Hesperbot

It uses very credible-looking phishing-like campaigns, related to trustworthy organizations, to lure victims into running the malware.

The filename used was zasilka.pdf.exe... A double extension – .PDF.EXE – was used here too.

The link in the email showed the legitimate www.ceskaposta.cz domain while pointing to www.ceskaposta.net, which many victims hadn’t noticed.

Furthermore, an undocumented trick of hooking UserNotifyProcessCreate is used when running inside csrss.exe, to ensure that the trojan’s code will be injected into every new process.

Typical malware functionality, such as writing to the Run Windows Registry key, is also handled by core.

the malicious module also hooks functions responsible for certificate verification.

The dropper’s role is to inject the main component – ‘core’ – into explorer.exe.

Furthermore, an undocumented trick of hooking UserNotifyProcessCreate is used when running inside csrss.exe, to ensure that the trojan’s code will be injected into every new process.

Typical malware functionality, such as writing to the Run Windows Registry key, is also handled by core.

the downloaded data (namely the configuration file and plugin modules) is encrypted using the Twofish cipher.

The perpetrators have registered the domain www.ceskaposta.net, which is very close to the real website of the Czech Postal Service, www.ceskaposta.cz.

The dropper’s role is to inject the main component – ‘core’ – into explorer.exe.

the malicious module also hooks functions responsible for certificate verification.

The keylogger module intercepts key strokes by hooking the functions GetMessage and TranslateMessage in user32.dll.

If the configuration file specifies that the current URL should be monitored, the data is written to a log.

the malicious module also hooks functions responsible for certificate verification.

Win32/Spy.Hesperbot performs a man-in-the-middle attack by creating a local proxy through which it directs all connections from the browser.

The nethk module carries its own crafted, self-signed SSL certificates and these are substituted for legitimate certificates.

The following information is sent to the command-and-control server: Bot name based on the Computer Name ... IP addresses of present network adapters ... Names of active smart-cards

It enables the trojan to create a hidden VNC server, to which the attacker can remotely connect.

For storing the downloaded data as well as other auxiliary binaries (e.g. the log created by the keylogger module), Hesperbot uses a randomly named subdirectory under %APPDATA%.

The keylogger module intercepts key strokes by hooking the functions GetMessage and TranslateMessage in user32.dll.

If the configuration file specifies that the current URL should be monitored, the data is written to a log.

screenshots and video capture is done by the httpi module, if specified in the configuration file.

The video capture functionality has been used by the Zeus banking trojan spin-off Citadel and provides the attackers with an even better overview of what’s happening on the victim’s screen.

As the web-injects, form-grabbing and other shenanigans performed by these banking trojans take place inside the affected browser, the method has collectively been labeled as the ‘Man-in-the-Browser’ attack.

Win32/Spy.Hesperbot performs a man-in-the-middle attack by creating a local proxy through which it directs all connections from the browser.

The core module, now running in the context of explorer.exe, handles communication with the C&C server and launching other plug-in modules.

The httphk module is merely responsible for parsing the HTTP protocol data.

socks – Used to set up a SOCKS5 proxy server

Win32/Spy.Hesperbot.A uses either a hard-coded URL ... or generates new C&C URLs using a domain generation algorithm in case the first server is inaccessible.