0000_Sec_Logo_with_tm.png

Xbot, HawkEye, and AZORult have made recent appearances on the CyberCrimetracker and are now tracked by both the tracker and ThreatSTOP. The goal of the three families is stealing sensitive information from victims.

Xbot

Xbot is a Trojan family given its name by Palo Alto Networks who also believe the malware is a successor to Alurin a previous Android Trojan. The primary difference being the programing languages and libraries used by the malware. With Xbot focusing on JavaScript and the Rhino framework from Mozilla, while Alurin used .NET and Lua. It appears, however, that the author is the same, having just changed up their toolchain.

Xbot has already appeared in 22 malware apps all targeting Android devices. The distribution seems to be targeting Eastern Europe, Russia, and Australia. With Eastern Europe and Russia confirmed by Avast. This targeting is due -- at least in the European and Russian cases -- to the use of non-Google based app markets, instead favoring local app markets which may not have the same level of scrutiny that Google provides.

Under active development, it's expected that this Trojan will continue to be an active force for some time. Its primary method of gathering data is to mimic Google Play store payment screens and record the data provided by the user, it can also spoof several banking applications. Additionally, it has the ability to encrypt the device and demand a ransom and will copy all SMS messages, and contact information.

The malware's development is extensible, currently targeting banks in Russia and Australia, it can be expanded to target other countries and Android apps. Its main attack method is to hijack the phone's activity and injects itself over applications that are in use. This doesn't attack the application itself but instead poses an interfering layer over an active application. Another attack vector displays an alert which asks the user to input credit card information.

In some instances, a command from the C2C system will cause XBot to encrypt the phone and demand a ransom. In order for this to occur the malware asks the user to grant it administrator privileges, if granted these permissions and the switch is thrown, then the device encrypts itself.

In any case, the end goal of Xbot is the same: capture SMS (text message) data, contact information, and banking information and send it to the C2C.

Xbot family was added to the following ThreatSTOP targets:

  • TS Curated – Mobile Threats (Standard and expert)
  • TS Curated – Banking Threats (Standard and expert)
  • CyberCrime Tracker (Expert only)
  • Xbot (Expert only)

HawkEye

Shifting from Android we're going to look at the HawkEye family of malware. HawkEye targets Word, but it does something a little different from the usual Word attack.

It's worth noting that HawkEye itself isn't an actual piece of malware, but rather a category of malware defined by Sophos's security researcher, Gabor Szappanos (Spazi).

More traditional Word based attacks have relied on attaching macros (kind of a mini-program) to a Word doc. Then begging the user to turn on macros to get it to run. HawkEye doesn't require macros. Instead, it relies on two factors:

  • The user hasn't patched their version of Word for some time.
  • The user blindly trusts any document sent to them from the Internet.

While a significant number of users patch regularly and aren't in danger of this attack, a small number are.

HawkEye works by using a malformed Word Doc. On opening, the document Word will crash, but still, has programmatic control over the OS. It uses this control to download and install another piece of malware (making this a dropper), this new malware then carries out whatever nefarious deeds the attacker wants.

One of the biggest concerns with this type of attack is that it lowers the bar for attack difficulty. A malicious user, not even a savvy one, can buy malformed Word docs, and embed malware into them. Then a spear phishing campaign could see a decent return for the amount of time invested.

The defense against this type of attack is to counteract the two points above. Patch regularly, and don't open unexpected attachments to emails.

HawkEye family was added to the following ThreatSTOP targets:

TS Curated – Botnets (Standard and expert)

CyberCrime (Expert only)

HawkEye (Expert only)

 

AZORult

AZORult is actually the weakest of this bunch, it's not much of a family. It's a Trojan horse that steals information from a compromised system.

After installation and running by another piece of malware (most commonly Seamless), AZORult begins looking for sensitive data. In particular, it looks for and submits the following to its C2C, as provided by malwarebreakdown.com:

  • Saved passwords from several program types (Browsers, Email, FTP, IM)
  • Cookies from browsers and forms (form history, autofill):
  • Collects wallet.dat files from popular bitcoin clients (Bitcoin, Litecoin, etc.)
  • Skype message history
  • Grabs files from chat history then reads the files with special utilities
  • Desktop files grabber
  • Collects files with specified extensions from Desktop. Filtered by file size. Recursively searches files in folders.
  • List of installed programs
  • List of running processes
  • Username, computer name, OS, RAM

AZORult needs other malware, like HawkEye, Xbot or Seamless, to get into the computer. From there it can grab its data and submits it to its C2C system. It's also a known and quick to remediate Trojan, with a removal tool already crafted by Symantec.

AZORult family was added to the following ThreatSTOP targets:

TS Curated – Botnets (Standard and Expert)

CyberCrime (Expert only)

AZORult (Exprt only)

 

To enable ThreatSTOP’s protection against these malware families in your firewall turn on the targets described above in the ThreatSTOP portal.

If you don’t have a ThreatSTOP account, Sign up. If you do have a ThreatSTOP account, instructions to add targets to DNS or IP Defense policies are available on the ThreatSTOP Documentation Hub. Or, contact our Support team.