{"id":1071,"date":"2024-08-29T01:37:22","date_gmt":"2024-08-29T01:37:22","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=1071"},"modified":"2025-07-28T13:48:43","modified_gmt":"2025-07-28T13:48:43","slug":"this-aint-no-disco-fireball-malware-corrupts-250-million-users","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/this-aint-no-disco-fireball-malware-corrupts-250-million-users\/","title":{"rendered":"This ain\u2019t no disco \u2013 Fireball malware corrupts 250 million users"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

A new strain of Chinese malware, dubbed Fireball by researchers, has recently been discovered on more than 250 million computers around the globe. Indian machines are the most heavily infected (10 per cent), followed by Brazil, Mexico and Indonesia (Nine, six and five per cent respectively).<\/p>\n\n\n\n

Once installed, Fireball hijacks internet browsers, effectively turning them into zombies. Currently, the malware\u2019s aim is to install plugins and other configurations to enhance ad performance and manipulating traffic in order to increase advertising revenue.<\/p>\n\n\n\n

While in its current form Fireball seems relatively benign, it has the security community worried as it has the capability to serve any other PUA (potentially unwanted application).<\/p>\n\n\n\n

Researchers have linked the malware to a Chinese advertising agency named Rafotech.<\/p>\n\n\n\n

Below is a technical analysis we\u2019ve conducted on Fireball\u2019s code \u2013 the sample hashes are below:

FAB40A7BDE5250A6BC8644F4D6B9C28F

69FFDF99149D19BE7DC1C52F33AAA651

B56D1D35D46630335E03AF9ADD84B488

8C61A6937963507DC87D8BF00385C0BC

7ADB7F56E81456F3B421C01AB19B1900<\/strong>

This set contains three dll files and two exe files. We started our analysis with exe files.

MD5: 69FFDF99149D19BE7DC1C52F33AAA651

After digging into static analysis of the sample, one of the first things we saw was a suspicious URL inside the strings.<\/p>\n\n\n\n

\"\"\/
Figure 1 Suspicious URL in strings<\/em><\/figcaption><\/figure>\n\n\n\n

We then ran the suspicious URL in Virus Total, here are the results:

https:\/\/virustotal.com\/en\/url\/28e8eec84c1342d64f8b20b2624e095f5fdddd7329b90b53dcf5adeba7cc2af4\/analysis\/1496656286\/<\/a>

URL Scanner                     Result<\/strong>

Dr.Web                               Malicious site

Avira (no cloud)               Malware site

Fortinet                              Malware site

Kaspersky                          Malware site

Sangfor                               Malware site

The above five vendors were the only ones out of 65 who flagged this site as a malware site.<\/p>\n\n\n\n

\"\"\/
Figure 2 Suspicious URL found in the stack<\/em><\/figcaption><\/figure>\n\n\n\n

Additionally, we encountered registry traces in the code which led to an image file execution entry.<\/p>\n\n\n\n

\"\"\/
Figure 3 Registry key pointing in the code<\/em><\/figcaption><\/figure>\n\n\n\n

We executed these instruction sets and watched for any changes in the system registry traces.<\/p>\n\n\n\n

\"\"\/
Figure 4 Image File Execution Options<\/em><\/figcaption><\/figure>\n\n\n\n

What we\u2019re seeing here is that the image file execution option entry can be used to replace a file with another process using the \u2018debugger\u2019 value. To see how this works, let\u2019s take a process explorer, a similar tool to Windows Task Manager, and view the running processes:<\/p>\n\n\n\n

\"\"
Figure 5 Replacing task manager by process explorer<\/em><\/figcaption><\/figure>\n\n\n\n

After doing this, we can see the registry trace changes in the Image file execution option.<\/p>\n\n\n\n

\"\"\/
Figure 6 Regedit shows process explorer replacing the task manager<\/em><\/figcaption><\/figure>\n\n\n\n

This is the process we would undertake to replace task manager manually, and the malware author uses this same technique to replace important files with the \u2018debugger\u2019 value.

If we now refer back to Figure 4, we can see that MRT.exe is replaced by the Fireball malware \u2013 MRT.exe is Microsoft\u2019s malicious software removal tool.

Now we\u2019ll move on to our next executable file.

MD5:  7ADB7F56E81456F3B421C01AB19B1900

This file doesn\u2019t have any embedded url, but we do see the peculiar registry entry “HKEY_LOCAL_MACHINE\\SOFTWARE\\ScreenShot”.

It is supposed to be a screenshot application but didn\u2019t show any behaviour in our virtual machine, so we proceeded with the other dll files.

DLL file analysis:

We started our analysis on the dll (MD5: FAB40A7BDE5250A6BC8644F4D6B9C28F).<\/p>\n\n\n\n

\"\"\/
Figure 7 DLL file – Export details<\/em><\/figcaption><\/figure>\n\n\n\n

Interesting strings:<\/p>\n\n\n\n

    \n
  • 00000001B36F   00001001C56F      0   d\\\\.\\PhysicalDrive%d<\/li>\n\n\n\n
  • 00000001B3F0   00001001C5F0      0   %u_%u<\/li>\n\n\n\n
  • 00000001B404   00001001C604      0   %s_%s<\/li>\n\n\n\n
  • 00000001B410   00001001C610      0   %s_%08X<\/li>\n\n\n\n
  • 00000001B450   00001001C650      0   cloud<\/li>\n\n\n\n
  • 00000001B45C   00001001C65C      0   front<\/li>\n\n\n\n
  • 00000001B468   00001001C668      0   .net\/\/v<\/li>\n\n\n\n
  • 00000001B480   00001001C680      0   ?action=<\/li>\n\n\n\n
  • 00000001B49C   00001001C69C      0   http:\/\/<\/li>\n\n\n\n
  • 00000001B4E0   00001001C6E0      0   HTTP\/1.0<\/li>\n\n\n\n
  • 00000001B54C   00001001C74C      0   rundll32.exe “<\/li>\n\n\n\n
  • 00000001B368   00001001C568      0   unnamed<\/li>\n\n\n\n
  • 00000001B4AC   00001001C6AC      0   Internet Open Failed!<\/li>\n\n\n\n
  • 00000001B4C4   00001001C6C4      0   Internet Connect Failed!<\/li>\n\n\n\n
  • 00000001B4FC   00001001C6FC      0   Http Open Failed!<\/li>\n\n\n\n
  • 00000001B510   00001001C710      0   Http Send Request Failed!<\/li>\n\n\n\n
  • 00000001B5D8   00001001C7D8      0  C:\\Users\\Administrator\\Desktop\\archer_lyl\\Release\\ Archer_Input.pdb<\/li>\n\n\n\n
  • 00000001CAC8   00001001DCC8      0   InternetOpenW<\/li>\n\n\n\n
  • 00000001CAD8   00001001DCD8      0   InternetCrackUrlW<\/li>\n\n\n\n
  • 00000001CAEC   00001001DCEC      0   InternetReadFile<\/li>\n\n\n\n
  • 00000001CB00   00001001DD00      0   InternetConnectW<\/li>\n\n\n\n
  • 00000001CB14   00001001DD14      0   HttpSendRequestW<\/li>\n\n\n\n
  • 00000001CB28   00001001DD28      0   HttpQueryInfoW<\/li>\n\n\n\n
  • 00000001CB3A   00001001DD3A      0   HttpOpenRequestW<\/li>\n\n\n\n
  • 00000001CB4E   00001001DD4E      0   InternetCloseHandle<\/li>\n<\/ul>\n\n\n\n

    We registered the DLL to find any behaviour changes in the system. It creates a new registry entry in the StartMenu2 program.

    We checked the next DLL file (MD5: 8C61A6937963507DC87D8BF00385C0BC) to find whether this file also had any similar behaviour.<\/p>\n\n\n\n

    \"\"\/
    Figure 8 File export details<\/em><\/figcaption><\/figure>\n\n\n\n

    Interesting strings inside this file:<\/p>\n\n\n\n

      \n
    • strings [C:\\ProgramData]<\/li>\n\n\n\n
    • strings [msmpeng]<\/li>\n\n\n\n
    • strings [C:\\Windows\\System32\\cmd.exe \/c “”]<\/li>\n\n\n\n
    • strings [C:\\Windows\\System32\\cmd.exe \/c “]<\/li>\n\n\n\n
    • strings [ -l >> ]<\/li>\n\n\n\n
    • strings [ttttt.exe]<\/li>\n\n\n\n
    • strings [Microsoft\\Windows Defender\\Support]<\/li>\n\n\n\n
    • strings [hhhhh.exe]<\/li>\n\n\n\n
    • strings [kernel32]<\/li>\n\n\n\n
    • strings [Microsoft\\Microsoft Antimalware\\Support]<\/li>\n\n\n\n
    • strings [d\\\\.\\PhysicalDrive%d]<\/li>\n\n\n\n
    • strings [\\\\.\\Scsi%d:]<\/li>\n\n\n\n
    • strings [MachineGuid]<\/li>\n\n\n\n
    • strings [SOFTWARE\\Microsoft\\Cryptography]<\/li>\n\n\n\n
    • strings [%s_%08X]<\/li>\n\n\n\n
    • strings [inqmqq]<\/li>\n\n\n\n
    • strings [.cloud]<\/li>\n\n\n\n
    • strings [front.net]<\/li>\n\n\n\n
    • strings [?action=]<\/li>\n\n\n\n
    • strings [clean\/]<\/li>\n\n\n\n
    • strings [http:\/\/]<\/li>\n\n\n\n
    • strings [HTTP\/1.0]<\/li>\n\n\n\n
    • strings [list.dat]<\/li>\n\n\n\n
    • strings [ -stop “]<\/li>\n\n\n\n
    • strings [msmpeng]<\/li>\n\n\n\n
    • strings [“,StartClear2]<\/li>\n\n\n\n
    • strings [C:\\Windows\\System32\\Rundll32.exe “]<\/li>\n\n\n\n
    • strings [cle.log.4]<\/li>\n\n\n\n
    • strings [cle.log.3]<\/li>\n\n\n\n
    • strings [cle.log.2]<\/li>\n\n\n\n
    • strings [cle.log.1]<\/li>\n\n\n\n
    • strings [ -accepteula]<\/li>\n\n\n\n
    • strings [hhhhh.exe]<\/li>\n\n\n\n
    • strings [ttttt.exe]<\/li>\n<\/ul>\n\n\n\n

      We then moved to the final file (MD5: B56D1D35D46630335E03AF9ADD84B488), which contains the following export function:

          Export table of DLL ‘WinSAP.dll’:

      Base ordinal number: 00000001h \/ 1<\/p>\n\n\n\n

        \n
      • 2 names are exported<\/li>\n\n\n\n
      • 2 functions are exported<\/li>\n<\/ul>\n\n\n\n

        Ordinal Offset                                Name<\/p>\n\n\n\n

          \n
        • 00002F80h                         MAIN<\/li>\n\n\n\n
        • 0000B990h                         ServiceMain<\/li>\n<\/ul>\n\n\n\n

          We found the following strings in this file:<\/p>\n\n\n\n

            \n
          • strings [\\\\.\\PhysicalDrive%d]<\/li>\n\n\n\n
          • strings [\\\\.\\Scsi%d:]<\/li>\n\n\n\n
          • strings [SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost]<\/li>\n\n\n\n
          • strings [NOT UPDATE]<\/li>\n\n\n\n
          • strings [UPDATE OVERWRITE]<\/li>\n\n\n\n
          • strings [SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost]<\/li>\n\n\n\n
          • strings [%s\\svchost.exe -k %s]<\/li>\n\n\n\n
          • strings [%s\\svchost.exe -k %s]<\/li>\n\n\n\n
          • strings [Advapi32]<\/li>\n\n\n\n
          • strings [SYSTEM\\CurrentControlSet\\Services\\%s]<\/li>\n\n\n\n
          • strings [Parameters]<\/li>\n\n\n\n
          • strings [ServiceDll]<\/li>\n\n\n\n
          • strings [explorer.exe]<\/li>\n\n\n\n
          • strings [SeDebugPrivilege]<\/li>\n\n\n\n
          • strings [ADFWAGAADF_Example\/1.0]<\/li>\n\n\n\n
          • strings [2.7.38]<\/li>\n\n\n\n
          • strings [2.7.38]<\/li>\n\n\n\n
          • strings [explorer.exe]<\/li>\n\n\n\n
          • strings [winsap]<\/li>\n\n\n\n
          • strings [\\SETUP.dll]<\/li>\n\n\n\n
          • strings [winsap]<\/li>\n\n\n\n
          • Strings [Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.]<\/li>\n\n\n\n
          • strings [SCSIDISK]<\/li>\n\n\n\n
          • strings [CreateServiceW]<\/li>\n\n\n\n
          • strings [StartServiceW]<\/li>\n\n\n\n
          • strings [-install]<\/li>\n\n\n\n
          • strings [-update]<\/li>\n\n\n\n
          • strings [-install]<\/li>\n\n\n\n
          • strings [-uninstall]<\/li>\n\n\n\n
          • strings [-update]<\/li>\n\n\n\n
          • strings [aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLndvcmsmdXBkYXRlMz12ZXJzaW9uLCVz]<\/li>\n\n\n\n
          • strings [aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLmluc3RhbGw=]<\/li>\n\n\n\n
          • strings [aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLnVwZGF0ZW9r]<\/li>\n\n\n\n
          • strings [aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLnN0YXJ0aW5zdGFsbA==]<\/li>\n\n\n\n
          • strings [aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLnN0YXJ0dXBkYXRl]<\/li>\n\n\n\n
          • strings [aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLmlzZXhpc3RlZA==]<\/li>\n\n\n\n
          • strings [aHR0cDovL2RjNDRxandhbDNwMDcuY2xvdWRmcm9udC5uZXQvd2luc2FwL3VwP3B0aWQ9JXMmc2lkPSVzJmxuPSVzXyVzJnZlcj0lcyZ1aWQ9JXMmZHA9MA==]<\/li>\n<\/ul>\n\n\n\n

            This is the interesting part in this file, some strings appeared to be encoded:<\/p>\n\n\n\n

              \n
            • aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLndvcmsmdXBkYXRlMz12ZXJzaW9uLCVz<\/li>\n\n\n\n
            • aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLmluc3RhbGw=<\/li>\n\n\n\n
            • aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLnVwZGF0ZW9r<\/li>\n\n\n\n
            • aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLnN0YXJ0aW5zdGFsbA==<\/li>\n\n\n\n
            • aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLnN0YXJ0dXBkYXRl<\/li>\n\n\n\n
            • aHR0cDovL2QzaTFhc29zd3VmcDVrLmNsb3VkZnJvbnQubmV0L3Y0L2d0Zy8lcz9hY3Rpb249dmlzaXQud2luc2FwLmlzZXhpc3RlZA==<\/li>\n\n\n\n
            • aHR0cDovL2RjNDRxandhbDNwMDcuY2xvdWRmcm9udC5uZXQvd2luc2FwL3VwP3B0aWQ9JXMmc2lkPSVzJmxuPSVzXyVzJnZlcj0lcyZ1aWQ9JXMmZHA9MA==<\/li>\n<\/ul>\n\n\n\n

              Here are the same values decoded:<\/p>\n\n\n\n

                \n
              • hxxp:\/\/d3i1asoswufp5k(.)cloudfront(.)net\/v4\/gtg\/%s?action=visit.winsap.work&update3=version,%s<\/li>\n\n\n\n
              • hxxp:\/\/d3i1asoswufp5k (.)cloudfront (.)net\/v4\/gtg\/%s?action=visit.winsap.install<\/li>\n\n\n\n
              • hxxp:\/\/d3i1asoswufp5k (.)cloudfront (.)net\/v4\/gtg\/%s?action=visit.winsap.updateok<\/li>\n\n\n\n
              • hxxp:\/\/d3i1asoswufp5k (.)cloudfront (.)net\/v4\/gtg\/%s?action=visit.winsap.startupdate<\/li>\n\n\n\n
              • hxxp:\/\/d3i1asoswufp5k (.)cloudfront (.)net\/v4\/gtg\/%s?action=visit.winsap.isexisted<\/li>\n\n\n\n
              • hxxp:\/\/dc44qjwal3p07 (.)cloudfront (.)net\/winsap\/up?ptid=%s&sid=%s&ln=%s_%s&ver=%s&uid=%s&dp=0<\/li>\n<\/ul>\n\n\n\n

                All these are malicious URLs present in the file. We advise readers to block these urls in their firewall and if you notice any strange behaviour from your web browser, please revert the web browser settings back to default and remove any extensions you did not install.<\/p>\n","protected":false},"excerpt":{"rendered":"

                A new strain of Chinese malware, dubbed Fireball by researchers, has recently been discovered on more than 250 million computers around the globe. Indian machines are the most heavily infected (10 per cent), followed by Brazil, Mexico and Indonesia (Nine, six and five per cent respectively). Once installed, Fireball hijacks internet browsers, effectively turning them into zombies. Currently, the malware\u2019s aim is to install plugins and other configurations to enhance ad performance and manipulating traffic in order to increase advertising revenue.<\/p>\n","protected":false},"author":1,"featured_media":1083,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-1071","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1071","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=1071"}],"version-history":[{"count":5,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1071\/revisions"}],"predecessor-version":[{"id":4093,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/1071\/revisions\/4093"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/1083"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=1071"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=1071"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=1071"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}