rough_spear wrote:Hi All, :DOh, no...Bublik it's not Bubnix or Necurs, it's an absolutely different malware.
Necurs rootkit aka Bubik/Bubnix.
Dropper -
...
rough_spear.
A forum for reverse engineering, OS internals and malware analysis
rkhunter wrote:But this malware puts it's driver in Boot Bus Extender driver group.BTW which malware is this?rough_spear wrote:Hi All, :DOh, no...Bublik it's not Bubnix or Necurs, it's an absolutely different malware.
Necurs rootkit aka Bubik/Bubnix.
Dropper -
...
rough_spear.
rough_spear wrote:...it's Necurs, but not a Bublik. And btw, why you think that Necurs is a Bubnix?rkhunter wrote:But this malware puts it's driver in Boot Bus Extender driver group.BTW which malware is this?rough_spear wrote:Hi All, :DOh, no...Bublik it's not Bubnix or Necurs, it's an absolutely different malware.
Necurs rootkit aka Bubik/Bubnix.
Dropper -
...
rough_spear.
Bublik is a data stealing trojan, Bubnix is usually Rustock (however this is generic name describing different families of malware that uses drivers to block/prevent removal) and Necurs is not rootkit but driver agent - part of FakeAV "self-protection". Posts moved.
Ring0 - the source of inspiration
EP_X0FF wrote:Bublik is a data stealing trojan, Bubnix is usually Rustock (however this is generic name describing different families of malware that uses drivers to block/prevent removal) and Necurs is not rootkit but driver agent - part of FakeAV "self-protection". Posts moved.Thanks EP_X0FF,
That's really perfect explanation.
Fresh Sample. One Change:
Drops <random> exe in %userprofile% (reg entries point to it - located in Necurs.log)
Included GMER log of reg entries as well as dropper and sys file. Both dropper and sys file have been renamed from original, original names located in Necurs.log file.
VT 7/43 for dropper:
https://www.virustotal.com/file/607a516 ... /analysis/
Drops <random> exe in %userprofile% (reg entries point to it - located in Necurs.log)
Included GMER log of reg entries as well as dropper and sys file. Both dropper and sys file have been renamed from original, original names located in Necurs.log file.
VT 7/43 for dropper:
https://www.virustotal.com/file/607a516 ... /analysis/
Attachments
Password: infected
(83.61 KiB) Downloaded 147 times
(83.61 KiB) Downloaded 147 times
Active Necurs dropper in last few days:
hxxp://209.236.67.163/5101fcf84/43ggewvefbwerg
https://www.virustotal.com/file/461b890 ... /analysis/
hxxp://209.236.67.163/5101fcf84/43ggewvefbwerg
https://www.virustotal.com/file/461b890 ... /analysis/
Attachments
password: infected
(61.47 KiB) Downloaded 145 times
(61.47 KiB) Downloaded 145 times
I found this on a system, very interesting and runs as a service on the target system. Was unable to kill the PID using all methods of force I knew (TerminateProcess, terminate threads, closing handles, WM_DEstroy, attaching debugger and then killing it) It prevents the target user from launching new devices on the system and its root dir in C:\Windows\Installer is untouchable. Defeated by removing registry key from windows repair.
* Enables driver test signing mode
* installs two drivers and makes keys under HKLM\System\CurrentControlSet****\Services\
* Has target of syshost.exe in C:\windows\installer\{ }\
* Removes Windows Update related services including bits\wuauserv
* prevents loading of new drivers and continually closes handles to its files and keys
* Enables driver test signing mode
* installs two drivers and makes keys under HKLM\System\CurrentControlSet****\Services\
* Has target of syshost.exe in C:\windows\installer\{ }\
* Removes Windows Update related services including bits\wuauserv
* prevents loading of new drivers and continually closes handles to its files and keys
Attachments
infected
(65.24 KiB) Downloaded 103 times
(65.24 KiB) Downloaded 103 times
infected
(66.71 KiB) Downloaded 109 times
(66.71 KiB) Downloaded 109 times
Last edited by RageMachine on Fri Dec 07, 2012 12:19 am, edited 3 times in total.
hi
its Necurs. Try TDSS Killer, under change parameters, check all boxes and let it run, at first i would take the action step, so you can check the log from user.
its Necurs. Try TDSS Killer, under change parameters, check all boxes and let it run, at first i would take the action step, so you can check the log from user.