Operation Buhtrap malware distributed via ammyy.com

We noticed in late October that users visiting the Ammyy website to download the free version of its remote administrator software were being served a bundle containing not only the legitimate Remote Desktop Software Ammyy Admin, but also an NSIS (Nullsoft Scriptable Installation Software) installer ultimately intended to install the tools used by the Buhtrap gang to spy on and control their victims’ computers.

Figure 1 – Ammyy.com legitimate website

While Ammyy Admin is legitimate software, it has a long history of being used by fraudsters. As a result, several security products, such as ESET's, detect it as a Potentially Unsafe Application. However, it is still widely used, notably in Russia.

As noted in our previous blog on Buhtrap, this gang has been actively targeting Russian businesses, mostly through spear-phishing. It is thus interesting to see them add strategic web compromises to their arsenal. As remote administrator software is routinely used by businesses, it definitely makes sense for this gang to try to compromise visitors to this site. It’s worth noting that Ammyy’s website lists clients that include the top 500 Fortune companies as well as Russian banks.

The compromise

It appears Ammyy’s website is now clean and serves the malware-free Ammyy Admin remote administrator package, but for about a week, visitors were downloading an installer that contained both malware and the Ammyy product. After investigation, different malware families were found to have been distributed through Ammyy’s website. The timeline below shows which and when.

The first malware we saw was the lurk downloader, which was distributed on October 26^th. We then saw Corebot on the 29^th, Buhtrap on the 30^th, and finally, Ranbyus and the Netwire RAT on November 2^nd.

Although these families are not linked together, the droppers that might have been downloaded from Ammyy’s website were the same in every case. The executable would install the real Ammyy product, but would also launch a file called either AmmyyService.exe or AmmyySvc.exe which contained the malicious payload. Thus, it is quite possible that the cybercriminals responsible for the website hack sold access to different groups.

Buhtrap

The install package behaves in exactly the same way as described in our previous blog. It first fingerprints the system by looking at software installed on the computer and at what URLs have been visited. It then downloads an additional package if the system is deemed valuable. This downloader is signed with the following certificate:

Figure 2 – Downloader’s certificate

We notified Comodo which promptly revoked this certificate. The downloaded package is used to spy on the system and ultimately run code to log all keystrokes, enumerate smart cards and communicate with C&C servers. This module has exactly the same functionalities as the one that we analyzed previously and is loaded in memory through a DLL sideloading technique. The main difference this time is that the legitimate application that is used for DLL sideloading is no longer Yandex Punto, but a program called The Guide, a two-pane extrinsic outliner.

Operation Buhtrap is still ongoing and we regularly see new updates coming from the malware’s authors. This group, in much the same way as the Carbanak gang, is using techniques that we are accustomed to see in targeted attacks. The fact that they now use strategic web compromises is another sign of the closing gap between techniques used by cybercriminals and by APT actors.

If you downloaded and installed Ammyy Admin recently, your computer might be compromised by one of the malware described above. Since we do not know exactly when the attack started nor if the site is still compromised, we recommend that you take precautionary measures and use or install a security product to scan and protect your computer.

We tried to contact Ammyy’s developers about this problem for several days and in different ways, but did not receive an answer from them. As Ammyy Admin is widely used, we wanted to warn its users about this security problem.

Special thanks to Anton Cherepanov, Peter Košinár and Jan Matušík for their help in this analysis.