Follow up for Gataka /Tatanga Submission

Microsoft missed the point of all the files I submitted them. I knew that all of them were malware, I just wanted them to get the signatures in their definitions to protect others. Out of the last batch of 6 files I sent, 5 of them were samples of the malware as it resides on the system after it was dropped. The last file, which they firmly placed the words "not malware" next to, IS THE ACTUAL EXECUTABLE THAT CREATED ALL OF THE OTHER FILES I SENT THEM!!!! So the genius that looked at the files either didn't read the instructions and the cautions that I sent them and proceeded to barrel forward VirTool:Win32/Obfuscator.ZC is what they come up with... bully for them. Here is their reply with their results for the files I sent them: Gataka.zip [Container]  +---2807784521.exe.vir [Not Malware] <========= THIS IS THE DROPPER!!!!  +---AdVantage.exe.vir [VirTool:Win32/Obfuscator.ZC]  +---AdVantage.exe.vir [VirTool:Win32/Obfuscator.ZC]  +---googletalk.exe.vir [VirTool:Win32/Obfuscator.ZC]  +---googletalk.exe.vir [VirTool:Win32/Obfuscator.ZC]  +---Skype.exe.vir [VirTool:Win32/Obfuscator.ZC] So I have replied back to them trying to, once again, explain that the file they say isn't malware is actually the cause of the whole thing. Another update if I ever hear back. P.s. they even had the nerve to tell me that their detection for this was published on June 21. Funny... I submitted these files on July 2 and they didn't detect them. Just one more piece of proof that the bad guys are ahead. Hell, there's likely better money in it.

Gataka / Tatanga Malware MITB Banking Trojan

Recently I have received reports from people of their online banking sessions being hijacked and asking for additional verification of their identity.  When they contacted their bank, the bank reported that this is not their doing, and they need to have their machine scanned for malware.

Malware scans came back clean, but their were some odd exe files in places they shouldn't have been, so I investigated further.

There are 3 file names that you may see regularly.

·         Googletalk.exe

·         Skype.exe

·         AdVantage.exe

The malware has the following capabilities:

• ·         It opens a back door on the machine to allow an outside attacker to control the computer remotely
• ·         It has the ability to inject code into web pages, mostly banking and financial pages to steal user login information
• ·         It communicates via port 443 (SSL) with a Command & Control server on a pretty constant basis using the same XOR/ROT encryption as the encrypted dropper.

It may also be able to spread via network shares (meaning that it may be a network worm that spreads directly from one computer to the other automatically).

I have submitted samples of the malware, the dropper, and pcaps (packet captures) of network activity coming from an infected machine to McAfee, Microsoft, ESET, and  MalwareBytes  to ensure that this is caught by other AV firms.  All files are submitted to VirusTotal as well, so any AV firm that is a partner of theirs is also receiving the samples.

This is a new, polymorphic (meaning it changes from one machine to the other) piece of malware that has been very difficult to detect, and the name of the files aren’t something that would cause any undue attention.

The names this malware goes by are: Win32.Tatanga and Win32.Gataka.  An article on an older variant of the same family is here: http://securityblog.s21sec.com/2011/02/tatanga-new-banking-trojan-with-mitb.html.

The files are located in one of 3 locations:

C:\documents and settings\<username>\application data\Google Talk

C:\documents and settings\<username>\application data\Skype\Phone

C:\documents and settings\<username>\application data\Advantage

It survives reboot through a registry key:

HKey_Current_User\Software\Microsoft\Windows\CurrentVersion\Run

It also creates another file in:

C:\documents and settings\<username>\application data\Microsoft\

With a random, usually 4 letter folder name and a random rile name with no file extension.

It is installed on the system by a dropper that is saved in:

C:\documents and settings\<username>\Start Menu\Programs\Startup

Which is deleted after the dropper executes and installs the injector.  The dropper is saved in an encrypted form in the C:\documents and settings\<username>\application data\Microsoft\ directory in the random folder with random file name.  As of the time of this writing, it appears to be encrypted using a XOR key with a ROT element.

The injector, Googletalk.exe, AdVantage.exe, or Skype.exe, does not remain running on that machine, but instead injects its code into the explorer.exe process.  When new processes are created, it injects its code into the new one as well.  This means that if you look at task manager and don’t see it, it doesn’t mean that the machine is clean.  If the files are on the drive, and the registry keys are there, then the machine is compromised.

If you run from a CMD prompt, NETSTAT –NAO and hit enter, you may see a connection on port 443 to an external IP address.  That is most likely the connection to the C&C server, especially if it is the PID for explorer.exe that is referenced.