Worm.Win32.BLASQUI.A

This malware is part of the newly discovered BLACKSQUID malware family that targets web servers, network drives, and removable drives using multiple web server exploits and dictionary attacks.

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It takes advantage of certain vulnerabilities.

Arrival Details

This Worm arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Worm drops the following files:

• %ProgramData%\qkooy.exe - detected as Coinminer.Win64.TOOLXMR.AS
• {Malware Path}\WebServer\Blacksquid.txt - copy of itself
• {Malware Path}\WebServer\hta.hta - contains html and powershell code to download a copy of itself
• %ProgramData%\S.exe - encrypted file that was renamed to %ProgramData%\445.exe after decryption
• %ProgramData%\445.exe - detected as TROJ_EQUATED.J. This is used for EternalBlue and DoublePulsar exploit
• C:\important\important.exe - copy of itself

It adds the following processes:

• %ProgramData%\qkooy.exe -o stratum+tcp://{BLOCKED}e.{BLOCKED}l.com:80 -u 44f3Gk4zcTvR4e8PTaYEEpJfhj8FpvnxbHADmAiiQFLeMTAzvN1Xavn3VHHNP8n4ob3WJ77KbzcQaCgGYSofCwpSQQkCW9G -p x --max-cpu-usage=25 -K
• C:\147159.exe

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• wfcwfwwxwcvrbedbew

Autostart Technique

This Worm adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
NVIDIA GeForce Experience = {malware path}\{malware name}.exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
NVIDIA GeForce Experience = {malware path}\{malware name}.exe

Other System Modifications

This Worm adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\BlacksquidXmr
CPUming = {data from VersionUpdate}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\BlacksquidXmr
Update = Updated

Other Details

This Worm does the following:

• Deletes Logs
  • C:\Windows\SysWOW64\rserver30\Radm_log.htm
  • Event log - Application
  • Event log - Security
  • Event log - System
• Deletes registry keys
  • HKEY_CURRENT_USER\Software\RealVNC\vncviewer\KnownHosts
  • HKEY_CURRENT_USER\Software\RealVNC\vncviewer\MRU
• Adds a process - C:\Windows\System32\taskkill.exe /f /im %ProgramData%\qkooy.exe
• Tries to download and execute a file from {BLOCKED}.{BLOCKED}.0.1:8080\VersionUpdate
• Checks if current process is current in a 64bit architecture
  • if not, terminate
  • if yes, check the Videocard if NVIDIA or AMD
  • If NVIDIA
  • checks for a process named ickmk.exe and terminate it if found
  • Download from http://m9f.oss-cn-beijing.{BLOCKED}cs.com/A.exe and save it as %ProgramData%\ickmk.exe
  • Create a process: %ProgramData%\ickmk.exe ostratum+tcp://{BLOCKED}e.{BLOCKED}l.com:80 -u 44f3Gk4zcTvR4e8PTaYEEpJfhj8FpvnxbHADmAiiQFLeMTAzvN1Xavn3VHHNP8n4ob3WJ77KbzcQaCgGYSofCwpSQQkCW9G -p x --donate-level=0 --cuda-max-threads=2 --donate-level=0 --cuda-max-threads=2
  • If AMD
  • the same behavior as when the videocard is NVIDIA
• Checks for the presence of removable and network drives
  • drops a copy of itself named 12345689.exe to the drive found
  • if found, drop and execute %System Root%\147159.exe - detected as Trojan.Win32.CVE20178464.A
  • then move all files dropped by %System Root%\147159.exe from %System Root%\cve to the drive found
  • deletes %System Root%\147159.exe afterwards
• Checks for the following folders
  • C:\inetpub\
  • C:\xampp\
  • C:\wamp\
  • C:\phpStudy\PHPTutorial\WWW\
  • then infect all html files from these folders with a malicious iframe that executes C:\important\important.exe
• Uses the following to try to bruteforce login SQLservers:
  • sa
  • users
  • wwo
  • kisadmin
  • hbv7
  • www
  • vice
  • su
  • sa123
  • v39 = 0;
  • sa
  • 1
  • 123
  • 321
  • 123456
  • 12345678
  • 112233
  • 147258
  • vice
  • password
  • 1qaz@WSX3edc
  • 123456789
  • 666666
  • 888888
  • 66666666
  • 88888888
  • 1111111
  • 11111111111
  • saadmin
  • P@ssword
  • pa$$w0rd
  • sysadm
  • 119119
  • admin123!@#
  • Admin@123
  • !@#$%^
  • Admin123
  • vice_1433 vice
  • Password123
  • bw99588399
  • !QAZ2wsx
  • Sa123456
  • sa@123
  • ifuckyounow
  • password01!
  • yto_admin
  • star
  • pass@word1
  • 8ik,9ol.
  • zXJl@mwZ
  • 1qaz2wsx
  • qazwsx
  • qwertyuiop
  • \"vice_1433 vice\"
  • sql
  • sql&2008
  • sql&2012
  • 123qwe!@#QWE
  • !@#qwe123
  • abc123
  • a1b2c3
  • 123123
  • 123321
  • 789789
  • admin123
  • admin999
  • zh@123456
• Uses different exploits for propagation

It takes advantage of the following vulnerabilities:

• EternalBlue CVE-MS17-010
• DoublePulsar
• ThinkPHP Exploit
• ApacheTomcat CVE-2017-12615
• CVE-2017-8464
• CVE-2014-6287

It adds the following scheduled tasks:

• Task Name: NVIDIA GeForce Experience
  Action: Start a program - {malware path}\{malware name}.exe