Recently, the Zscaler ThreatLabZ team came across a new type of malware called Qealler, which is written in Java and designed to silently steal sensitive information from an infected machine.
Qealler is a highly obfuscated Java loader that deploys a Python credential harvester.
We first saw this payload hit Zscaler Cloud Sandbox on Jan 21, 2019, and below is a screenshot of the detonation report.
Fig. 1: Zscaler Cloud Sandbox report
This threat makes use of social engineering techniques to initiate the infection, as the malicious JAR file has to be executed by the user. These malicious JAR files are portrayed as invoice-related files, requiring the user to double-click on the file to open it.
We have been monitoring this campaign for the past two weeks, and the malware has been quite active, spiking this week.
Fig. 2: Hits of Qealler in a week
The malicious JAR file (named Remittance.jar), which we analyzed, was getting downloaded from a compromised site (hiexsgroup.co[.]uk). It is heavily obfuscated with Proguard Java obfuscator. After deobfuscation and decompilation, we saw encrypted URLs that are accessible by a key, as shown in the figure below.
Fig. 3: Accessing encrypted URLs
The sample has a “synchronized” file that contains key-value pairs.
Fig. 4: Key-Value pair of encrypted URLs
On execution, this sample first creates two file paths in %USERPROFILE% by checksum of hardcoded strings.
Fig. 5: File Path creation
File path 1:
%USERPROFILE%\\CRC32(“2a890bc98aaf6c96f2054bb1eadc9848eb17633039e9e9ffd833104ce553fe9b”)\\CRC32(“qealler”)\\CRC32(“lib”)\\CRC32(“8e65457409fea4b2a183125f1c0f552080edb4cefa516b14698cb8d0abf5bb6dFILE”)
Equivalent to:
%USERPROFILE%\\a60fcc00\\bda431f8\\a90f3bcc\\83e7cdf9
File Path 2:
%USERPROFILE%\\CRC32(“2a890bc98aaf6c96f2054bb1eadc9848eb17633039e9e9ffd833104ce553fe9b”)\\CRC32(“qealler”)\\CRC32(“lib”)\\CRC32(“0e10ad6938994f2466b192d8f29217ad39155b8a3a082b6412048f4a12126b3bFILE”)
Equivalent to:
%USERPROFILE%\\a60fcc00\\bda431f8\\a90f3bcc\\db2bf213
If the above two files don’t exist, the malicious file decrypts the URL, downloads these two files, and stores them in the same place.
Fig. 6: Encrypts and drops downloaded module
The value of LIB_7Z_URL in the synchronized file is “xVQR4PWAw91AhkgaMsQVAVV1igV7HSOV1dqWgFN23eQtkNRd23RzTnPVGB9/iVYA” which is decoded by BASE64 and decrypted by AES-EBC with the hardcoded key “bbb6fec5ebef0d93”.
The final URL after decryption is hxxp://82.196.11[.]96:55326/lib/7z
The value of LIB_QEALLER_URL in the synchronized file is “xVQR4PWAw91AhkgaMsQVAaWhGxVQIpMxX60ZE+OpV3KjNnWvOARi0rccZaVSvle8”, it is also decrypted by the same algorithm with the same key.
The final URL is hxxp://82.196.11[.]96:54869/lib/qealler
The sample downloads the data from these URLs and encrypts it using the AES algorithm with the key generated by SecureRandom() having hardcoded seed value “2a890bc98aaf6c96f2054bb1eadc9848eb17633039e9e9ffd833104ce553fe9b”.
AES key: 39 3e df 7e fc 58 be 20 60 e4 78 bb 4a 91 38 72
After encryption, it stores both files at the below locations to avoid further downloading in the next run:
%USERPROFILE%\\a60fcc00\\bda431f8\\a90f3bcc\\83e7cdf9 (/lib/7z)
%USERPROFILE%\\a60fcc00\\bda431f8\\a90f3bcc\\db2bf213 (/lib/qealler)
Fig. 7: Created path and dropped files
Along with these two files, the virus creates another file path with the following algorithm and stores an encrypted unique machine ID in it. The ID is generated by a random number of system nanoTime.
Machine ID path:
%USERPROFILE%\\CRC32(“2a890bc98aaf6c96f2054bb1eadc9848eb17633039e9e9ffd833104ce553fe9b”)\\CRC32(“qealler”)\\CRC32(“machine”)\\CRC32(“id”)\\CRC32(“d”)\\CRC32(“q”)
Equivalent to:
%USERPROFILE%\\a60fcc00\\bda431f8\\1505df84\\bf396750\\98dd4acc\\99de3ada
After the downloading and decryption steps are completed, the sample stores a decrypted copy of 83e7cdf9 and db2bf213 in the %TEMP% directory with the name “_<SystemNanoTime>.tmp”.
_502560701855008616300501457487639.tmp
_502562165489004300569223733573535.tmp
_502560701855008616300501457487639.tmp (/lib/7z) is again a JAR file that doesn’t have any Java code inside, but contains three PE files inside the libraries as shown in Fig 8.
Fig. 8: Content of _502560701855008616300501457487639.tmp (/lib/7z)
7za.exe is a repackaged version of 7-zip to ensure the malware executes successfully even if the user does not have it installed by default.
The 7-zip (7za.exe) and its modules (7za.dll, 7zxa.dll) will be extracted from 7z.jar by the main sample and saved in the %TEMP% directory with the name “7z_<SystemNanoTime>.exe” and “7z_<SystemNanoTime>.dll”.
7z_502574395484008643130462441900754.exe
7z_502567545558005642490654395727502.dll
7z_502579570140002751296504101539829.dll
After extraction, the 7-zip executable is called by the main sample with the following command-line options:
%TEMP%\\7z_502574395484008643130462441900754.exe x %TEMP%\\_502562165489004300569223733573535.tmp -o%TEMP% -p”bbb6fec5ebef0d936db0b031b7ab19b6” -mmt -aoa -y
The downloaded Qealler module _502562165489004300569223733573535.tmp (/lib/qealler) is a password-protected file with 7-zip.
The above command will extract the Qealler module in the %TEMP% directory with the password: bbb6fec5ebef0d936db0b031b7ab19b6
-mmt: use multithreading mode
-aoa: set overwrite mode
-y: assume yes for all the prompts
The Qealler module is the key component of this malware.
The extracted Qealler module contains Python 2.7.12 with the installed packages to ensure the malware will execute even if the user does not have it installed by default.
The Qealler also has a directory named QaZaqne. It is a custom version of the open source project called LaZagne. LaZagne is used to retrieve lots of passwords stored on a local computer. This is the same functionality of QaZagne, which finds and steals credentials of the most commonly used software from local machines.
Fig. 9: Content of extracted _502562165489004300569223733573535.tmp (/lib/qealler)
After extraction, the main sample (Remittance.jar) executes a Python file of QaZagne (main.py) with the following option and takes the JSON output:
%TEMP%\\qealler\\python\\python.exe %TEMP%\qealler\qazaqne\main.py all
Fig. 10: Stealer functions in QaZaqne module
This will get the credentials of all the software shown in the figure below:
Fig. 11: Qealler steals credentials of the software in this table
The output of the QaZagne on an infected Windows machine is shown in Fig 12. It is in JSON format and contains the credentials of CoreFTP and a Windows credential manager. It always starts with #fs# and ends with #ff#.
Fig. 12: JSON output of QaZaqne module
The main sample parses this output, fetches below system information, and encrypts it using an AES-EBC algorithm with key “bbb6fec5ebef0d93”.
Fig. 13: Fetch and encrypt system info
The final information scraped from the infected machine before encryption is shown below.
Fig. 14: Scrapped data from an infected machine
Here, machine_id is a unique ID generated by system nanoTime and uuid is encrypted in a synchronized file.
This output is encrypted and encoded with BASE64 and sent to the command-and-control (C2) server, whose URL is an encrypted value of the key “d7c363a2019dac744cf076e11433547a47907e2c2f781e2d1c8f59a40c57dd03” in a synchronized file.
C2 URL: hxxp://82.196.11[.]96:56636/qealler-reloaded/ping
Fig. 15: Data sent to C2
In the post headers, q-qealler-id is the encrypted machine ID and q-qealler-stub-id is the encrypted hash of the machine ID and system time.
The request body contains encrypted and encoded system information and stolen credentials.
If the C2 server is active and data is successfully sent to the server, it will respond with the encrypted status, which looks like the following after decryption:
{"status":"2000","message":"success","extended":[],"time":1548096059}
IOCs:
hiexsgroup.co[.]uk/?_sm_nck=1
lcbodywowrksltd[.]online
willsonsolicitors[.]biz
willsonsolicitors[.]online
willsonsolicitors[.]store
mcneilspecs[.]com
mcneilspecs[.]org
mcneilspecs[.]net
prestigebuildersltd[.]com
prestigebuildersltd[.]net
larrgroup.co[.]uk/remittance%20advice.jar
prestonbuildersltd.co[.]uk/remittance%20advice.jar
otorgroup.co[.]uk/remittance%20advice.jar
ultrogroup.co[.]uk/remittance%20advice.jar
stgeorgebuildltd.co[.]uk/remittance%20advice.jar
gregoryteebuilders.co[.]uk/remittance%20advice.jar
txjxgroup.co[.]uk/remittance.jar
kingagroup.co[.]uk/remittance%20advice.jar
hiexgroup.co[.]uk/remittance%20advice.jar
salmogroup.co[.]uk/remittance%20advice.jar
4f77bf588e0b721e68971059b0cefe21 (Remittance Advice.jar)
b0ba5d6fdd26d81a6a2f050600ade3f0 (Remittance Advice.jar)
d742beba17f7893b2b4989661652a66f (Remittance Advice.jar)
61ecd8f17d405fa1c29dd78008011250 (Remittance Advice.jar)
ccac2b99cb4b72bc7728a8fc42ccc4ad (Remittance Advice.jar)
76e87575e76b2ea28e1bb49e4c280152 (Remittance Advice.jar)
7854ccf3208f805da7ec19a067ae3abe (Remittance Advice.jar)
ca741116466d5ddbcb76df00748bb885 (Remittance Advice.jar)
9b7ebeff190cef02a7c22072d3d26ab3 (Remittance Advice.jar)
639865eb7fac1b405b223cb4b7fe9ada ({E60A953D}-Remittance Advice.jar)
e6fdc2140f6047fad60720cdf2157f9c (Remittance.jar)
aae120bf74131d04e47d99b16af41120 (Remittance.jar)
3d43a83b1c8877e782ff69650ec00449 (Remittance.jar)
4d433929f175c6df366aed139bf34f85 (Remittance.jar)
2ed3b8cdc87a11437f5a15302ce047d6 (Remittance.jar)
8e0f4cb12c6f2fef3a8ff731c195843d (Remittance.jar)
fc20f0068b71cc74e9061a0ea2b5d45a (Cred_Adv043H3272.jar)
791217f372c347f53003ae8a26a2fe54 (Cred_Adv043H3272.jar)
a593cb286e0fca1ca62e690022c6d918 (7z.jar)
8d2c718599ed0aff7ab911e3f1966e8c (qealler.jar)
5a8915c3ee5307df770abdc109e35083 (main.py)
82.196.11[.]96:54869/lib/qealler
82.196.11[.]96:443/lib/qealler
128.199.60[.]13:443/lib/qealler
37.139.12.136:443/lib/qealler
192.81.222[.]28:41210/lib/qealler
37.139.12[.]169:23980/lib/qealler
37.139.12[.]169:16901/lib/qealler
176.58.117[.]125:8676/lib/qealler
176.58.117[.]125:8796/lib/qealler
146.185.139[.]123:6521/lib/qealler
159.65.84[.]42:10846/lib/qealler
159.65.84[.]42:12536/lib/qealler
139.59.76[.]44:4000/lib/qealler
128.199.60[.]13:47222/lib/7z
128.199.60[.]13:443/lib/7z
128.199.60[.]13:46061/lib/7z
82.196.11[.]96:54869/lib/7z
82.196.11[.]96:443/lib/7z
37.139.12[.]136:443/lib/7z
192.81.222[.]28:39871/lib/7z
176.58.117[.]125:8650/lib/7z
176.58.117[.]125:8796/lib/7z
159.65.84[.]42:11268/lib/7z
82.196.11[.]96:56636/qealler-reloaded/ping
37.139.12[.]136:36561/qealler-reloaded/ping
128.199.60[.]13:56636/qealler-reloaded/ping
192.81.222[.]28:46871/qealler-reloaded/ping
176.58.117[.]125:5797/qealler-reloaded/ping
