AcidBox Malware Uncovered Working with Repurposed VirtualBox Exploit

Superior malware, dubbed AcidBox, has been discovered by researchers who say a mysterious cybergang made use of it 2 times from Russian companies as significantly back as 2017. In a report produced Wednesday, Palo Alto Networks’ Device 42 sheds new gentle on to assaults against the popular open-supply virtualization program VirtualBox that utilized the AcidBox malware.

Unit 42’s postmortem on the VirtualBox attacks commences in 2008 when researchers at Main Protection discovered a bug in the Windows Vista stability mechanism called Driver Signature Enforcement (DSE). The flaw allowed an attacker to disable DSE and set up rogue software on to qualified scenarios of Oracle’s VirtualBox program. The bug (CVE-2008-3431) impacting VirtualBox driver VBoxDrv.sys was patched in edition 1.6.4.

Quickly ahead to 2o14, and the notorious Turla Group designed the initially malware to abused a third-get together product driver to disable DSE, weaponizing Core Security’s analysis. The Turla Group attacks also concentrated on VirtualBox motorists. And inspite of Oracle’s 2008 patch, Turla operators successfully figured out how to disabled DSE with its malware. That’s since, in accordance to Device 42, even with the bug (CVE-2008-3431) deal with, only just one of two vulnerabilities ended up patched in 2008.

“The exploit utilized by Turla really abuses two vulnerabilities — of which, only a person was ever set [with CVE-2008-3431],” Device 42 wrote in its report posted Wednesday. The Turla Team malware, researchers claimed, also targeted a next DSE vulnerability tied to a signed VirtualBox driver (VBoxDrv.sys v1.6.2) using what would later be recognized as AcidBox malware.

Rapidly ahead to 2019, and that’s when Unit 42 reported it first uncovered a sample of AcidBox that had been uploaded to VirusTotal. Researchers then traced the AcidBox malware to fresh assaults versus the VirtualBox driver VBoxDrv.sys v1.6.2, along with all other versions up to v3.. (the existing VirtualBox variation is 6).

“Because of the malware’s complexity, rarity, and the truth that it is aspect of a even larger toolset, we think it was utilized by an superior risk actor for qualified assaults and it’s possible that this malware is even now currently being employed these days if the attacker is still active,” wrote Dominik Reichel and Esmid Idrizovic, scientists with Palo Alto Networks’ Device 42 team.

Even with similarities involving the Turla Group and the cybergang behind the recent VirtualBox assaults, researchers explained the two threat groups are not connected. Turla, also recognised as Venomous Bear, Waterbug and Uroboros, is a Russian-speaking menace actor recognized since 2014.

VirtualBox Exploit

The exploit that was employed by Turla abuses two vulnerabilities. The 1st flaw (CVE-2008-3431), fixed in 2008, exists in the VBoxDrvNtDeviceControl purpose in VBoxDrv.sys. The function does not properly validate a buffer connected with the Irp object, allowing neighborhood people to achieve privileges by opening the .VBoxDrv machine and calling DeviceIoControl to send out a crafted kernel deal with.

On the other hand, the second vulnerability is even now unpatched, and was used in a newer version of Turla’s exploit, which scientists imagine was launched in 2014 in the risk group’s kernelmode malware. It is this exploit that the still-to-be-recognised threat actor powering AcidBox leveraged in the 2017 assault in opposition to the two Russian companies.

Reichel explained to Threatpost that the unpatched flaw “never acquired a CVE due to the fact it was obviously (i.e. unintentionally) patched in variation 3…”

“[AcidBox] utilizes a known VirtualBox exploit to disable Driver Signature Enforcement in Home windows, but with a new twist: Though it is publicly recognised that VirtualBox driver VBoxDrv.sys v1.6.2 is susceptible and applied by Turla, this new malware works by using the exact exploit but with a slightly newer VirtualBox edition,” explained researchers.

The Malware

The AcidBox malware alone is a complicated modular toolkit. Scientists only have entry to a small portion of this toolkit. They discovered 4 64-little bit usermode DLLs and an unsigned kernelmode driver. 3 (out of individuals four usermode samples (msv1_.dll, pku2u.dll, wdigest.dll) have identical features and are loaders for the key worker module, researchers reported.

Researchers also noted that attackers are using their personal DEF files (in its place of __declspec(dllexport), which provides the export directive to the item file so end users do not require to use a DEF file) to give instructions for when to import or export its DLLs. A DEF file (or module-definition file) is a text file containing 1 or additional module statements that explain numerous attributes of a DLL. When a DEF file is applied, attackers can decide on which ordinal their export perform will have.

“This is not feasible with __declspec(dllexport) as the Visual Studio compiler generally counts your functions setting up from one,” reported researchers. “Using a DEF file alternatively of __declspec(dllexport) has some advantages. You are in a position to export capabilities by ordinals and you can also redirect capabilities between other matters. The disadvantage is that you have to sustain an added file inside of your project.”

Reichel explained to Threatpost there is continue to a lot of unknowns about the malware, but he’s “encouraging the cybersecurity local community to enable collaborate with us and share any additional information about this menace if they have it,” he stated.

Going ahead, AcidBox is a “very rare” malware that is likely used in remarkably focused attacks, scientists claimed.

“While AcidBox does not use any basically new solutions, it breaks the fantasy that only VirtualBox VBoxDrv.sys 1.6.2 can be made use of for Turla’s exploit,” they said. “Appending delicate info as an overlay in icon resources, abusing the SSP interface for persistence and injection and payload storage in the Windows registry places it into the class of appealing malware.”

Insider threats are diverse in the perform-from property period. On June 24 at 2 p.m. ET, join the Threatpost edit crew and our special guest, Gurucul CEO Saryu Nayyar, for a Free of charge webinar, “The Enemy In just: How Insider Threats Are Transforming.” Get beneficial, genuine-world info on how insider threats are altering with WFH, what the new assault vectors are and what businesses can do about it. Please sign-up here for this Threatpost webinar.