New Zloader Banking Malware Campaign Exploiting Microsoft Signature Verification

An ongoing ZLoader^[1]
malware campaign has been uncovered exploiting remote monitoring
tools and Microsoft’s digital signature verification to siphon user
credentials and sensitive information.

Israeli cybersecurity company Check Point Research, which has
been tracking the sophisticated infection chain since November
2021, attributed it to a cybercriminal group dubbed
Malsmoke, citing similarities with previous
attacks.

“The techniques incorporated in the infection chain include the
use of legitimate remote management software (RMM) to gain initial
access to the target machine,” Check Point’s Golan Cohen said in a
report^[2]
shared with The Hacker News. “The malware then exploits Microsoft’s
digital signature verification method to inject its payload into a
signed system DLL to further evade the system’s defenses.”

The campaign is said to have claimed 2,170 victims across 111
countries as of January 2, 2022, with most of the affected parties
located in the U.S., Canada, India, Indonesia, and Australia. It’s
also notable for the fact that it wraps itself in layers of
obfuscation and other detection-evasion methods to elude discovery
and analysis.

The attack flow commences with the installation of a legitimate
enterprise remote monitoring software called Atera, using it to
upload and download arbitrary files as well as execute malicious
scripts. However, the exact mode of distributing the installer file
remains unknown as yet.

One of the files is used to add exclusions to Windows Defender,
while a second file proceeds to retrieve and execute next-stage
payloads, including a DLL file called “appContast.dll” that, in
turn, is used to run the ZLoader binary (“9092.dll”).

What stands out here is that appContast.dll is not only signed
by Microsoft with a valid signature, but also that the file,
originally an app resolver module (“AppResolver.dll”), has been
tweaked and injected with a malicious script to load the
final-stage malware.

This is made possible by exploiting a known issue tracked as
CVE-2013-3900^[3]
— a WinVerifyTrust signature validation vulnerability — that allows
remote attackers to execute arbitrary code via specially crafted
portable executables by appending the malicious code snippet while
still maintaining the validity of the file signature.

Although Microsoft addressed the bug in 2013, the company
revised^[4]
its plans in July 2014 to no longer “enforce the stricter
verification behavior as a default functionality on supported
releases of Microsoft Windows” and made it available as an opt-in
feature. “In other words, this fix is disabled by default, which is
what enables the malware author to modify the signed file,” Cohen
said.

“It seems like the ZLoader campaign authors put great effort
into defense evasion and are still updating their methods on a
weekly basis,” Check Point malware researcher, Kobi Eisenkraft,
said, urging users to refrain from installing software from unknown
sources and apply Microsoft’s strict Windows Authenticode signature
verification^[5] for executable
files.