Bank Trojan called “Ursnif” using clever Trick to Evade sandbox Detection from the Virtual Machine Environment by using mouse movements.
New Futures has been embedded with it including anti-sandbox Technique to avoid Detection and its used combination of mouse position and file time stamps.
Trojan This clever Technique helps to decode the internal data and steal Data from the Thunderbird applications.
Ursnif Trojan focused on extracting contacts and passwords from the Mozilla Thunderbird email client, and its not focusing on stealing credentials for specific banks.
Ursnif spreads itself through emails provided with a plain text password for an attached encrypted document.
Also Read Banking Trojan “Trickbot” Powered by Necurs Targeting Financial Institutions
Ursnif Delivered via Malicious Document
This Banking Trojan Delivered through email that contains an attached ZIP file within an encrypted Word document with the plain text password within the email body.
Malicious Spam Email with Attachment (Source : Forcepoint)
Attached ZIP file contains 3 OLE document icons with the extension “docx. but its, not an actual word Document but it contains several obfuscated VBS files.
VB Script code has highly obfuscated and it developed to evade the sandbox Detection and its make Difficult to understand.
It will Download the Malware from the address “‘hxxp://46.17.40[.]22/hyey.pnj ” once this Trojan triggered in the victim’s Machine.
Once Download Attempt failed , then it will initiate the second attempts that leads to Another site ‘hxxp://inshaengineeringindustries[.]com/head.pkl’.
Malicious File Execution
Downloaded Malicious files are DLL Files which contains alot of obfuscated code that evade the Static analysis Method.
According to Forcepioint, it will drop a second DLL file During execution, , map this new DLL to the current address, fix the Import Address Table and Relocation Table, then finally jump into the entry point to execute.
After complete the self check and integrity it will performing the Following task,
- Performs anti-sandboxing checks
- Performs anti-VM checks
- Implements persistence through an autorun registry key
- Injects itself into the ‘explorer.exe’ process
Once this Trojan successfully load into the Victims , it will established the Communication with C&C server via TOR. finally it has limited Tractability and performing with anti-sandbox and anti-VM techniques.
Mouse-based Sandbox Technique
Malware Author used an algorithm that help to difference between the current and previous recorded mouse coordinates to detect mouse movement and avoid sandbox environments where the mouse is not usually moved.
According to Forcepoint, It further uses the value generated by this process to ‘brute force’ its own decryption key.
First stop of the key generation,malware calculate the Delta value between the x coordinates and y Coordination of the Mouse point .
If you want to know the full technical Analysis please visit the Forcepoint Blog
