Image File Trickery Part II: Fake Icon Delivers NanoCore

The .zipx file extension is used to denote that the ZIP archive format is compressed using advanced methods of the WinZip archiver. In 2019, we published a blog about this file extension being abused to deliver Lokibot malware. In this blog, we outline another .zipx attachment we recently encountered with spam messages, and we will show the result of our investigation in comparison to the previous .zipx sample we observed.

Figure 1: The email sample containing a .zipx attachment

The emails, claiming to be from the Purchase Manager of certain organizations that the cybercriminals are spoofing, look like usual malspams except for their attachment. The attachments, which have a filename format “NEW PURCHASE ORDER.pdf*.zipx”, are actually image (Icon) binary files, with attached extra data, which happens to be RAR. This file format abuse is similar to what we have seen previously.

Figure 2: The attachment’s contents viewed in the Hiew tool

If the attachment successfully evades any scanning email gateways, the next hurdle is the victim’s machine, which needs to have an unzip tool that can extract the executable file inside the attachment. We tried using the same tools from the previous blog to extract the EXE file and here is the result:

The archive utility WinZip and WinRAR yield similar results when extracting the EXE file from the previous and current .zipx files. WinZip does not support unzipping either of samples whereas WinRAR managed to extract the EXE file contained in both samples.

Figure 3: The executable contained in the attachment NEW PURCHASE ORDER.pdf.zipx is recognized by WinRAR

Interestingly, 7Zip can also extract the content of the latest .zipx sample. 7Zip initially tries to open the files as a ZIP archive and fails, but afterward, 7Zip recognizes the .zipx files as Rar5 archives and can get their contents unpacked. Unlike in the previous blog, there is no need for the extension of the recent attachments to be renamed to something else other than .zipx or .zip just for their executables to be extracted using 7Zip.

Figure 4: Opening the attachment NEW PURCHASE ORDER.pdf.zipx using the 7Zip tool

The executables we gathered have a similar name to that of the .zipx attachment, “NEW PURCHASE ORDER*.exe”. Also, the icon at the start of the .zipx files is actually the icon used on the EXE files within the archive.

Analyzing the EXE files indicates that they are samples of NanoCore RAT version 1.2.2.0. This RAT create copies of itself at the AppData folder and inject its malicious code at RegSvcs.exe process. The data stolen by this RAT is sent to the command and control servers listed below:

• shtf[.]pw
• uyeco[.]pw

Figure 5: Memory dump of RegSvcs processes where NanoCore malware is injected

Summary

The recent malspams have the same goal like the ones we investigated almost two years ago and that is to effectively hide the malicious executable from anti-malware and email scanners by abusing the file format of the “.zipx” attachment, which in this case is an Icon file with added surprises. In a slight twist, enclosing the executable into a RAR archive instead of a ZIP file, the content of the .zipx attachment can be extracted by another popular archiving tool, 7Zip. If the end-user uses 7Zip or WinRAR, the NanoCore malware could be installed onto the system, if the user decides to run and extract it. It all works because various archive utilities try their darndest to find something to unzip within files. You might even argue they try too hard!

The Trustwave Secure Email Gateway flagged the messages as malicious and detected this threat.

IOCs

Attachment:

NEW PURCHASE ORDER.pdf.zipx (480092 bytes) SHA1: DF46A893B51D8ADE0CCDEF7E375FB387E2560720
New Purchase Order.pdf (2).zipx (403050 bytes) SHA1: C93FBA54357E90235202F58DA1FEFF7AB1142F65

NanoCore RAT:

NEW PURCHASE ORDER.exe (635904 bytes) SHA1: E99F6B9BD787679666F8C54B9A834D6ACECFA622
New purchase order (3).exe (431104 bytes) SHA1: FD958C365B6BFA5EF34779831773EC92C041A5D5