The GuptiMiner eScan Update Hijack

What happened

Attackers used a man-in-the-middle position to swap a genuine eScan update for a malicious one. Avast reports that the eScan client fetched updates from http://update3.mwti.net/pub/update/updll3.dlz over unencrypted HTTP. The attacker replaced the genuine package on the wire. The vendor did not publish the bad file. Most users received clean updates. BleepingComputer and The Hacker News name the trojanized package updll62.dlz, while Avast's write-up names the update path updll3.dlz. BleepingComputer adds that the malware avoids sandboxes by checking for at least 4 CPU cores and 4 GB of RAM.

The bad package carried a DLL, usually version.dll, placed in C:\Program Files\eScan\ so that eScan would load it. The DLL then ran more code. Avast lists these payloads.

• An XMRig cryptocurrency miner injected into credwiz.exe.
• A backdoor built on PuTTY that scans SMB and spreads to Windows 7 and Server 2008 machines.
• A modular backdoor aimed at enterprise networks. Avast reports more than 7,000 computers in one domain.

Avast reports that eScan fixed the problem after disclosure on 31 July 2023. The vendor added HTTPS downloads, a requirement for EV code signing, and checks for unsigned binaries. The Hacker News says the flaw went undetected for at least five years and that infections continued on outdated eScan clients. Avast notes possible links to the Kimsuky group, based on shared code and infrastructure. Read the Avast research. BleepingComputer and The Hacker News covered it too.

The update package gained a new DLL that downloads and runs code. A comparison of the package against a trusted copy shows that file.

Affected versions

Avast does not list eScan product version numbers. The weakness was the unencrypted HTTP update download, so any eScan client that used it was open to attack.

• Activity ran from at least 2018 to mid-2023.
• Avast saw the last variants in November 2023.
• eScan confirmed the fix on 31 July 2023.

Only users whose traffic an attacker could alter received the bad package.

Indicators of compromise

• File version.dll in C:\Program Files\eScan\ that eScan did not ship.
• Other DLL names from later variants: atiadlxx.dll (AMD CNext folder), BrLogAPI.dll (Brother folder), updll3.dll3 (Crypto folder).
• Domains: ns1.peepzo.com, ext.peepzo.com, crl.peepzo.com, m.airequipment.net, gesucht.net, www.righttrak.net, www.elimpacific.net.
• Registry: HKLM\SYSTEM\CurrentControlSet\Control\CMF\Class, HKLM\SYSTEM\RNG\FFFF, HKLM\SOFTWARE\Microsoft\DECLAG.
• Mutexes: ONLY_ME_V1, SLDV01 to SLDV15, PROCESS_.
• SHA-256 of the first 2018 sample: c3122448ae3b21ac2431d8fd523451ff25de7f6e399ff013d6fa6953a7998fa3

How to check

Look for the sideloaded DLL and the registry keys on each Windows machine that runs eScan.

dir "C:\Program Files\eScan\version.dll"

reg query "HKLM\SYSTEM\CurrentControlSet\Control\CMF\Class"

A version.dll that eScan did not ship, or the registry key, needs follow-up. Also search DNS logs for the domains above. Confirm the eScan client now uses HTTPS for updates.

What to do now

1. Update eScan to a build that downloads over HTTPS, as the vendor fixed after July 2023.
2. Run the file and registry checks above on every machine with eScan.
3. If a check hits, isolate the machine. The malware spreads over SMB, so check neighbouring machines.
4. Rebuild affected machines and reset credentials used on them.
5. Block the listed domains and watch for new DLLs in application folders.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 20 (1 Added)

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

NEW FILE   version.dll
           It downloads from the internet and runs other programs.

Sources

1. decoded.avast.io/janrubin/guptiminer-hijacking-antivirus-updates-for-distributing-backdoors-and-casual-mining/
2. bleepingcomputer.com/news/security/hackers-hijack-antivirus-updates-to-drop-guptiminer-malware/
3. thehackernews.com/2024/04/escan-antivirus-update-mechanism.html