Pony/Fareit Credential Stealer: PK11SDR_Decrypt Firefox NSS, Chrome Login Data, POP3/IMAP/SMTP Mail Hasati

Genel Bakis

Bu ornek, 64KB buyuklugunde son derece kompakt bir credential stealer'dir. Google Chrome, Chromium, Mozilla Firefox, SeaMonkey ve Thunderbird'den sifreleri cekerken ayni zamanda POP3, IMAP ve SMTP mail hesap bilgilerini de hasatlayan bu malware, Pony/Fareit ailesine benzer ozellikler gostermektedir. Firefox NSS PK11SDR_Decrypt API'si ile sifreleri cozerken SQL ile moz_logins tablosunu sorgular.

Teknik Analiz

Tarayici Hedefleri

• Google Chrome: %s\Google\Chrome\User Data\Default\Login Data
• Chromium: %s\Chromium\User Data\Default\Login Data
• Mozilla Firefox: %s\Mozilla\Firefox\profiles.ini, select * from moz_logins
• Mozilla SeaMonkey: %s\Mozilla\SeaMonkey\profiles.ini
• Thunderbird: %s\Thunderbird\profiles.ini

Firefox NSS Sifresi Cozme

PK11SDR_Decrypt    <- Firefox master password decrypt
PK11_Authenticate  <- authenticate to NSS slot
PK11_GetInternalKeySlot
PK11_FreeSlot
mozsqlite3.dll     <- Firefox SQLite driver
select * from moz_logins  <- saved passwords query

Mail Hesap Hasati

• POP3: POP3 User, POP3 Server, POP3 Password
• IMAP: IMAP User, IMAP Server, IMAP Password
• SMTP: SMTP User, SMTP Server, SMTP Password
• HTTP: HTTP Password (temel kimlik dogrulama)
• IE IntelliForms: Software\Microsoft\Internet Explorer\IntelliForms\Storage2

C2 Iletisim

• FCONNECT %s:%d HTTP/1.0 — HTTP CONNECT proxy tuneli ile C2
• Connection: close
• WSAStartup, connect, closesocket — raw socket C2

Teknik Ozellikler

IOC Ozeti

• SHA256: e4b2cfa2a3d348c8a316186ad65d0554804e9c87d7dc4a9d85a714ab9e9f037f