Malspam pushing Locky ransomware tries HoeflerText notifications for Chrome and FireFox
Last Updated: 2017-09-01 23:09:04 UTC
by Brad Duncan (Version: 1)
2017-09-01 update: A different campaign using HoeflerText popups has been active during the same timeframe. I wrote about it here, but the only thing these two campaigns have in common is that they both used HoeflerText popups.
During past two weeks or so, we've seen plenty of botnet-based malicious spam (malspam) pushing Locky ransomware. In recent days, I've noticed multiple waves of malspam every weekday. It gets a bit boring after a while, but as 2017-08-31 came to a close, I noticed a different technique from this malspam.
Of note, I was unable to get any malware when using Internet Explorer or Microsoft Edge.
The emails were botnet-based, and they came from various IP addresses around the world. The message-ID header was spoofed, so that it ended with @us-west-2.amazonses.com>. However, the few emails I examined closely didn't come from Amazon servers. Email headers follow:
- Date/Time start: Thursday 2017-08-31 as early as 23:50 UTC
- Date/Time finish: Friday 2017-09-01 as late as 01:41 UTC
- Sender (spoofed): "Dropbox" <firstname.lastname@example.org>
- Subject: Please verify your email address
Shown above: Screen shot from one of the emails.
Fake Dropbox sites and HoeflerText notifications
Each link from the malspam went to compromised sites hosting fake Dropbox pages. When I viewed the links in Internet Explorer 11 or Microsoft Edge, they merely showed a fake Dropbox page. I believe they should've returned something after I clicked a link in "Please click here to download a new verification message." But that didn't work for me.
Shown above: Bogus site, but nothing when I tried it in IE or Edge.
Shown above: Bogus site with a HoeflerText popup when viewing it in Chrome.
Shown above: Bogus site with a HoeflerText popup when viewing it in FireFox.
Shown above: Bogus site with a HoeflerText popup when viewing it in FireFox after clicking "update".
I tried different browsers and had mixed results. Tor and Yandex browsers both returned the same results as IE 11 and Microsoft Edge when viewing those fake Dropbox pages. Opera and Vivaldi returned the same HoeflerText notifications seen in Google Chrome.
Shown above: Bogus site in Opera or Vivaldi gave the Chrome notification.
Shown above: Win.JSFontlib09.js from the fake HoeflerText notifications.
Network traffic wasn't too terribly different than what we've seen with other Locky infections. It just had an added step with the HoeflerText popup. The image below explains the network traffic from an infection in one of my lab hosts.
Shown above: Traffic from an infection filtered in Wireshark.
The following are URLs I found from the malspam. They're "de-fanged" so you can't accidentally click on them and go to the fake Dropbox pages.
URL that returned script causing HoeflerText popups in Chrome (and Firefox):
URL that should've returned some sort of malware when viewing the fake Dropbox sites in IE or Edge (but did not work):
URL that returned Win.JSFontlib09.js after clicking 'update' on the HoeflerText popup:
URL to retrieve the Locky binary after double-clicking Win.JSFontlib09.js:
Locky ransomware post-infection URL:
SHA256 hash for Win.JSFontlib09.js:
SHA256 hash for the Locky binary:
Shown above: Desktop of an infected Windows host from my lab.
Ultimately, this infection wasn't very innovative. The ransomware was the "Lukitus" variant of Locky, which has been out for a while, and it's easily detectable. We've seen all the individual techniques used during the entire infection chain. However, it cobbled together some existing tricks like HoeflerText popups with fake Dropbox pages, so it briefly excited me as I looked into it.
As always there are plenty of good practices that users and administrators can follow to avoid getting infected by this malware.
A pcap of the network traffic can be found here. It's password protected with the standard password. If you don't know it, look at the "about" page of my blog at malware-traffic-analysis.net.
brad [at] malware-traffic-analysis.net
Sep 1st 2017
5 years ago
I'm certain it was a configuration error on the criminal's part. Something was wrong on the server side. In those fake Dropbox pages, there was a link at "click here" within the line "Please click here to download a new verification message." It generated a URL to hxxp://dippydado[.]net/json.php. That URL should've returned a file. Unfortunately, it didn't return anything, and I got a "not found" style error from the network traffic.
So it wasn't a setting for IE or Edge that prevented the issue. That URL should've returned something for download, but it didn't. That issue was server-side, not on the client (or victim) side.
Sep 1st 2017
5 years ago
Sep 2nd 2017
5 years ago
I was just recently hit with this and it appears they took down the 188.8.131.52 drop point. Mine tried to initiate a connection and failed but succeeded hitting 184.108.40.206. Just wanted to share. Thanks again for the great post!
Sep 7th 2017
5 years ago