A forum for reverse engineering, OS internals and malware analysis 

upass Kit (alias Worm:Win32/Rombrast)

Forum for analysis and discussion about malware.

Re: upass Kit malware sample : antivm

 #14462  by EP_X0FF
 Fri Jul 06, 2012 3:07 am
What kind of antivm you found inside? As for me it is primitive mass injector with mass installed ring3 hooks it uses for hiding, including hiding copy of explorer.exe
[1184]explorer.exe-->ntdll.dll-->NtDeleteValueKey, Type: Inline - RelativeJump 0x7C90D250-->01EF429C [unknown_code_page]
[1184]explorer.exe-->ntdll.dll-->NtEnumerateValueKey, Type: Inline - RelativeJump 0x7C90D2D0-->01EF4750 [unknown_code_page]
[1184]explorer.exe-->ntdll.dll-->NtOpenProcess, Type: Inline - RelativeJump 0x7C90D5E0-->01EF41D3 [unknown_code_page]
[1184]explorer.exe-->ntdll.dll-->NtQueryDirectoryFile, Type: Inline - RelativeJump 0x7C90D750-->01EF47E2 [unknown_code_page]
[1184]explorer.exe-->ntdll.dll-->NtQuerySystemInformation, Type: Inline - RelativeJump 0x7C90D910-->01EF44B0 [unknown_code_page]
[1184]explorer.exe-->ntdll.dll-->NtResumeThread, Type: Inline - RelativeJump 0x7C90DB20-->01EF41FE [unknown_code_page]
[1184]explorer.exe-->ntdll.dll-->NtSetInformationFile, Type: Inline - RelativeJump 0x7C90DC40-->01EF4518 [unknown_code_page]
[1184]explorer.exe-->ntdll.dll-->NtSetValueKey, Type: Inline - RelativeJump 0x7C90DDB0-->01EF437D [unknown_code_page]
[1184]explorer.exe-->ntdll.dll-->NtWriteFile, Type: Inline - RelativeJump 0x7C90DF60-->01EF45E4 [unknown_code_page]
Code: Select all
7C90D2D0:    E97B745085                jmp 01E14750h
7C90D2D5:    BA0003FE7F                mov edx, 7FFE0300h
7C90D2DA:    FF12                      call [edx]
7C90D2DC:    C21800                    retn 0018h
Boring crap, SpyEye was better.
Code: Select all
GetVolumeInformationW(&RootPathName, 0, 0, &VolumeSerialNumber, 0, 0, 0, 0);
if ( VolumeSerialNumber == 0xCD1A40 || sub_402999() == 1 )
{
      MessageBoxA(0, "Think with your dipstick, Jimmy!", "ERROR_BRAIN_TOO_SMALL", 0x10u);
      ExitProcess('dumb');
}
 Return to “Malware”