#MalwareMustDie - Fake Installer drops PUP Backdoor.
# 2014-05-02 13:06:40 | @unixfreaxjp
// Hint:
https://www.virustotal.com/en/ip-address/5.39.5.226/information/
http://urlquery.net/search.php?q=5.39.5.226&type=string&start=2011-06-25&end=2014-05-02&max=50
// URL:
http://dlp.procloudsvr3.com/4EHTX5KYU49ZDHwscT38XEJi6tq7n0jznJf_rmaMzCibzlRTvy7HyhYsHBZlm-hw1IqFSquT1VSezgSfwCwRbFwW5HHw-wnVSz5ya4ccE2K7zNB1mZd7QdfaiYCUPjs1
http://dlp.procloudsvr3.com/aOgRjb4gp2n4HvWFlVqTLrn6snO3Hn-ePTRjtgI7nAxFZ8uQclq757TRufvlW9QHAhmQO7UKeS2AGEPl9GHNDAT10sIVKmZt8A3mm-R3mdBtThveg8FktM4dkeNtaxZY
http://dlp.cloudsvr38.com/jmrRH5qz2zFU-p9rvlZnnzYC4-qW8Q-KMojSOpkPyZIgwB42YY9CTbV5rjQbnwawgPUmaDIuJ89DJ10cinqTiF9bnk3Kcvv8Aja2gsoF7xu-ChJ0GUAQQXasD3t5EiDe
http://dlp.cloudsvr36.com/A2c8U9C8ubRJZU3EAmGEMz39nAzmh17c9dj8lF4e1zyW4_rEYmKpBELXsRn_hb4o96UMobSYVh1FUD9FfpgRVyVMHoNpYAZAg_BRoB68qDnWK8_pflLMKCMQlv_6WxqF
http://dlp.cloudsvr36.com/0RbGL5gEYV2u6Y9bF5uhqOTUyINHr5OkHFGePCfE0OEyVOcbjLz4TKTof9Io3kRMIqr4Oht4ZqE8TDZWhN_Xq6svQjq041jo2cvo2WK8bleJ8omVAxmHFtPtYHxHa29F
// Fetch record...
--2014-05-02 12:43:07-- http://dlp.procloudsvr3.com/4EHTX5KYU49ZDHwscT38XEJi6tq7n0jznJf_rmaMzCibzlRTvy7HyhYsHBZlm-hw1IqFSquT1VSezgSfwCwRbFwW5HHw-wnVSz5ya4ccE2K7zNB1mZd7QdfaiYCUPjs1
Resolving dlp.procloudsvr3.com (dlp.procloudsvr3.com)... 178.32.29.116
Connecting to dlp.procloudsvr3.com (dlp.procloudsvr3.com)|178.32.29.116|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 499032 (487K) [application/octet-stream]
Saving to: 'Setup.exe'
2014-05-02 12:43:11 (208 KB/s) - 'Setup.exe' saved [499032/499032]
--2014-05-02 12:50:20-- http://dlp.procloudsvr3.com/aOgRjb4gp2n4HvWFlVqTLrn6snO3Hn-ePTRjtgI7nAxFZ8uQclq757TRufvlW9QHAhmQO7UKeS2AGEPl9GHNDAT10sIVKmZt8A3mm-R3mdBtThveg8FktM4dkeNtaxZY
Resolving dlp.procloudsvr3.com (dlp.procloudsvr3.com)... 5.39.40.131
Connecting to dlp.procloudsvr3.com (dlp.procloudsvr3.com)|5.39.40.131|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 499040 (487K) [application/octet-stream]
Saving to: 'Setup.exe'
2014-05-02 12:50:23 (229 KB/s) - 'Setup.exe' saved [499040/499040]
--2014-05-02 13:09:46-- http://dlp.cloudsvr38.com/jmrRH5qz2zFU-p9rvlZnnzYC4-qW8Q-KMojSOpkPyZIgwB42YY9CTbV5rjQbnwawgPUmaDIuJ89DJ10cinqTiF9bnk3Kcvv8Aja2gsoF7xu-ChJ0GUAQQXasD3t5EiDe
Resolving dlp.cloudsvr38.com (dlp.cloudsvr38.com)... 46.105.161.137
Connecting to dlp.cloudsvr38.com (dlp.cloudsvr38.com)|46.105.161.137|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 319832 (312K) [application/octet-stream]
Saving to: 'Setup.exe'
2014-05-02 13:09:48 (169 KB/s) - 'Setup.exe' saved [319832/319832]
// Debug
GET /4EHTX5KYU49ZDHwscT38XEJi6tq7n0jznJf_rmaMzCibzlRTvy7HyhYsHBZlm-hw1IqFSquT1VSezgSfwCwRbFwW5HHw-wnVSz5ya4ccE2K7zNB1mZd7QdfaiYCUPjs1 HTTP/1.1
Accept: */*
Host: dlp.procloudsvr3.com
Connection: Keep-Alive
HTTP request sent, awaiting response...
HTTP/1.1 200 OK
Server: nginx
Date: Fri, 02 May 2014 04:03:24 GMT
Content-Type: application/octet-stream
Content-Length: 499032
Connection: keep-alive
Vary: Accept-Language, Cookie
Content-Language: en
Content-Disposition: filename=Setup.exe
200 OK
Registered socket 3 for persistent reuse.
Length: 499032 (487K) [application/octet-stream]
Saving to: 'Setup.exe'
100%[====================>] 499,032 197KB/s in 2.5s
2014-05-02 13:03:27 (197 KB/s) - 'Setup.exe' saved [499032/499032]
// Full session:
--2014-05-02 13:06:38-- http://dlp.cloudsvr38.com/jmrRH5qz2zFU-p9rvlZnnzYC4-qW8Q-KMojSOpkPyZIgwB42YY9CTbV5rjQbnwawgPUmaDIuJ89DJ10cinqTiF9bnk3Kcvv8Aja2gsoF7xu-ChJ0GUAQQXasD3t5EiDe
Resolving dlp.cloudsvr38.com (dlp.cloudsvr38.com)... 54.200.252.181
Caching dlp.cloudsvr38.com => 54.200.252.181
Connecting to dlp.cloudsvr38.com (dlp.cloudsvr38.com)|54.200.252.181|:80... connected.
GET /jmrRH5qz2zFU-p9rvlZnnzYC4-qW8Q-KMojSOpkPyZIgwB42YY9CTbV5rjQbnwawgPUmaDIuJ89DJ10cinqTiF9bnk3Kcvv8Aja2gsoF7xu-ChJ0GUAQQXasD3t5EiDe HTTP/1.1
Accept: */*
Host: dlp.cloudsvr38.com
Connection: Keep-Alive
HTTP request sent, awaiting response...
HTTP/1.1 200 OK
Content-Disposition: filename=Setup.exe
Content-Language: en
Content-Type: application/octet-stream
Date: Fri, 02 May 2014 04:06:39 GMT
Server: nginx
Vary: Accept-Language, Cookie
Content-Length: 499032
Connection: keep-alive
200 OK
Length: 499032 (487K) [application/octet-stream]
Saving to: 'Setup.exe'
100%[=========>] 499,032 436KB/s in 1.1s
2014-05-02 13:06:40 (436 KB/s) - 'Setup.exe' saved [499032/499032]
// Cloud DNS
;; QUESTION SECTION:
;dlp.procloudsvr3.com. IN A
;; ANSWER SECTION:
dlp.procloudsvr3.com. 332 IN CNAME dlpr3.tgusrv.com.
dlpr3.tgusrv.com. 12 IN A 54.200.252.181
/* ↑Short TTL*/
// RoundRobin IP
$ while true; do dig +short dlpr3.tgusrv.com A; sleep 2; done
37.59.93.34
5.135.66.83
176.31.87.147
54.200.252.181
176.31.87.147
54.200.252.181
5.39.40.131
5.39.5.226
^C
// There are two download payloads:
Setup.exe
https://www.virustotal.com/en/file/92d8677c6a4e7508edd9f96a1cae539b324bd1d3a4894d242b0bef941f4c9c25/analysis/1399007797/
Setup2.exe
https://www.virustotal.com/en/file/ee41130e11711ccb480ca8377f130be1c114d40e2eba48d48acd4900e4b64ae7/analysis/1399007809/
// And both are dropping this PE:
Android.exe / Apk_Setup.exe
https://www.virustotal.com/en/file/5d4c7345e36592ec207055ca7eb51c8805cddea9e2b70eb4b7ba2966678e7bc9/analysis/1399007997/
//Verdict Evidence:
https://lh6.googleusercontent.com/-F72SeYsUzvY/U2MxkxIvGxI/AAAAAAAAPjw/7lqFjd-whGo/s1024/A1000101.png
https://lh5.googleusercontent.com/-1kLFi8UaZh8/U2Mxk7fi4ZI/AAAAAAAAPjs/_dEMPrSe_E4/s1024/A2000101.png
// Which is having these badness:
// drops
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nso2.tmp (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\android\android.exe (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\android\android.exe.config (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\android\Newtonsoft.Json.dll (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\android\SQLite.Interop.dll (successful)
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\android\System.Data.SQLite.dll (successful)
// Spawn process of its own & daemonized..
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\android\android.exe (successful)
https://jbxcloud.joesecurity.org/index.php/analysis/43101/0/html
// Loading config for HTTP communication (backdoor)
<?xml version="1.0"?>
<configuration>
<appSettings>
<add key="UseElevatedPermissions" value="0" />
</appSettings>
<system.net>
<settings>
<httpWebRequest useUnsafeHeaderParsing="true"/>
</settings>
</system.net>
<system.web>
<httpRuntime maxRequestLength="19000"/>
<webServices>
<protocols>
<add name="HttpGet"/>
<add name="HttpPost"/>
</protocols>
</webServices>
</system.web>
<startup useLegacyV2RuntimeActivationPolicy="true">
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0,Profile=Client"/>
<supportedRuntime version="v2.0.50727"/>
</startup>
<runtime>
<NetFx40_LegacySecurityPolicy enabled="true"/>
</runtime>
</configuration>
---
#MalwareMustdie!
Comments