAR 3.4.2 on an XP system however, more interesting things happened.

The RAR archive triggered a buffer overflow vulnerability in WinRAR, after which code was executed which dropped an Alternate Data Stream (ADS) at:

C:\windows\system32:system32.exe

While it’s trivial to extract ASCII files from ADS streams, it’s relatively difficult to do the same with binaries. There are several freeware tools available which can do this, but the free versions generally restrict you from reading ADS from within the Windows directory. The easiest command-line solution is CAT.exe from the Windows 2000 resource kit, or you can copy file and accompanying ADS to another directory using Robocopy (a command line replacement for xcopy which does support data streams) and then use whatever tool you wish.

Once extracted, the UPX packed file could easily be unpacked. It had virtually no AV detection, and injects code into the Internet Explorer process. Next, iexplore.exe performs a DNS lookup for the following host:

sds.bi-apple.net

This host currently resolves to 63.64.63.64, which is really a fictional IP address that is used by this specific group (I like to refer to them as "threat agents") quite regularly, apparently to "park" their attack hosts when not in use. Finally, the tool attempts to set up an obfuscated connection to that server on port 3460.

While we're still looking at the backdoor, a member of the DarkMoon family, it appears to have at least some keylogging functionality. Most interesting, it does almost all from memory, with only a 9k binary stored on-disk.