[unixfreaxjp]

It has the botnet communication with HTTP & SSL, the SSL is for the handshake...

avast! Blog / Mr. Ivan Jedek made a thorough payload binary analysis which is revealing the hidden C&C server information in the Cutwail payload binary.
Please check out his good reversing analysis in here: http://blog.avast.com/2013/06/25/15507/#more-15507
It worth to read, and I learned a lot by this post.

[Win32:Virut]

Hi, could someone tell me what is it?

Is it Pushdo? (Kaspersky detected some similar samples as Backdoor.Win32.Pushdo)

VT: https://www.virustotal.com/en/file/a8f0 ... 379954996/

Thanks.

[forty-six]

I believe so:

0x12e148 (13): smtp.live.com
0x160334 (38): smtp.mail.yahoo.com
0x161740 (24): smtp.sbcglobal.yahoo.com
0x1619fc (26): smtp.live.com
0x1621ac (48): smtp.sbcglobal.yahoo.com
0x18b93c (48): smtp.sbcglobal.yahoo.com
0x1a1544 (48): smtp.sbcglobal.yahoo.com
0xb3f894 (19): smtp.mail.yahoo.com
0x40065c4 (19): smtp.compuserve.com
0x40065ec (18): smtp.directcon.net
0x4006600 (24): smtp.sbcglobal.yahoo.com
0x400661c (19): smtp.mail.yahoo.com
0x4006630 (13): smtp.live.com
0x89062d9 (19): smtp.compuserve.com
0x8906301 (18): smtp.directcon.net
0x8906315 (24): smtp.sbcglobal.yahoo.com
0x8906331 (19): smtp.mail.yahoo.com
0x8906345 (13): smtp.live.com

[Horgh]

Is it Pushdo?

MS says TrojanDownloader:Win32/Cutwail.BS on my shitty dump, it behaves like it, so yeah pushdo (even if i doubt it's the .BS variant, I don't remember it looked like this).

The file is easy to unpack : shit -> UPX packed MZ -> final binary ; call eax to go to the newly allocated zone each time.
You have the classic stuff in the cutwail binary, I gave it a quick look, like dynamic apis resolution, traffic encryption via crypto apis, and obviously spamming. The requests contains informations on the victim computer, crypted, and sent to hacked (?) websites (cbsprinting.com.au / naijagurus.com / lockerlookz.com / upsilon89.com / agence-des-druides.com) in the usual manner. I haven't took a look further in the spamming process.

[GMax]

unpacked file

[Win32:Virut]

Thanks guys, here's another sample of it.

[patriq]

This url was in the cutwail.7z archive..posted earlier.

Code: Select all

hxxp://173.237.198.42/closest/i9jfuhioejskveohnuojfir.php

more interesting items on this IP

Blackhole EK (no bhadmin.php or front end that I see)

Code: Select all

hxxp://173.237.198.42/channels/templates/

Samples pulled from

Code: Select all

hxxp://173.237.198.42/least/
hxxp://173.237.198.42/mix/ (some Jar files in here)

attached (ZeroAccess, etc) - pretty low detection rates.

Code: Select all

834af630ca797db828560b20ff215df3
12a2041b21d6a4542fb6402bcbb2c19f
3dd5efcc8a520c807d40c2ef0e82d155
a00ca295a954e432e041d0e60aaf5ac8
cb37e5b89370b7b7d4ac257ede6ecdbe
26915f4c1750735e4ad82896f9e830a2

[Win32:Virut]

Another one

https://www.virustotal.com/en/file/8916 ... 380741891/

[unixfreaxjp]

Any recent sample of PushDo / Cutwail please friends?
Looks like their email template is changing I wonder why..
With thanks in advance, era;;y appreciated the share beforehand.

Rick of MalwareMustDie

[Cody Johnston]

Here you go:

MD5: 813d4a1b0e3bf81a9b5706ef832df4c3

https://malwr.com/analysis/NDc4MmI0ZjU4 ... czNjVjNjQ/