A forum for reverse engineering, OS internals and malware analysis 

Plugx

Forum for analysis and discussion about malware.

Malware which uses signed McAfee executable to start

 #18995  by Dmitry Varshavsky
 Thu Apr 18, 2013 4:39 pm
Found today.
mw2.png
mw2.png (36.03 KiB) Viewed 730 times
mw3.png
mw3.png (48.51 KiB) Viewed 730 times
Drops legitimate McAfee binary to C:\ProgramData\MC\, also creates 2 files - mcutil.dll and mcutil.dll.url.
mw1.png
mw1.png (8.77 KiB) Viewed 730 times
First one - simple proxy, written in MSVC ( non-packed, non-crypted ) which loads second file on DLL_PROCESS_ATTACH and transfer an execution to it. Second file - raw crypted binary file ( not PE, at least loader ). Didn't bother myself with decryption, but seems to be pretty easy to unpack.
Creates remote threads in svchost.exe and msiexec.exe ( no dll mappings )

Does anyone know about this ?

UPD: Did the unpack. Russian keylogger with debug output :D Unpacked image scan here
Last edited by Dmitry Varshavsky on Thu Apr 18, 2013 4:59 pm, edited 1 time in total.
 Return to “Malware”