A malware dropper dubbed WiryJMPer is masquerading as a virtual wallet and using challenging obfuscation techniques to infect machines with the Netwire remote-access Trojan (RAT) payload.
Researchers at Avast first disclosed details about the malware dropper, which they identified because the .RSRC section was three times larger than the WinBin2Iso binary for the wallet it purported to be, called ABBC Coin. In addition, a virtual wallet like ABBC Coin is normally used for managing cryptocurrencies, whereas the WinBin2Iso strings containing WiryJMPer are normally used to convert images from CDs, DVDs and Blu-ray discs.
Why WiryJMPer Flew Under the Radar
The researchers discovered that the ABBC Coin wallet’s window always shows up at startup, immediately following an unresponsive WinBin2Iso window. While a victim’s attention is focused on this front-end activity, WiryJMPer drops the Netwire RAT in the background. During this process, the JMP instruction moves directly into the .RSRC section rather than handle window messages, as it would in a more benign scenario.
The malware dropper’s creators used low-level code abstraction, along with control flow obfuscation and possibly a virtual machine based on a custom stack amid the RC4 key schedule.
The infection process consists of decrypting first the RC4 decryption password and .LNK filename, then the decoy binary — the ABBC Coin wallet — and, of course, the Netwire malware. At the same time, ntdll.dll is loaded into memory, along with the malware, and the decoy is saved to disk. By copying %APPDATA%abbcdriver.exe and creating a shortcut .LNK file in the startup folder, WiryJMPer can gain persistence on an infected machine, researchers said.
Ordinary users may be fooled by the decoy binary, the report added, which may explain why the malware dropper has not attracted attention until now.
How to Ward Off Threats Like WiryJMPer
Malware creators are always trying to find effective ways to sneak into machines, and organizations must do more than simply hope the power users among their teams will notice unusual attributes in a binary.
Security teams can help avoid being tricked by the likes of WiryJMPer by investing in a comprehensive vulnerability management solution that can model network topologies, ensure the latest software patches have been applied and more.