How Do You Say βHelpβ in Chinese?
Defending Against Fake Support Tickets
About us
Mauro CΓ‘seres
Threat Management Specialist @ Bitso
Quetzal Team Leader
2
www.hackerhalted.com
Emilio Revelo
Security Engineering Manager @ Bitso
Quetzal Team Member
About this talk
This talk is about Zhong Stealer, a malware from China π¨π³.
It's distributed using a particular method: fake support tickets ποΈ.
3
www.hackerhalted.com
Why target Help Desk?
Privileged access to workstations, internal systems and users info π©π»βπ».
Anyone can reach Help Desk π₯Έ.
Many support agents π.
4
www.hackerhalted.com
Who targets Help Desk?
Initial Access Brokers: buy and sell credentials, VPNs and any access πͺͺ.
Malware Devs/Ops: gather credentials, data and financial gain π°.
5
www.hackerhalted.com
Zhong Stealer
First spotted by us on December, 22th, like a Christmas gift π.
Targets companies in the Fintech and Crypto sectors π§³.
6
www.hackerhalted.com
Zhong Stealer
Chinese-speaking actors opened tickets sharing false problems π.
They attached the malware sample disguised as "a screenshot" πΌοΈ.
7
www.hackerhalted.com
Zhong Stealer
8
www.hackerhalted.com
Zhong Stealer
9
www.hackerhalted.com
Zhong Stealer
10
www.hackerhalted.com
Zhong Stealer
11
www.hackerhalted.com
Zhong Stealer
We started collecting samples from every interaction π¬!
π¦ Android θͺη±ζͺεΎ_20241220.zip
π¦ εΎη_20241224 (2).zip
π¦ εΎη_20241224.exe
π¦ εη2024122288jpg.exe
π¦ εΎη_20241220.exe
12
www.hackerhalted.com
Zhong Stealer
13
www.hackerhalted.com
Zhong Stealer
This makes it impossible to track malware families and campaigns π.
So we analyzed it and named it "Zhong Stealer" π·οΈ.
14
www.hackerhalted.com
Reversing Zhong Stealer
Initial reversing revealed samples to be a first stage: a Loader πͺ€.
Loaders prepare the system to run the full malware and download more components π§.
15
www.hackerhalted.com
Reversing Zhong Stealer
16
www.hackerhalted.com
Reversing Zhong Stealer
Other components were downloaded from Alibaba Cloud next π¦.
A .DLL library, a .Log file and the next stage .Exe file π.
17
www.hackerhalted.com
Reversing Zhong Stealer
18
www.hackerhalted.com
Reversing Zhong Stealer
Connects to exfiltration servers in China and Hong Kong π.
19
www.hackerhalted.com
Reversing Zhong Stealer
20
www.hackerhalted.com
Reversing Zhong Stealer
Creates persistence through Windows Registry and Scheduled Tasks ποΈ.
21
www.hackerhalted.com
Reversing Zhong Stealer
22
www.hackerhalted.com
Reversing Zhong Stealer
23
www.hackerhalted.com
Reversing Zhong Stealer
Samples are signed with stolen certificates belonging to chinese companies βπ».
Some samples even pose as antimalware solutions π¨π»ββοΈ.
24
www.hackerhalted.com
Reversing Zhong Stealer
25
www.hackerhalted.com
Reversing Zhong Stealer
Eventual victims will find their digital accounts for sale on underground markets π΄ββ οΈ.
Corporate access faces worse fates, being sold to ransomware gangs for later extortion π.
26
www.hackerhalted.com
Reversing Zhong Stealer
27
www.hackerhalted.com
Reversing Zhong Stealer
28
www.hackerhalted.com
Reversing Zhong Stealer
29
www.hackerhalted.com
Reversing Zhong Stealer
As most malwares do, it covers its track by disabling Windows Event Logging π¨.
This complicates Systems and Security Engineers work π·π»ββοΈ.
30
www.hackerhalted.com
Reversing Zhong Stealer
31
www.hackerhalted.com
Reversing Zhong Stealer
But we were able to stop it on its tracks and map its infrastructure and TTPs π§ .
Here's the MITRE ATT&CK Matrix π€.
32
www.hackerhalted.com
Reversing Zhong Stealer
33
www.hackerhalted.com
More about Zhong Stealer
34
www.hackerhalted.com
Conclusions
Security is a team journey π«.
Cybercriminals believe Help Desk to be weakest link. Let's prove them wrong by training our teams and working closely together π«±π½βπ«²πΎ.
35
www.hackerhalted.com
Conclusions
Start reversing today.
There's a lot to discover and learn π¬.
Remember that malware is not a toy.
Beware when trying to reverse strains at home... π₯½
36
www.hackerhalted.com
Conclusions
Having said that:
Everyone deserves a name.
Adopt an unnamed malware strain today and write about it βπ».
37
www.hackerhalted.com
Contact
Mauro CΓ‘seres
@MauroEldritch
Linkedin: Mauro Eldritch
38
www.hackerhalted.com
Emilio Revelo
Linkedin: Emilio Revelo