[PX5]

No worries here, only respect, apologies for using profanity in the post, spec the emotions go the better of me this time, something about that human quality I cant seem to remove.

I spose if I dont get my focus back on work, it wont matter much anyways. :)

[Maniac]

SUPERAntiSpyware 4.42.1000 Final

Changelog:

Resolves issue with McAfee and scanning "hang" on 64-bit systems
Enhanced "smart definitions" system resulting in improved detection of certain threats
Updated TDSS Detection/Removal Technology
Updated scanning engine (speed improvements)

[LeastPrivilege]

I tried the latest SAS and it didnt work for me. It didn't even see it.

[Quads]

SAS won't detect TDL3, let alone cure, as previously stated somewhere here.

Quads

[Jaxryley]

Another sample.
dg.exe - 8/ 41 (19.5%) - MD5 : 8d8ae005b1d95e542a3369557febc2d8
http://www.virustotal.com/file-scan/rep ... 1282875340

dg.rar

Pass:
infected
(82.87 KiB) Downloaded 133 times

Prevx article on 64 bit:
http://www.prevx.com/blog/154/TDL-rootk ... -wild.html

[EP_X0FF]

Another sample.
dg.exe - 8/ 41 (19.5%) - MD5 : 8d8ae005b1d95e542a3369557febc2d8

This is classical TDL3+

[main]
version=3.273
quote=I felt like putting a bullet between the eyes of every panda that wouldn't screw to save it's species. I wanted to open the dump valves on oil tankers and smother all those french beaches I'd never see. I wanted to breathe smoke
botid=
affid=20787
subid=0
installdate=27.8.2010 4:15:52
builddate=27.8.2010 1:0:5
rnd=1993962763
[injector]
*=tdlcmd.dll
[tdlcmd]
servers=hxxps://nichtadden.in/;hxxps://91.212.226.67/;hxxps://li1i16b0.com/;hxxps://zz87jhfda88.com/;hxxps://n16fa53.com/;hxxps://01n02n4cx00.cc/;hxxps://lj1i16b0.com/
wspservers=hxxp://zl00zxcv1.com/;hxxp://zloozxcv1.com/;hxxp://71ha6dl01.com/;hxxp://axjau710h.com/;hxxp://rf9akjgh716zzl.com/;hxxp://dsg1tsga64aa17.com/;hxxp://l1i1e3e3oo8as0.com/;hxxp://7gafd33ja90a.com/;hxxp://n1mo661s6cx0.com/
popupservers=hxxp://clkh71yhks66.com/
version=3.941

[EP_X0FF]

I assume further improvements because this rootkit version is very easy to remove. And it is really buggy, I can't get real machines free from debuggers to work after infection, only after mbr recovery.

Rootkit is simply bugged

It works pretty fine on x64, system is bootable.

[EP_X0FF]

Okay, dropper works as expected on x64. To bypass direct disk access restriction this dropper operates with \Device\HarddiskX\DrX device and rewrites MBR with IOCTL_SCSI_PASS_THROUGH_DIRECT DeviceIoControl request and after this it do immediately ExitWindowsEx with Reboot flag set.
Quite simple stuff, nothing zero day unfortunately.

[Fabian Wosar]

In case someone wants to take a closer look at the dropper I have attached an unpacked memory dump for static analysis. As EP_X0FF already mentioned the Dropper uses ZwOpenFile/ZwDeviceIoControlFile to write directly to the disk.

[Fabian Wosar]

More droppers are popping up currently. Mostly they just vary in the way they are packed and the config. For example:
http://www.virustotal.com/file-scan/rep ... 1282900525

File dump report:

Code: Select all

Trying to detect TDL3 ...

Memory Region Size: 0x1000
Memory Protection: 0x40
Memory Type: 0x20000
Memory State: 0x1000

Found TDL-3 shell code inside process. TDL-3 is running. Injected DLL:
\\?\globalroot\device\00000b9b\7112b3f1\cmd.dll

\\?\globalroot\device\00000b9b\7112b3f1\cfg.ini ...Success! (CRC: 0x8810dc9e)
\\?\globalroot\device\00000b9b\7112b3f1\config.ini ...Failed! (Errorcode: 2)
\\?\globalroot\device\00000b9b\7112b3f1\ldr16 ...Success! (CRC: 0x25447618)
\\?\globalroot\device\00000b9b\7112b3f1\ldr32 ...Success! (CRC: 0xe5d8dfe4)
\\?\globalroot\device\00000b9b\7112b3f1\ldr64 ...Success! (CRC: 0xbbcecddc)
\\?\globalroot\device\00000b9b\7112b3f1\drv32 ...Success! (CRC: 0xaf6d3dc4)
\\?\globalroot\device\00000b9b\7112b3f1\drv64 ...Success! (CRC: 0xc81b5de9)
\\?\globalroot\device\00000b9b\7112b3f1\kdmf.tmp ...Failed! (Errorcode: 2)
\\?\globalroot\device\00000b9b\7112b3f1\bckfg.tmp ...Success! (CRC: 0xaf0608eb)
\\?\globalroot\device\00000b9b\7112b3f1\cmd.dll ...Success! (CRC: 0xa20eac86)
\\?\globalroot\device\00000b9b\7112b3f1\cmd64.dll ...Success! (CRC: 0x925ba29e)
\\?\globalroot\device\00000b9b\7112b3f1\mbr ...Success! (CRC: 0xd0e85ed0)
\\?\globalroot\device\00000b9b\7112b3f1\keywords ...Failed! (Errorcode: 2)

Config:

Code: Select all

[main]
version=0.02
aid=30136
sid=0
rnd=1788223648
[inject]
*=cmd.dll
* (x64)=cmd64.dll
[cmd]
srv=https://68b6b6b6.com/;https://61.61.20.132/;https://34jh7alm94.asia;https://61.61.20.135/;https://nyewrika.in/;https://rukkieanno.in/
wsrv=http://rudolfdisney.com/;http://crozybanner.com/;http://imagemonstar.com/;http://funimgpixson.com/;http://bunnylandisney.com/
psrv=http://cri71ki813ck.com/
version=0.11
bsh=62eb4acda396a529555436afc2d1c9cba44d2eef
delay=7200
csrv=http://lkckclckl1i1i.com/

If someone desperately needs more dropper samples, just drop me a PM or mail.