January 11, 2015

North Korea's State News Agency Website Serving Up Malware

It's a quiet night and you're settled in for the evening, so of course you fall down the Wikipedia rabbit hole and somehow end up at the Website of the Korean Central News Agency (KCNA), North Korea's official state news portal for the outside world's consumption. (Safer when done from the proper environment of course.) What's in KCNA's headlines tonight? Apparently at least one Zip file containing a pair of malware droppers, disguised as Flash Player updates targeting Windows users on Internet Explorer, along with some other unusual items. Now for all I know "exploit" might be North Korean for "executable", which would make sense given how often it shows in the Website's code and structure. Besides, "executable" is probably a word that DPRK Web devs prefer not to think about and probably wish to avoid. So Let's assume that "exploit" is in fact a translation issue and take it from there.

Digging In The Forest

Let's start with the Website's structure. Underneath all those great stories of record-breaking crop yields and efficient traffic control officers, a few things leap out like Chollima at a long jump competition. Sitting at the Web root is the file "kcna.user.exploit.exploit.kcmsf". Further down in the "siteFiles" folder, we find an "exploit" folder with some content underneath. Seriously? Is this some weird angle on honeypots? Right, I'm assuming a translation issue. Red herring or otherwise, at least the night won't be dull.

So what's going on in "exploit.kcmsf"? All good things, all good things. Normally I'd obscure the paths, however this is not exactly an underground site so perhaps it's best that people know since they're visiting it regardless.

FlashPlayer10.zip - Malware Droppers To Go

A Javascript var is getting set to "/download/FlashPlayer10.zip", anyone else curious? I suppose KCNA could be helping Adobe save bandwidth by acting as a mirror site. Sure. A quick download of the hosted file reveals a Zip file containing two Windows .exe files. VirusTotal rates both of these faux-Flash Updaters as NOPE NOPE NOPE, with 42 sites flagging the files as variants of malware droppers. Not that you needed VirusTotal to tell you that.

Dynamically Hosted Gifts In siteFiles/exploit/memorybook?

Onward to the next bit of code in "exploit.kcmsf" - seriously, these KCNA devs use "exploit" like Apple's sslKeyExchange.c dev used "goto". Yeah I said it.

It's of course a common Webapp use case to serve up different content based on various parameters. In this particular piece of code a little interactive AJAX is created, leveraging "kcna.user.exploit.exploitMemory.kcmsf". Go ahead and assume it's a language barrier issue. But how comfortable are you now with being served up PDF files (for English, Chinese, Japanese, and Spanish users), or custom HTML if you're Korean? Maybe keep a closer eye on those? In the n==111 case below, "h00.html" had a clean bill of health. Iterating through the possibilities would definitely be interesting however.

Strings analysis of the faux-Flash Updaters reveals that they both contain the exact same string set, complete with matching SHA-256 hashes of the extracted results. Compared to the actual installer from Adobe, the differences are immediately apparent. Below to the left I've listed a sample of the processes and DLLs referenced in the malware droppers, which taken as a whole tell quite a story. Also the malware's embedded security settings require Administrator, whereas Adobe's installer requests a run level of 'asInvoker'.

At this point it's safe to say that, translation issues aside, someone's trying to feed certain visitors a special gift. All we know for certain is that the KCNA Website is serving it up, not its origins. But if that's the only viable externally facing Website a country has, you'd think it would be noticed (sitting in the Website's root). Draw your own conclusions. 

Security XML settings for actual Adobe Flash Installer.

Security XML settings for Faux Adobe Installers.

Malware dropper - Sample of referenced processess.

kcna.user.exploit.exploit.kcsmf - Top of File

Of course some people would argue that Flash Player itself is malware, so by way of comparison let's take a look at what VirusTotal has to say about an equivalent installer straight from Adobe's Website.

Next Up - Malware Execution and Phoning Home

So who does the dropped malware want to talk to? Most malware gets lonely and wants to call home. None of this guarantees attribution but at least you can get some ideas. In the next installment we'll walk through the runtime code in the debugger, capture file system changes and packet traffic, and see what these little beasts are up to.

kcna.user.exploit.exploit.kcsmf - Top of File

kcna.user.exploit.exploit.kcsmf - AJAX and Content from /siteFiles/exploit/memorybook/