BianLian

MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1078 Persistence: Valid Accounts

MITRE ATT&CK® Techniques ... Lateral Movement T1091 Replication Through Removable Media

MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1047 Execution: Windows Management Instrumentation

ussd : Module used to run USSD codes and make calls

Execution: Unknown binary launching PowerShell If leveraging an EDR that classifies binaries as known and unknown, searching for unknown binaries launching PowerShell will frequently detect use of the BianLian backdoor

The malware uses the multidex scheme to load the payload as secondary DEX... The technique consists in re-writing the way applications load multiple DEX.

The most common packing mechanism consists in loading a hidden DEX with DexClassLoader. The sample does not use DexClassLoader... Some newer samples... use the common DexClassLoader method... The payload DEX (maXclr.json) is a Bian Lian sample.

MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1078 Persistence: Valid Accounts

Credential Access: Account manipulation via net.exe “Net user” is too loud to alert on in most environments, but we recommend alerting on a threshold of “net user” executions.

Defense Evasion: Reg.exe modifying safeboot keys BianLian added a remote access tool to safeboot keys in order to enable network access for their remote access tool in safeboot.

the first thing the application does is hide its icon and constantly requests permission to abuse Accessibility services functionalities until granted. Once these are obtained, it initiates all of its modules.

XiaomiAutostartHandler. Sets auto start for the malware in MiUI’s security center.

MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1078 Persistence: Valid Accounts

Credential Access: Account manipulation via net.exe “Net user” is too loud to alert on in most environments, but we recommend alerting on a threshold of “net user” executions.

the first thing the application does is hide its icon and constantly requests permission to abuse Accessibility services functionalities until granted. Once these are obtained, it initiates all of its modules.

XiaomiAutostartHandler. Sets auto start for the malware in MiUI’s security center.

All those banking trojans also abuse Android Accessibility Services . Accessibility Services are meant to help people with disabilities. Do not grant such rights to any other application!

At a first look, it seemed clear that the APK was heavily obfuscated... It seems to mostly rely on generating a variety of random functions to hide the real functionalities of the sample... Most of the strings in the code are generated by using functions implementing a XOR decryption of byte arrays.

The malware does not use DexClassLoader to unpack the payload DEX. Instead it loads the payload as a secondary DEX through multidex support. The packer re-implements multidex support and mainly changes names & adds asset decryption.

be on the lookout for... a botnet with tags such as “grim” that poses as a “Security” application ... Android banking trojans typically pose as famous applications: Video Player, Play Store, Flash Player, etc.

The same component also deals with removal of applications... If the package name is “bot”, then the bot removes itself. A self “cleaning” command!

MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1078 Persistence: Valid Accounts

From attachBaseContext, the malware calls a cascade of functions which (1) locate an asset named G9ugwFtlG1.jwi, (2) deflates it and (3) finally decrypts it using a home-made algorithm with hard coded key...

The installation is performed by abusing the Accessibility API... automatically click to install. If the system is requesting permission to install from an external source, authorize it etc.

Upon execution of the ransomware, it attempts to identify if the file is running in a WINE environment by checking the wine_get_version() function via the GetProcAddress() API.

the first thing the application does is hide its icon

The most common packing mechanism consists in loading a hidden DEX with DexClassLoader. The sample does not use DexClassLoader... Some newer samples... use the common DexClassLoader method... The payload DEX (maXclr.json) is a Bian Lian sample.

This code is loaded and used by the main application through Java reflection.

Defense Evasion: Reg.exe modifying safeboot keys BianLian added a remote access tool to safeboot keys in order to enable network access for their remote access tool in safeboot.

injects : Module used to run overlay attacks, mostly on banking applications

When an app among this list is launched, the bot requests the C&C an HTML page to overlay... The card number, expiration date & CVV are sent back to the C&C.

Reconnaissance: Ping -4 -n 1 BianLian used single pings to perform network reconnaissance.

MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1069 Discovery: Permission Groups Discovery

MITRE ATT&CK® Techniques ... Discovery T1082 T1083 T1518 T1120 System Information Discovery File and Directory Discovery Security Software Discovery Peripheral Device Discovery

After dropping the ransom note, the malware searches files and directories for encryption by enumerating them using the FindFirstFileW() and FindNextFileW() API functions.

Upon execution of the ransomware, it attempts to identify if the file is running in a WINE environment by checking the wine_get_version() function via the GetProcAddress() API.

MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1021.005 Lateral Movement: Remote Services: VNC

Lateral Movement: Winrm dropping a file via PowerShell The binary wsmprovhost.exe is used to mediate the relationship between WinRM and PowerShell. Alerting on file modification by wsmprovhost.exe proved a reliable method to detect BianLian dropping malicious files.

MITRE ATT&CK® Techniques ... Lateral Movement T1091 Replication Through Removable Media

injects : Module used to run overlay attacks, mostly on banking applications

When an app among this list is launched, the bot requests the C&C an HTML page to overlay... The card number, expiration date & CVV are sent back to the C&C.

The Screencast Module allows the malware to record the screen of the device... to create a virtual display to screencast.

we can see an interesting TLS certificate on port 443. | In this post we will investigate a Bianlian C2 address and use TLS certificates to obtain another ~50 servers.

MITRE TTPs Redacted researchers provided the following MITRE ATT&CK tactics, techniques, and procedures: ID Technique T1071.001 Command and Control: Application Layer Protocol: Web Protocol

This module is used to create a functioning SSH server on the device using JSCH... BianLian can setup a proxy that can run SSH sessions using remote port forwarding on port 34500, with an implementation similar to 2017’s malware MilkyDoor, making communication with the CC harder to detect.

there are two entries... a second refers to a file conveniently called “payload.apk” – which means that the sample will likely install an additional application during execution... in this case it is downloaded from the CC.

This sample connects to a Tor onion website to retrieve the URL of the C2.

most of the interesting calls, like information exfiltration and connection initiations, are executed from the code in the first application.

Locker. This disables the ringer, and displays a text taken randomly from a pool of possible messages.

DeviceSecurityHandler. Turns off Huawei and Samsung security centers.

Defense Evasion: Svchost not a child of services.exe ... Defense Evasion: Svchost executing from an unusual path ...