Joao Malware Analysis

Joao Malware Analysis

August 31, 2017 | Adeline Zhang

Overview

Security researchers from the security firm ESET spotted a piece of malware dubbed Joao targeting gamers. This malware is found inside an Aeria game installation pack provided by a third party. Upon the start of a game, this malware runs in the background, sending the victim’s machine information to the attacker, including the operating system, user name, and privilege information of this user. Additionally, this malware will install other forms of malware on the machine of the affected user.

Related information can be found at the following link:

http://www.hackread.com/dangerous-new-malware-joao-hits-gamers-worldwide/

Aeria Games

Aeria Games, formerly known as Aeria Games and Entertainment, is an online game publisher headquartered in Berlin, Germany with other locations in .

Aeria Games, a subsidiary of ProSiebenSat.1 Media, operates an Internet gaming portal for massive multiplayer online games. It focuses on online games in multiple formats to include client, browser, and mobile games. It publishes for North America, South America, and Europe.

Propagation and Infection

The malware Joao propagates via hacked Aeria games offered on unofficial websites for users to download.

Sample Analysis

   Environment

Operating System 32-bit Windows 7
Tools ProcessMonitor, XueTr, Wireshark, OllyDbg, IDA

Major Functions

  1. Information theft: The sample steals the computer name, operating system version, user privilege information, as well as information (such as login data) saved in Google Chrome.
  2. Network behavior: The sample connects to 104.18.48.240 to send an HTTP GET request in which the “value” field is encrypted user information.

http://www.apexserver.ws/index.php?route=anticheat&op=validatekey&cid=7&ver=4&value=c9LKpz30qO2-L4mZUktTzhQiySiSOfhzxdwusZP4GCXiQGWr96-7R22jHFA_lny5FtUMlbSI6tiiGCtl5_UuVe0SG-ft8VmlXMa

At first, this sample collects information about the local device, including the device name, user name, operating system version, and the user’s privilege level.

Then the sample encrypts and encodes the information shown in the preceding figure, extracts the URL from its own data via decryption, and adds the encoded local information to the “value” field in the URL. After that, the sample connects to the remote server and sends it an HTTP GET request.

If URL is unavailable and a request to it is replied with error 522 the sample has no further malicious behaviors as it fails to download data from the server. After receiving data from the server the sample acts as instructed. Specifically, it may create processes for code injection or steal information (such as user login data) saved in Google Chrome and send it to the remote server.

Analysis of Associated Samples

We searched for associated samples and found a component of Joao. According to our simple analysis, this component is also a downloader that is mainly used to download a PE file and inject it in the downloader for execution.

This component keeps trying to connect ports 53, 18000, 80, 443, 8000, 25, 21, 3389, and 445 of IP addresses 95.170.86.186, 146.185.136.11, and 185.35.77.17 in a circular manner until a connection is established.

After the connection is established, both ends first decide on the size of the file to upload. After that, the Joao component receives data and checks whether it is a PE file. If yes, this component injects it into its own process application space and then invokes CreateRemoteThread for execution.

   Network Characteristics

  1. The sample sends an HTTP GET request to 104.18.48.240, in which the value of the “host” field is www.apexcontrol.ws.
  2. An associated sample tries to download malicious code from the following malicious IP addresses: 95.170.86.186, 146.185.136.11, and 185.35.77.17.

   Attack Source

Detection Method

   Users’ Self-Protection

  1. Download games from official websites, rather than third-party websites where trojans may be concealed.
  2. Monitor HTTP GET requests whose “host” field contains the www.apexcontrol.ws domain name.
  3. Install antivirus software to prevent malware infection and resulting damage.

   NSFOCUS Recommended Solutions for Removing Trojans

  1. Short-term service: NSFOCUS engineers provide the onsite trojan backdoor removal service (manual services + NIPS + TAC) to ensure that risk points are immediately eliminated from the network and the event impact is minimized. After the handling, an event analysis report is provided.
  2. Mid-term service: NSFOCUS provides 3- to 6-month risk monitoring and preventive maintenance inspection (PMI) services (NIPS + TAC + manual services) to detect this malicious sample in an ongoing manner, thereby securing customers’ systems.
  3. Long-term service: NSFOCUS provides industry-specific risk mitigation solutions (threat intelligence + attack traceback + professional security service).

Conclusion

The malware Joao propagates via hacked Aeria games offered on unofficial websites for users to download. To prevent the infection of this malware, users must check whether the game installation pack contains an extra DLL file, especially mskdbe.dll. If yes, remove it immediately.

Appendix

The following indicators of compromise (IoCs) are concerned with Joao:

Joao downloader: mskdbe.dll – Win32 / Joao.A
Hashes:
49505723d250cde39087fd85273f7d6a96b3c50d
d9fb94ac24295a2d439daa1f0bf4479420b32e34
4ede2c99cc174fc8b36a0e8fe6724b03cc7cb663
e44dbadcd7d8b768836c16a40fae7d712bfb60e2
b37f7a01c5a7e366bd2f4f0e7112bbb94e5ff589
fdbb398839c7b6692c1d72ac3fcd8ae837c52b47
5ab0b5403569b17d8006ef6819acc010ab36b2db
c3abd23d775c85f08662a00d945110bb46897c7c
00a0677e7f26c325265e9ec8d3e4c5038c3d461d
c1b4c2696294df414cfc234ab50b2e209c724390
844f20d543d213352d533eb8042bd5d2aff4b7d4
2ce51e5e75d8ecc560e9c024cd74b7ec8233ff78
12a772e2092e974da5a1b6e008c570563e9acfe9
287c610e40aff6c6f37f1ad4d4e477cb728f7b1d
5303a6f8318c2c79c2188377edddbe163cd02572
6f17c3ab48f857669d99065904e85b198f2b83f5
51dfe50e675eea427192dcc7a900b00d10bb257a
ec976800cd25109771f09bbba24fca428b51563e
13e05e44d1311c5c15c32a4d21aa8eadf2106e96
0914913286c80428b2c6dec7aff4e0a9b51acf50
1e9c0a2a75db5b74a96dbfd61bcdda47335aaf8b
392b54c5a318b64f4fd3e9313b1a17eac36320e1
ba40012bdee8fc8f4ec06921e99bc4d566bba336
6d130e6301f4971069513266a1510a4729062f6d
beea9351853984e7426107c37bc0c7f40c5360e0
a34d6a462b7f176827257991ef9807b31679e781
ac86700c85a857c6d8c72cb0d34ebd9552351366
af079da9243eb7113f30146c258992b2b5ceb651
1e6125b9c4337b501c699f481debdfefea070583
a158f01199c6fd931f064b948c923118466c7384
350fc8286efdf8bcf4c92dc077088dd928439de9
2da8a51359bf3be8d17c19405c930848fe41bb04
Components:
JoaoShepherd.dll – Win32 / Joao.B
joaoDLL.dll – Win32 / Joao.C
joaoInstaller.exe – Win32 / Joao.D
JoaoShepherd.dll(x64) – Win64 / Joao.B
joaoInstaller.exe(x64) – Win64 / Joao.D
Hashes:
0d0eb06aab3452247650585f5d70fa8a7d81d968
f96b42fd652275d74f30c718cbcd009947aa681a
6154484d4acf83c21479e7f4d19aa33ae6cb716c
d338babd7173fa9bb9b1db9c9710308ece7da56e
ef2a21b204b357ca068fe2f663df958428636194
6b0e03e12070598825ac97767f9a7711aa6a7b91
28ca2d945731be2ff1db1f4c68c39f48b8e5ca98
d08120dd3fa82a5f117d91e324b2baf4cbbcaea5
f95aef3ca0c4bd2338ce851016dd05e2ee639c30
9b2d59a1aa7733c1a820cc94a8d5a6a5b4a5b586
ceb15c9fd15c844b65d280432491189cc50e7331
3331ac2aecfd434c591b83f3959fa8880141ab05
2ff2aadc9276592cbe2f2a07cf800da1b7c68581
3bceb54eb9dd2994b1232b596ee0b117d460af09
86617e92fc6b8625e8dec2a006f2194a35572d20
18a74078037b788f8be84d6e63ef5917cbafe418
4b0c1fcd43feab17ca8f856afebac63dedd3cd19
6bfa98f347b61d149bb2f8a2c9fd48829be697b6
7336e5255043841907e635b07e1e976d2ffb92b5
745396fedd66a807b55deee691c3fe70c5bc955d
574f81b004cb9c6f14bf912e389eabd781fe8c90
d7751fc27efbc5a28d348851ce74f987d59b2d91
19bf7b5ad77c62c740267ea01928c729ca6d0762
ecc0ade237fa46a5b8f92ccc97316901a1eaba47
7075ffa5c8635fb4afeb7eea69a910e2f74080b3
47f68b6352243d1e03617d5e50948648f090dc32
7a4f05fc0906e3e1c5f2407daae2a73b638b73d9
b6d7da761084d4732e85fd33fb670d2e330687a2
ab69fb7c47e937620ab4af6aa7c36cf75f262e39
0e9e2dcf39dfe2436b220f13a18fdbce1270365d