First of al thank's forXylit0l for inviting mehere, I(ll try to contribute the best I can. And to all of you who share for malware research in KernelMode, respect!
The new updates was detected in on Cridex/PWS infector I follow. I was writing it the analysis as details as possible in MalwareMustDie post here:
http://malwaremustdie.blogspot.jp/2013/ ... prove.html , but I will share here the deeper details. Here we go.
Source of infection is same, spam leads to redirector to BHEK, they use 2.1, kinda dulll to see same scheme over and over again. You'll see the spam used for this infection here:
http://blog.dynamoo.com/2013/01/ups-spa ... omaru.html
The redirector of this i.e.: h00p://
www.tounichi-g.co.jp/info.htm
All of for landing page here: h00p://eziponoma.ru:8080/forum/links/column.php
Grabbed all samples and share you exploits and payload used as per I pasted here:
http://pastebin.com/raw.php?i=St6E6Rjr
(was too long to write it here)
My point is, in this Cridex infection the below NEW development was detected:
Code: Select all1. The usage of the encryption is getting deeper, they encrypted the data
up to the memory level now.
2. The attempt to avoid capture also detected, the cridex was running about
3 sec & following by the KB*.exe which runs for about less than 5mins.
The cmd was executed in a glimpse, and see my PCAP & file capture data
to view the time/speed of this new things. All is just to prevent someone
making a post like this :-)
3. The attempt to (need to follow this further) change system internals
was detected, system files in my TestPC got so corrupted & won't restart.
The possibility of the bootkit made this becoming very interesting &
if the theory is right, they just increased their cybercrime level
from stealer to ransom ＜ need the to dig-in SERIOUSLY!
4. More profile capture detected & more sent data template seen.
Thus now they have the attachment file API code in POST session
5. The desktop data was captured and saved in registry (NEW)
1. How far the encryption go? Far!
For the Cridex sample If you unpack the sample (in my case is about.exe) you'll see what the bad guys allow you to see, thus there are trace of the garbled parts which still show the encrypted strings that they don't allow us to see.
i.e. See the part of the unpack file of the Cridex:
i.e.2. See the part of the unpack binary of "Fareit"/KB00777165.exe:
The marked green one shows the same pattern of encryption, while the yellow marked one is supposed to be password to be used after decrypted. Moreover the sent data is having the same pattern:
2. The speed in execution
It was calibrated to execute stuff in faster way, other than the logs of file I/O I captured in the MalwareMustDie blog, you'll see the timeline overall log I upload for the explorer.exe during the infection:
http://www.mediafire.com/?cojctz3hcubecoe
I breakdown the process ID for this log too as per below table
PID 2116 - about.exe
http://pastebin.com/raw.php?i=GGFyU3GH
PID 2152 - cmd.exe
http://pastebin.com/raw.php?i=4GgvdGSU
PID 4128 - exp%n.tmp.exe
http://pastebin.com/raw.php?i=tdYAz3k8
PID 1896 - KB00777165.exe
http://pastebin.com/raw.php?i=xXTs3Nwz
3. Start to detect system root & (maybe) the changes in OS system internals?
I happened to spot the registry blob made by this malware in the below section:
Code: Select allHKU\S-1-5-21-1214440339-926492609-1644491937-1003\Software\Sysinternals\
Process Monitor\FilterRules: 01 13 00 00 00 75 9C 00 00 00 00 00 00 00 18 00 00
00 50 00 72 00 6F 00 63 00 6D 00 6F 00 6E 00 2E 00 65 00 78 00 65 00 00
00 00 00 00 00 00 00 00 00 75 9C 00 00 00 00 00 00 00 0E 00 00 00 53 00
79 00 73 00 74 00 65 00 6D 00 00 00 00 00 00 00 00 00 00 00 77 9C 00 00
:
72 00 65 00 00 00 00 00 00 00 00 00 00 00 87 9C 00 00 05 00 00 00 00 10
00 00 00 24 00 55 00 70 00 43 00 61 00 73 00 65 00 00 00 00 00 00 00 00
00 00 00 87 9C 00 00 06 00 00 00 00 10 00 00 00 24 00 45 00 78 00 74 00
65 00 6E 00 64 00 00 00 00 00 00 00 00 00 00 00 92 9C 00 00 00 00 00 00
00 14 00 00 00 50 00 72 00 6F 00 66 00 69 00 6C 00 69 00 6E 00 67 00 00
00 00 00 00 00 00 00 00 00
With this blob actually looks like this:
↑The system root, its information was clearly stated there. The question is why?
and again I cannot even restart my TestPC after reboot, which showing the system files has changed.
This is something new, need to be seek deeper and further.
4. Captures
The captured data functionality was also saved in the registry, I wonder why the did this,
found the below blobs:
Code: Select allHKU\S-1-5-21-1214440339-926492609-1644491937-1003\Software\Microsoft\Windows\
Shell\Bags\1\Desktop\ItemPos1024x768(1): 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 17 00 00 00 A6 00 00 00 14 00 1F 48
BA 8F 0D 45 25 AD D0 11 98 A8 08 00 36 1B 11 03 17 00 00 00 02 00
00 00 14 00 1F 50 E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D
17 00 00 00 54 00 00 00 14 00 1F 58 60 2C 8D 20 EA 3A 69 10 A2 D7
:
01 00 3A 42 48 4D 20 00 61 62 6F 75 74 33 2E 65 78 65 00 00 2C 00
03 00 04 00 EF BE 3A 42 E5 5B 39 42 00 78 14 00 00 00 61 00 62 00
6F 00 75 00 74 00 33 00 2E 00 65 00 78 00 65 00 00 00 1A 00 B3 00
00 00 02 00 00 00 00 00 00 00
Which means:
↑Those are the shortcuts data I used in the desktop of my TestPC actually. They snapshot'ed it.
Furthermore, while reversing about.exe I found:
Code: Select all0x001AB8 Content-Disposition
0x001ACD name="
0x001AD5 filename="
and
Code: Select all0x001CAE Content-Disposition: attachment; filename=%S
↑This part is new, at least for me. looks the uploader of file was in the logic now.
Seeking this further, if you see the config of fareit I recoded it nicely to see here-->>
http://pastebin.com/H9kY7bbX
...will explain its correlation to phishing functionality.
During the detection traffic communication, I found only view hostnames receiving the POST requested, which are:
Mostly the other server wasn't receiving the requets well:
I uploaded latest sample here. and for the unpack Crudex, Horgh looks uploaded it already in VT here:
https://www.virustotal.com/file/a8de1b6 ... /analysis/
For the analysis data, captures and etc, I am not promoting anything but to centralized the data please grab it from malwaremustdie post of this case here
http://malwaremustdie.blogspot.jp/2013/ ... prove.html
PS: please add information in reply, will be thankful if you also add / paste the evidence to share.
Kindly regards! @unixfreaxjp
#MalwareMustDie!
