{
  "timestamp": "2025-02-05T22:29:03.513598",
  "content": "Search Free Trial Get Demo PEMPEMPEM  Hiding Behind Fake Certificates! August 3, 2020 Over the years, enterprise security teams and threat actors have been involved in a never-ending game of cat and mouse. Organizations pour millions of dollars to stop advanced threats, but threat actors continue finding ways to evade detection by either enhancing their code or simply repackaging malware in more ways than one. This blog discusses the use of multiple components, including the use of legitimate software and encryption to deliver malware in a new manner. A few days ago, we received samples, which contained components that include a file that looked like Privacy Enhanced Mail PEM certificates. PEM certificates are Base64 encoded Distinguished Encoding Rules DER certificates and are frequently used for web servers because they can easily be translated into readable data with the use of a text editor. A PEM certificate can be identified by the presence of a header and footer, which envelopes a Base64 encoded data, just as the sample below Figure 1.0 PEM Certificate Sample This component, however, although enveloped with the PEM header and footer, includes a large amount of Base64 encoded data, which the main executable decodes using Windows cerutil.exe command line utility. Figure 2.0 Fake PEM Sample The decoded data reveals a heavily obfuscated AutoIt script containing encrypted x86 code used as a loader module to decrypt the main malware payload  in this case tempvFaqy.com  from the main executable, which is finally injected to another host process. Figure 3.0 Decoded Fake PEM revealing heavily obfuscated AutoIt script Figure 3.1 Deobfuscated Autoit Script With this information, we can use Autoit Script Debugger together with Win32dbg to extract the main payload. The script checks if the Windows platform is 32bit or 64bit. It will then use a specific set of shellcode for the determined platform to decrypt the payload. Figure 3.2 Function containing the platform and shellcode Then it will use a second shellcode to inject the payload to dllhost.exe. Figure 3.3 Code snippet of 2 nd shellcode Analysis of the injected code reveals that this payload is a variant of Vidar , a supposed copyfork of the Arkei family of Stealer Trojans. This malware family has existed since late 2018, and this variant does not have distinguishable changes from its v4.1 functionality which was analyzed and documented 2 years ago. Looking into other samples that we have detected with AU3Injector.A.gen!Camelot, we saw at least 2 types of malware packages, one using NSIS and another using CABSFX . These samples are from different malware families, indicating of a new attempt of packaging malware to evade detection with the use of multiple components and supposedly benignlegitimate applications. Shown below is the execution tree to show the overview of how the malware payload is installed into a system. We did a little digging to see which malware families are packaged with this multi-component obfuscation and below is a histogram of samples seen over the month of July. And below is the distribution of malware families using this obfuscation and a list of extracted IOCs. Indicators of Compromise IOCs SHA256 Cyren Detection Remarks 3dd24bfc6728959f084de536645e2bd20318e4a709b41cddb9245147922da1d0 AU3Injector.A.gen!Camelot Vidar Malware Package a23bb96f26b3c9f3fd5e3bcde7bd3281316ff75ead540e5f337e3967db1159bf W32Agent.BRT.gen!Eldorado Injected Vidar executable 971df5d381b1745f50b3b0a06daefe6cf96744c57f2fb9582840a4d02842f755 AU3Injector.A.gen!Camelot Agent Malware Package Like what you read in this blog? Cyren gathers actionable intelligence  like the IOCs above  by analyzing and processing billions of daily transactions in Cyren GlobalView Threat Intelligence cloud. By correlating insights gathered across email content, web traffic, and suspicious files Cyren provides security teams with a multi-dimensional presentation of critical threat characteristics. Powered by GlobalView, Cyren Threat InDepths contextualized threat intelligence allows enterprise security teams to gain unique visibility into evolving email-borne threats and make meaningful decisions to combat them. Learn more . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Microsoft Finally Acknowledges COVID-19-Related Cybercrimes Anatomy of a Phishing Attack Stolen Microsoft 365 Credentials Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "product",
  "analysis": "**Comprehensive Security Analysis and Recommendations**\n\n**1. Key Security Features and Capabilities:**\n   - **Behavior-Based Detection:** Essential for identifying malicious activities that may not be caught by traditional signature-based methods, especially when attackers misuse legitimate files and processes.\n   - **Script Control and Application Whitelisting:** Restricting the execution of scripts, particularly AutoIt, and monitoring the use of legitimate utilities like cerutil.exe to prevent malicious decoding.\n   - **Memory Protection and Anti-Injection Measures:** To detect and block process hollowing and injection techniques, protecting against malware injecting into legitimate processes.\n   - **Obfuscation Handling:** Utilizing sandboxing and advanced static/dynamic analysis tools to uncover hidden threats within obfuscated scripts and encoded files.\n   - **Multi-Layered Security Approach:** Integrating various security layers, including endpoint detection, firewalls, and email gateways, to provide comprehensive protection.\n\n**2. User Benefits and Protection Measures:**\n   - **Protection Against Advanced Threats:** Safeguards against sophisticated attacks using legitimate processes, preventing data theft and maintaining system integrity.\n   - **Prevention of Phishing Attacks:** Educating users on phishing tactics to avoid initial infection vectors, often through email.\n   - **Regular System Updates and Backups:** Ensuring software is up-to-date and critical data is backed up to mitigate potential breaches.\n\n**3. Integration with Existing Security Systems:**\n   - **Endpoint Detection and Response (EDR):** For monitoring and responding to malicious activities in real-time.\n   - **Firewalls and Email Gateways:** To filter and block malicious traffic and phishing attempts.\n   - **Threat Intelligence Sharing:** Enhancing detection capabilities by integrating with threat intelligence platforms.\n\n**4. Compliance and Certification:**\n   - Adhering to regulations requiring protection against advanced threats and data protection standards. Ensuring compliance with frameworks that emphasize robust security controls.\n\n**5. Security Best Practices for Users:**\n   - Keeping software and operating systems updated to patch vulnerabilities.\n   - Using reputable endpoint protection to detect and block malicious activities.\n   - Educating users on phishing awareness to prevent initial compromise.\n   - Regularly backing up data to ensure quick recovery in case of an attack.\n\n**6. Technical Specifications and Requirements:**\n   - Monitoring tools capable of detecting unusual behavior in legitimate processes.\n   - Advanced analysis tools to decode and analyze suspicious Base64 encoded files.\n   - Cross-platform compatibility to protect against threats beyond Windows, if applicable.\n   - Whitelisting and control measures for scripts and legitimate utilities to prevent misuse.\n\nIn summary, the focus is on leveraging a multi-layered security approach, combining behavioural analysis, script control, memory protection, and integrated security solutions. Users must adopt best practices and ensure their systems are robust against these advanced evasion techniques."
}