Gataka / Tatanga Malware MITB Banking Trojan

Recently I have received reports from people of their online banking sessions being hijacked and asking for additional verification of their identity.  When they contacted their bank, the bank reported that this is not their doing, and they need to have their machine scanned for malware.

Malware scans came back clean, but their were some odd exe files in places they shouldn't have been, so I investigated further.

There are 3 file names that you may see regularly.

·         Googletalk.exe

·         Skype.exe

·         AdVantage.exe

The malware has the following capabilities:

• ·         It opens a back door on the machine to allow an outside attacker to control the computer remotely
• ·         It has the ability to inject code into web pages, mostly banking and financial pages to steal user login information
• ·         It communicates via port 443 (SSL) with a Command & Control server on a pretty constant basis using the same XOR/ROT encryption as the encrypted dropper.

It may also be able to spread via network shares (meaning that it may be a network worm that spreads directly from one computer to the other automatically).

I have submitted samples of the malware, the dropper, and pcaps (packet captures) of network activity coming from an infected machine to McAfee, Microsoft, ESET, and  MalwareBytes  to ensure that this is caught by other AV firms.  All files are submitted to VirusTotal as well, so any AV firm that is a partner of theirs is also receiving the samples.

This is a new, polymorphic (meaning it changes from one machine to the other) piece of malware that has been very difficult to detect, and the name of the files aren’t something that would cause any undue attention.

The names this malware goes by are: Win32.Tatanga and Win32.Gataka.  An article on an older variant of the same family is here: http://securityblog.s21sec.com/2011/02/tatanga-new-banking-trojan-with-mitb.html.

The files are located in one of 3 locations:

C:\documents and settings\<username>\application data\Google Talk

C:\documents and settings\<username>\application data\Skype\Phone

C:\documents and settings\<username>\application data\Advantage

It survives reboot through a registry key:

HKey_Current_User\Software\Microsoft\Windows\CurrentVersion\Run

It also creates another file in:

C:\documents and settings\<username>\application data\Microsoft\

With a random, usually 4 letter folder name and a random rile name with no file extension.

It is installed on the system by a dropper that is saved in:

C:\documents and settings\<username>\Start Menu\Programs\Startup

Which is deleted after the dropper executes and installs the injector.  The dropper is saved in an encrypted form in the C:\documents and settings\<username>\application data\Microsoft\ directory in the random folder with random file name.  As of the time of this writing, it appears to be encrypted using a XOR key with a ROT element.

The injector, Googletalk.exe, AdVantage.exe, or Skype.exe, does not remain running on that machine, but instead injects its code into the explorer.exe process.  When new processes are created, it injects its code into the new one as well.  This means that if you look at task manager and don’t see it, it doesn’t mean that the machine is clean.  If the files are on the drive, and the registry keys are there, then the machine is compromised.

If you run from a CMD prompt, NETSTAT –NAO and hit enter, you may see a connection on port 443 to an external IP address.  That is most likely the connection to the C&C server, especially if it is the PID for explorer.exe that is referenced.