{
  "timestamp": "2025-02-05T22:25:29.505733",
  "content": "Search Free Trial Get Demo PEMPEMPEM  Hiding Behind Fake Certificates! August 3, 2020 Over the years, enterprise security teams and threat actors have been involved in a never-ending game of cat and mouse. Organizations pour millions of dollars to stop advanced threats, but threat actors continue finding ways to evade detection by either enhancing their code or simply repackaging malware in more ways than one. This blog discusses the use of multiple components, including the use of legitimate software and encryption to deliver malware in a new manner. A few days ago, we received samples, which contained components that include a file that looked like Privacy Enhanced Mail PEM certificates. PEM certificates are Base64 encoded Distinguished Encoding Rules DER certificates and are frequently used for web servers because they can easily be translated into readable data with the use of a text editor. A PEM certificate can be identified by the presence of a header and footer, which envelopes a Base64 encoded data, just as the sample below Figure 1.0 PEM Certificate Sample This component, however, although enveloped with the PEM header and footer, includes a large amount of Base64 encoded data, which the main executable decodes using Windows cerutil.exe command line utility. Figure 2.0 Fake PEM Sample The decoded data reveals a heavily obfuscated AutoIt script containing encrypted x86 code used as a loader module to decrypt the main malware payload  in this case tempvFaqy.com  from the main executable, which is finally injected to another host process. Figure 3.0 Decoded Fake PEM revealing heavily obfuscated AutoIt script Figure 3.1 Deobfuscated Autoit Script With this information, we can use Autoit Script Debugger together with Win32dbg to extract the main payload. The script checks if the Windows platform is 32bit or 64bit. It will then use a specific set of shellcode for the determined platform to decrypt the payload. Figure 3.2 Function containing the platform and shellcode Then it will use a second shellcode to inject the payload to dllhost.exe. Figure 3.3 Code snippet of 2 nd shellcode Analysis of the injected code reveals that this payload is a variant of Vidar , a supposed copyfork of the Arkei family of Stealer Trojans. This malware family has existed since late 2018, and this variant does not have distinguishable changes from its v4.1 functionality which was analyzed and documented 2 years ago. Looking into other samples that we have detected with AU3Injector.A.gen!Camelot, we saw at least 2 types of malware packages, one using NSIS and another using CABSFX . These samples are from different malware families, indicating of a new attempt of packaging malware to evade detection with the use of multiple components and supposedly benignlegitimate applications. Shown below is the execution tree to show the overview of how the malware payload is installed into a system. We did a little digging to see which malware families are packaged with this multi-component obfuscation and below is a histogram of samples seen over the month of July. And below is the distribution of malware families using this obfuscation and a list of extracted IOCs. Indicators of Compromise IOCs SHA256 Cyren Detection Remarks 3dd24bfc6728959f084de536645e2bd20318e4a709b41cddb9245147922da1d0 AU3Injector.A.gen!Camelot Vidar Malware Package a23bb96f26b3c9f3fd5e3bcde7bd3281316ff75ead540e5f337e3967db1159bf W32Agent.BRT.gen!Eldorado Injected Vidar executable 971df5d381b1745f50b3b0a06daefe6cf96744c57f2fb9582840a4d02842f755 AU3Injector.A.gen!Camelot Agent Malware Package Like what you read in this blog? Cyren gathers actionable intelligence  like the IOCs above  by analyzing and processing billions of daily transactions in Cyren GlobalView Threat Intelligence cloud. By correlating insights gathered across email content, web traffic, and suspicious files Cyren provides security teams with a multi-dimensional presentation of critical threat characteristics. Powered by GlobalView, Cyren Threat InDepths contextualized threat intelligence allows enterprise security teams to gain unique visibility into evolving email-borne threats and make meaningful decisions to combat them. Learn more . Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Microsoft Finally Acknowledges COVID-19-Related Cybercrimes Anatomy of a Phishing Attack Stolen Microsoft 365 Credentials Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "comprehensive",
  "analysis": "**Analysis of Security-Related Content on Malware Using Fake PEM Certificates**\n\n**1. Key Security Features and Their Benefits:**\n   - **Threat Intelligence & Detection:** The content highlights the use of GlobalView Threat Intelligence to analyze billions of transactions, providing actionable insights. This feature allows for early detection of malware, such as the fake PEM certificates, benefiting users by preventing potential data breaches and system compromises.\n   - **Sophisticated Mechanisms:** Tools like Cyren's detection systems are employed to identify obfuscated scripts and shellcode, offering users an advanced layer of protection against evolving threats.\n\n**2. Compliance Certifications and Regulatory Adherence:**\n   - While specific certifications like ISO 27001 or GDPR aren't mentioned, the detailed Indicators of Compromise (IOCs) provided suggest adherence to incident response standards. These IOCs aid organizations in meeting legal and regulatory requirements by providing crucial data for forensic analysis and compliance reporting.\n\n**3. User-Focused Security Recommendations:**\n   - **Vigilance and Awareness:** Users should be cautious with file downloads and emails, especially those from unknown sources, to avoid phishing attempts.\n   - **Antivirus and Updates:** Regularly updating software and using reputable antivirus solutions can mitigate the risk of infection.\n   - **User Training:** Educating users on recognizing phishing attempts and handling suspicious files effectively enhances organizational security.\n\n**4. Technical Security Implementation Details:**\n   - **Malware Techniques:** Attackers use fake PEM certificates containing obfuscated AutoIt scripts and shellcode for injection. These scripts check system architecture to deploy appropriate payloads, highlighting the need for advanced detection tools.\n   - **Detection Tools:** Utilizing tools like AutoIt Script Debugger and Win32dbg can help in analyzing and mitigating such threats.\n\n**5. Data Protection Measures:**\n   - **Encryption:** Protecting data both at rest and in transit with encryption can prevent unauthorized access.\n   - **Backups:** Regular backups are essential to mitigate potential data loss from ransomware attacks.\n\n**6. Best Practices for End Users:**\n   - **Software Updates:** Keeping all software updated to patch vulnerabilities.\n   - **Antivirus Solutions:** Employing strong antivirus programs to detect and block malicious activities.\n   - **Security Audits and Monitoring:** Regular audits and continuous monitoring can lead to early detection of threats and improve incident response.\n\n**Conclusion:**\nThe blog underscores the sophisticated methods employed by attackers, emphasizing the importance of advanced detection mechanisms and user education. While specific compliance certifications are not noted, the focus on IOCs and detailed analysis suggests a commitment to regulatory standards. Users are encouraged to adopt best practices such as vigilance, software updates, and utilizing security tools to protect against evolving threats."
}