Who's bad? NgrBot or SkyBot?

The latest SkyBot only targets Skype, and spreads itself by sending a malicious link to all the contacts in the victim’s Skype contact list. In its first phase, it tries to send the malicious link to the active Skype chat window. In order to hijack the current active chat window, SkyBot goes through the following steps:

Figure 1. SendMessage sets the spam text and sends an ‘Enter’ key event (virtual-key code: 0Dh).

The second phase is to send the malicious link to the entire list of the user’s contacts, regardless of whether they are online or offline. After hijacking the current active chat window to send the malicious link, it sleeps for 0x4e20 seconds and then uses the Skype Desktop API (also called Skype public API) provided by Skype itself. To do that, it utilizes the Skype4COM.dll file, which comes with the installation of every Skype application. Skype4COM is a Windows-based COM object which simply bridges the text based Skype Desktop API to a third-party application. To import the Skype4COM.dll, it calls CoCreateInstance with the hard-coded rclsid.

Figure 2. clsid:830690FC-BF2F-47A6-AC2D-330BCB402664 hard-coded in the worm.

Then it creates the wrapper object and calls ISkype.Attach with Protocol Version = 8 and Wait = -1. Although the Wait parameter is set to -1 here, this Attach method will still trigger the Skype application to warn the user that an application is trying to use Skype, and will let the user decide whether to allow it. However, this worm uses a trick to bypass the warning (this technique still works on the latest version of Skype [6.3.0.105] at the time of writing this article):

Before calling the Attach, it creates a thread which watches for warning windows popping up in Skype. The main idea here is to find the ‘TZapCommunicator’ window. First, it tries to call FindWindowA with ClassName ‘tSkMainForm’ or ‘tSkMainForm.UnicodeClass’. (The ‘TCommunicatorForm’ window will be searched if the above two searches fail – this is probably for backward-compatibility with older versions of Skype.) If there is a hit, it uses the return handle to call FindWindowExA to search for its child window, ‘TZapCommunicator’. The search is done in a loop, with a 0xc8 millisecond sleep. If it finds the ‘TZapCommunicator’ window, it checks the foreground window by calling GetForegroundWindow; it will minimize the current foreground window if it is not the Skype window and then set the Skype window as the foreground window by calling SetForegroundWindow. This step is crucial for the later part. If for some reason the foreground window is not Skype, the latest bypass method will fail.

It calls GetWindowRect to get the position of the ‘TZapCommunicator’ window and calculate the size. Then it calls GetSystemMetrics twice with index equal to SM_CXSCREEN and SM_CYSCREEN to obtain the primary screen’s width and height in pixels. Then it calculates the absolute position of the ‘allow’ button in pixels. The SendInput API is called three times, with the type set to INPUT_MOUSE: the first SendInput API moves the mouse to the absolute position of the ‘allow’ button, the second sends a mouse left-button-down event, and the third sends a mouse left-button-up event to finish the job.

Figure 3. Attach usually triggers a warning to the user.

Once the attaching is successful, it uses ISkype.Friends to retrieve the victim’s list of contacts and iterate through them one by one to send the malicious link using ISkype.SendMessage.

Figure 4. Spam is sent to all contacts.

The infected link leads to an IRCBot which eventually will download a type of Bitcoin miner (a CPU based miner). This miner only uses the CPU to perform mining, thus it always utilizes about 90% of the CPU resources when running (which is not an efficient method compared with other, GPU-based miners).

After blocking the domains, it injects itself into almost every process (except mspaint.exe) that it is able to access, so that it can look for and hook the desired APIs via inline hooking. The desired API list is hard-coded in the bot’s binary, as shown in Figure 7. The data structure of each entry in the hooking list is described as follows:

struct API_TO_HOOK
{
   DWORD *libName;
   DWORD *apiName;
   DWORD *hookerFunction;  //function to be injected into the original API routine
   DWORD *outRestorepoint;  //inline-hook restore point
   DWORD *browserMessengerCheckingFunction;  //helper function to check if current process is a browser or a messenger
}

The libName is a pointer to the name of the library which contains the API. The apiName is a pointer to the name of the targeted API. The hookerFunction is the address of the malicious function which will hook the original API. And the outRestorepoint is the pointer to a pre-determined location which holds a copy of the overwritten byte codes during the inline hooking and a jump operation back to the original API work flow.

Figure 7. List of hooking APIs.

Table 1 shows all the targeted APIs.

Among them, the hooking of CopyFileA, CopyFileW, CreateFileA, CreateFileW, DeleteFileA, DeleteFileW, MoveFileA, MoveFileW, NtEnumerateValueKey, NtQueryDirectoryFile, RegCreateKeyExA and RegCreateKeyW are mainly for the bot’s self-defence mechanism. If any other process attempts to access the bot’s registry record, it will block it. The hooking of DnsQuery_A, DnsQuery_W and GetAddrInfoW is for the blocking or redirecting of DNS queries. Table 2 shows the keywords contained in the hard-coded DNS blocking list.

After matching this list, it will access the shared data through a named pipe to see if there is a downloaded domain name list, and block those domains as well.

The hooking of HttpSendRequestA, HttpSendRequestW, InternetWriteFile, PR_Write and send is for accessing and modifying the user’s browser or messenger communication, so that it can grab sensitive information and also hijack messages. However, it only has the ability to parse MSN messenger protocol, so Skype is safe from this worm for now.

Figure 8. The hooker function tries to match MSN protocol keywords in the message.

Table 3 shows a list of websites from which it tries to grab login information.

The hooking of URLDownloadToFileA and URLDownloadToFileW blocks the downloading of any file with extension ‘exe’, ‘com’, ‘pif’ or ‘scr’ from the IE or Firefox browser. It does not affect the bot’s downloading process since the bot does not use browsers to do that. This is some kind of self-defence from competitors, against any other possible exploits.

The concept of this inline hooking is to replace the beginning of the API calls with a jump to the malicious code, and after executing the malicious code, the flow jumps to the saved original opcodes, then finally jumps back to resume from the original location. The malware uses a method called ‘code overwriting’ to locate the address of the original API function, and changes the first five bytes of the API code with a unconditional Jump instruction that redirects the call to the callback function. The following is an example of how it hooks the kernel32.CreateFileA API:

In order to pass the commands to the injected processes, it implements the named pipe technique for the communication between the IRC function process and the worker processes. The data saved in the pipe is RC4 encrypted; the RC4 key is hard-coded in the binary and its CRC32 value is used to compose the pipe name.

Figure 10. The pipe name is in the following format: [Hex value of CRC32]_ipc.

The named pipe server is created in the mspaint.exe thread, and another process calls ConnectNamedPipe using the same CRC32 value as the name to get the pipe handle. Then they are able to access the shared data just like a local file object.

Once the above set ups are finished, NgrBot copies itself to the current user’s %AppData% folder with a randomly generated name and then adds a link to its executable file in the system registry autorun key in order to automatically launch each time Windows starts up.

The download of the latest NgrBot is also a Bitcoin miner, but this one is a lot more sophisticated than the CPU miner downloaded by SkyBot. It imports the OpenCL library and utilizes GPUs to do the mining, which is much more efficient than a CPU based miner.