We recently encountered a stealthy malware that employs extended sleep calls to evade automated analysis systems capturing its behavior. It further makes use of the fast flux technique in order to hide the identity of the attacker controlling it. We call it Trojan Nap. The purpose of this article is to share the technical details of the execution steps by Nap.


Figure 1. Malicious domain and the downloadable executable
When the malicious code gets executed, as shown in Figure 1, it sends an HTTP request to the domain "wowrizep.ru" requesting the file "newbos2.exe."


Figure 2. Code of NAP making sleep call
After this, per the code in Figure 2, a call to SleepEx() with 0x0927C0 as its timeout parameter and the alterable value set to false are made. The value 0x0927C0 resolves to 600,000 milliseconds or, in other words, resolved to a 10-minute timeout. By setting the alterable to false, the malware ensures that the function does not return until the timeout period has elapsed. Since automated analysis systems are configured to execute a sample within a specified time frame, by executing a sleep call with a long timeout, Nap can prevent an automated analysis system from capturing its malicious behavior. Besides making a call to the function SleepEx(), the code also makes a call to the undocumented API NtDelayExecution() for performing sleep.

When the code of Trojan Nap is executed in a controlled environment, the behavior is pretty much the same as when it was observed executing the code in a debugger. As shown in Figure 3, the DNS request is sent to the domains wowrizep.ru and cagremub.ru.


Figure 3. DNS request generated for the domains.
After receiving the DNS reply, a GET request is sent to the domain to fetch the newbos2.exe file as shown in Figure 4.


Figure 4. GET request generated by the NAP
The two domains, "wowrizep.ru" and "cagremub.ru," appear to be a part of the fast flux network. Normally, fast flux networks are used when the attacker wants to be extra careful to hide their identity. In contrast to a typical fast flux setup where multiple IPs are returned in a DNS response, this one returns a single IP, which looks like another attempt to appear normal. As shown in Figure 5, when the domain is resolved multiple times (10 seconds apart), each time the domain's resolution resulted in a different IP. The IPs are most probably zombies acting as front-end flux agents giving cover to the actual bot herder.


Figure 5. Resolution of the domains>
Table 1 shows some of the IPs for the domain wowrizeep.ru. These IPs are spread across the globe. Almost each IP is in a different country.


Table 1. Resolution of the domain wowrizep.ru
As shown in Figure 6, a very low value of TTL (0) ensures that neither the intermediate DNS servers nor the end host caches the DNS/IP mapping. This way each time when the domain is contacted by malware, it will be a new DNS lookup and the attacker can keep on providing new IPs.


Figure 6. TTL value for the domain wowrizep.ru
When the file newbos2.exe is downloaded from the domain wowrizep.ru and is executed, it adds itself in the registry key.

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Run\"SonyAgent"=c:\newbos2.exe

The change to the registry key \CurrentVersion\Run ensures that the code gets executed each time when the computer is booted. It also makes use of the function RegOpenKeyExW() to check for the presence of the registry key SOFTWARE\Far\Plugins\FTP\Hosts.


Figure 7. Malicious code opening FTP registry keys
After the first execution the downloaded code resets the permission to hide itself and opens high TCP ports for listening. Some of the ports that we have observed are 49163, 49172, and 49175. It then communicates to the external domains. Some of the domains to which the communication goes are shown in Table 2.


Table 2. Communication by downloader going to the external domain
To summarize, Nap is a malicious downloader. It uses the fast flux technique to hide the location/identity of the attacker. Coincidently, from the NYT report, the malware used in the recent NYT breach also used a similar hiding technique where the attacker used the university computers as front-end agents and kept switching from one IP to another. Nap employs extended sleep calls, an anti-VM technique to avoid automated analysis systems capturing its behavior.

Using a long sleep is a classic technique used to stay under the radar of an automated analysis system. In addition to extended sleep calls to evade automated analysis, we have observed many techniques, like hooking to a mouse, that are actively being employed by the advanced active malwares.


Authors: FireEye security researchers Abhishek Singh and Ali Islam.