Researchers from LevelBlue Labs have identified a new strategy used by cybercriminals to exploit genuine anti-virus software for nefarious purposes.
The attack revolves around a tool called SbaProxy, which disguises itself as a legitimate anti-virus component to create proxy connections via a command and control (C&C) server. SbaProxy represents an advanced addition to the attackers’ toolkit, enabling them to generate revenue by establishing these connections.
This tool is distributed in various forms, including DLLs, EXEs, and PowerShell scripts. Its deceptive design and legitimate appearance make it difficult to detect.
Cybercriminals are embedding malicious code into real anti-virus software while preserving the software’s appearance as harmless. This trickery is compounded by the use of valid or seemingly valid certificates to sign the malicious binaries, allowing them to bypass security measures. Anti-virus products targeted include Malwarebytes, BitDefender, and APEX, among others.
The malicious binaries utilize certificates such as the one with thumbprint “DCB42EF087633803CD17C0CD6C491D522B8A2A” issued to “STERLING LIMITED.” The threat actors likely acquired this certificate to align with their attack timeline.
Technical Insights
LevelBlue Labs detected suspicious activities originating from anti-virus binaries in early June. This activity was linked to a newly identified tool from a campaign previously reported by Sophos in late April. This represents an evolution in the attackers’ toolkit.
One analyzed sample disguised itself as a BitDefender logging DLL. The malicious DLL’s exported functions mirrored those of the original DLL, except for one altered function, ‘LogSetMode’. This function was replaced with a jump instruction leading to a different address, which decrypts and executes embedded XOR-encrypted shellcode.
The decryption routine includes a pointless loop, setting local variables to a hardcoded value, repeated 448,840 times—a primitive attempt to thwart detection methods based on emulation. After the loop completes, the code checks the value of one variable and crashes if it’s not as expected. It then allocates memory, decrypts the payload with a multi-byte XOR key, and executes it.
Initial communication with the C&C server involves a sequence of ‘send’ function calls with zero content and specific byte lengths (16, 4, and 0 bytes). This sequence likely serves as a handshake to ensure the C&C server only responds to the malicious client. Following this, the server sends 16 bytes, which are then transmitted back over a new socket. This process supports multiple parallel connections.
The misuse of legitimate anti-virus software and valid certificates by these attackers complicates threat detection. To counteract these innovations, organizations must remain vigilant and enhance their defenses.
LevelBlue Labs has devised detection strategies for this threat, including SURICATA IDS signatures that flag specific communication patterns with the C&C server. Relevant indicators of compromise (IOCs) are available through the OTX Pulse.
