Cybersecurity researchers have disclosed details about a new
malware family that relies on the Common Log File System (CLFS[1]) to hide a second-stage
payload in registry transaction files in an attempt to evade
detection mechanisms.
FireEye’s Mandiant Advanced Practices team, which made the
discovery, dubbed the malware PRIVATELOG, and its installer,
STASHLOG. Specifics about the identities of the threat actor
or their motives remain unclear.
Although the malware is yet to be detected in real-world attacks
aimed at customer environments or be spotted launching any
second-stage payloads, Mandiant suspects that PRIVATELOG could
still be in development, the work of a researcher, or deployed as
part of a highly targeted activity.
CLFS is a general-purpose logging subsystem in Windows that’s
accessible to both kernel-mode as well as user-mode applications
such as database systems, OLTP systems, messaging clients, and
network event management systems for building and sharing
high-performance transaction logs.
“Because the file format is not widely used or documented, there
are no available tools that can parse CLFS log files,” Mandiant
researchers explained[2]
in a write-up published this week. “This provides attackers with an
opportunity to hide their data as log records in a convenient way,
because these are accessible through API functions.”
PRIVATELOG and STASHLOG come with capabilities that allow the
malicious software to linger on infected devices and avoid
detection, including the use of obfuscated strings and control flow
techniques that are expressly designed to make static analysis
cumbersome. What’s more, the STASHLOG installer accepts a
next-stage payload as an argument, the contents of which are
subsequently stashed in a specific CLFS log file.
Fashioned as an un-obfuscated 64-bit DLL named “prntvpt.dll,”
PRIVATELOG, in contrast, leverages a technique called DLL search order hijacking[3] in order to load the
malicious library when it is called by a victim program, in this
case, a service called “PrintNotify.”
“Similarly to STASHLOG, PRIVATELOG starts by enumerating *.BLF
files in the default user’s profile directory and uses the .BLF
file with the oldest creation date timestamp,” the researchers
noted, before using it to decrypt and store the second-stage
payload.
Mandiant recommends that organizations apply YARA rules to scan
internal networks for signs of malware and watch out for potential
Indicators of Compromise (IoCs) in “process”, “imageload” or
“filewrite” events associated with endpoint detection and response
(EDR) system logs.