[NoSense]

Hi to all,
I want to share with you guys this piece of code RCEd from the chinese APT known as "NetTraveler" or "TravNet". Hope this knowledge will somehow be useful and interesting to you. The code isn't very complicated nor advanced, it is basically C code with a few C++ implementations.



Google Code project:
https://code.google.com/p/open-nettraveler/

GIT command:

Code: Select all

git clone https://code.google.com/p/open-nettraveler/

Kaspersky reports:
http://kasperskycontenthub.com/wp-conte ... -final.pdf
http://securelist.com/blog/research/359 ... e-victims/
http://www.kaspersky.com/about/news/vir ... new_tricks

Kaspersky victims map:


Malware samples:
http://www.kernelmode.info/forum/viewto ... =16&t=2757

More about CVE-2012-0158:
https://securelist.com/analysis/publica ... 8-exploit/

More about CVE-2010-3333:
http://blogs.technet.com/b/mmpc/archive ... 0-087.aspx

Good luck!

[SomeUnusedName]

// Copyright 2015 Christian Roggia. All rights reserved.

on reverse-engineered malware

[EP_X0FF]

// Copyright 2015 Christian Roggia. All rights reserved.

on reverse-engineered malware

Why not? I doubt even 50% of this C++ is copy-paste from IDA.

[fade]

I doubt the original author is going to complain ;)