Pierluigi Paganini June 09, 2015

Security experts at Fortinet uncovered a new strain of the Vawtrak banking Trojan is implementing an obscuring mechanism based on the Tor2Web service.

The authors of the banking Trojan Vawtrak are adopting a new tactic to hide the traffic to its servers,  they are exploiting  the Tor2Web service to masquerade malicious connections. In the past, criminal crews behind the Vawtrak malware exploited steganography to avoid detection and some strain of malware were served using Microsoft macros.

In February 2015, security experts discovered variants of the banking trojan VAWTRAK that were coupling the use of Macros and the abuse Windows PowerShell to improve the malicious agent.

Now researchers at Fortinet uncovered a new strain of Vawtrak that was hiding its servers in Tor2Web to evade detection. The Tor2Web service allows users to access Tor resources without using a classic Tor client, but simply using a common browser. Of course, by accessing the Tor network from the Tor2Web service users are traceable.

The researchers explained that Vawtrak implements a smart Domain Name Generator that allows the malware to refer the C&C servers.

The experts discovered a collection of DWORD value hard coded in the Vawtrak source code that used them as a seed to generate the domain name.

To generate the corresponding domain name, Vawtrak uses the seed to generate the pseudo-randomized characters of the domain name.

“The malware, which also goes by the name Neverquest, has a handful of DWORD values which correspond to domain names. The malware uses the values to generate randomized domain names, which ultimately wind up linking back to tor2web.org strings. The technique bucks the malware’s usual trend of using fixed command and control servers in its variants.” wrote Raul Alvarez, a researcher with Fortinet. “If you know where to look, though, tracking and hunting these servers is hard, but possible,”

Vawtrak is rapidly evolving, developers implemented advanced web-inject and data stealing capabilities, criminal crews are using it to siphon several kind of information, including social security numbers and PINs, later its creators customized it to hit banks and retailers.

Pierluigi Paganini

(Security Affairs – Vawtrak, banking trojan)