ThreatLabz reports an update to the Ares banking trojan that adds a domain generation algorithm (DGA) mirroring Qakbot’s DGA, likely to extend infection lifetimes and monetize compromised systems. The update includes C2 fallback via DGA, web inject testing, and a modified API hashing approach to evade signatures.
#AresBankingTrojan #QakbotDGA
#AresBankingTrojan #QakbotDGA
Keypoints
- The Ares banking trojan received a DGA-based fallback mechanism in August 2022 to contact C2 when primary channels fail.
- The Ares DGA implementation is virtually identical to Qakbot’s defunct DGA, though not tied to the same codebase.
- The DGA uses a hardcoded seed and the current date to generate 50 domains per interval (150 domains per month), relying on the daytime protocol to obtain the date from NIST time servers.
- Reverse engineering suggests Ares reimplemented the DGA rather than stemming from Qakbot’s source code; ThreatLabz even modified a Python-based Qakbot DGA to produce Ares domains.
- Ares is active against financial institutions in Mexico, with BBVA Mexico appearing in hardcoded web inject configurations.
- New features include web inject testing, a dynamic API hash algorithm, and CRC64-based hashing changes to map NTDLL API names, aiding evasion of static detections.
- Threat activity includes improvements to resilience and inference of forthcoming attacks leveraging the new capabilities.
MITRE Techniques
- [T1071.001] Web Protocols – The malware uses one or more hardcoded URLs as the primary C2 channel; and, if C2 channels are unreachable, generates domains via a DGA to reach C2. “one or more hardcoded URLs that are used as the primary C2 channel” and “Ares will generate domains using a DGA.”
- [T1583] Acquire Infrastructure – The DGA-driven domain generation enables deployment of new C2 servers and regain control of infected systems if the primary servers are taken down. “The developer of Ares continues… to easily deploy new C2 servers and regain control of infected systems if the primary servers are taken down.”
Indicators of Compromise
- [SHA256] Ares DGA variant – baae5bbaf2decf7af9b22c4d10f66c7c77c9ebc7b73476f7cbe449d2bba97ed9
- [SHA256] Ares DGA variant – 31ed2ee200da9a35ab3868b3d2977e6b18bc49772d39c27d57a53b49b6e6fa4a
- [URL] Hardcoded C2 URL – http://tomolina[.]top/panel/connect.php
- [Domain] Example Ares DGA domains (August 29, 2022) – truktkqrhbqid.com, afthptslohtxez.info, and 48 more domains