“Spymel” Trojan Uses Stolen Certificates to Evade Detection

An infostealer malware family identified by researchers at Zscaler ThreatLabZ leverages compromised digital certificates to avoid being detected by security products.

The threat, which payload hashes provided by Zscaler show was discovered in late December, has been dubbed “Spymel” and it’s designed to allow cybercriminals to steal information from compromised machines and spy on the victim.

Attackers have distributed the malware via spam emails containing an archived JavaScript file that downloads Spymel from a remote server and installs it on infected systems.

While the downloader source code is not protected in any way, the actual malware executable, a .NET binary, is highly obfuscated. The file is signed with a digital certificate issued by DigiCert to SBO INVEST, which, according to Reason Core Security, is a France-based software publisher.

It appears the malware developers have somehow obtained more than one certificate issued to this company. The first version of the malware analyzed by Zscaler had been signed with a certificate that has been revoked by DigiCert, but a newer variant, which experts spotted two weeks later, was signed with a different certificate issued to SBO INVEST.

Spymel, a threat designed to work on both Windows XP and Windows 7 systems, creates registry keys for persistence. The malware’s configuration data, including for command and control (C&C), is hardcoded within the malware executable.

The Trojan uses modules to perform various tasks. One of the modules allows cybercriminals to log keystrokes and save the data to a file. Another module, dubbed “ProtectMe,” is designed to prevent the victim from terminating the malware using tools like Process Explorer, Task Manager, Process Hacker, or the taskkill command.

“The malware monitors application like Task Manager, Process Explorer, and Process Hacker. It uses GetForegroundWindow() API to get the handle of active window and changes it’s functionality if process is from the above list,” Zscaler researchers explained.

Attackers can use the C&C server to send various commands to the malware, including for collecting information about the infected system and the files found on it, deleting, executing or renaming a specified file, uploading a specified file to the C&C, capturing a screenshot of the desktop, and enabling or disabling video recording.

The C&C server used by the malware is hosted on the android.sh domain, which has a Germany IP address.

It’s not uncommon for potentially unwanted applications (PUA) and malware to abuse digital certificates. The number of certificates used to sign malware has increased steadily over the past years, with more than 6,000 cases being recorded in 2014.

Related Reading: Let’s Encrypt’s Free Certificates Abused by Cybercriminals