[Xylitol]

Citadel 1.3.5.1 targeting wellsfargo.com domains *again*
In attach config and decoded + plugins and sample.

Code: Select all

Drop: hxtp://pizdecnujzno.ru/ci/stuk.php
Update:
hxtp://programcam.ru/ci/file.php|file=config.bin
hxtp://seantit.ru/ci/file.php|file=config.bin
hxtp://ochengorit.ru/ci/file.php|file=config.dll
hxtp://pizdecnujzno.ru/ci/file.php|file=config.dll
Key: E3 CB 78 A2 67 ED D7 13 AF 76 12 78 02 84 54 FA
login key: 7114B0C95C94D1BD7E3E2CC9B6BF4BDE

[Xylitol]

Citadel 1.3.5.1 targeting wellsfargo.com domains *again*
In attach config and decoded + plugins and sample.

Code: Select all

Drop: hxtp://pauldomain.com/foam.php
Update:
hxtp://pauldomain.com/file.php|file=soft.exe
hxtp://reserve-host1/folder/file.php|file=config.bin (?!)
hxtp://reserve-host2/folder/file.php|file=config.bin (?!)
Key: EC 61 FA D8 34 37 3F 3B 69 96 37 2B 10 66 C6 05
login key: C1F20D2340B519056A7D89B7DF4B0FFF

[Xylitol]

Citadel 1.3.5.1 targeting wellsfargo.com domains *again*
In attach config and decoded + plugins and sample.

Code: Select all

Drop: hxtp://77.234.208.71/SOME/gate.php
Update:
hxtp://77.234.208.71/SOME/file.php|file=soft.exe
hxtp://184.82.235.213/SOME/file.php|file=config.dll
hxtp://panamadfrfrfirect.org/some/file.php|file=config.dll
Key: 7C BB 17 F9 7C 49 21 C6 F0 0B 55 4E ED 1F 4F F2
login key: C1F20D2340B519056A7D89B7DF4B0FFF

[tildedennis]

Xylitol,

Would you be up for writing a walk through on how you're extracting the RC4 and AES key from Citadel samples and decrypting the configs ?

Thanks much!

[EP_X0FF]

Xylitol,

Would you be up for writing a walk through on how you're extracting the RC4 and AES key from Citadel samples and decrypting the configs ?

Thanks much!

http://seifreed.es/docs/Citadel%20Troja ... rt_eng.pdf
page 17

[tildedennis]

The AhnLabs analysis is great, but I feel like it leaves some to be desired on the crypto. Doing my own reversing, the 2 AES functions map pretty closely to OpenSSL's AES_set_decrypt_key() and AES_decrypt() functions. Regardless of what I try though, I can't get the configs to decrypt via the openssl command line (openssl enc -aes-128-ecb -d -in config.dll -out decrypted -K 7CBB17F97C4921C6F00B554EED1F4FF2 -iv 0) (I take into account the post-AES XOR obfuscation). I also played with CBC mode (using the first 16 bytes of the config as the IV), even though I didn't see an IV being extracted/combined with the ciphertext in the code.

Are other researchers just dumping configs from a debugger or am I'm overlooking something? Has anyone been able to decrypt the configs via openssl command?

Thanks much!

[Xylitol]

a bit late this one have no webinject, only webfilter targeting france, sample come from botmaster 'Dahou'

Code: Select all

#*libertyreserve.com/*
#*banquepostale.com/*
#*banquepostale.fr/*
#*caisse-epargne.fr/*
#*bnpparibas.net/
#*societegenerale.fr/*
#*credit-agricole.fr/*
#*lcl.fr/*
#*axabanque.fr/*
#*groupama.fr/*

Code: Select all

Version 1.3.5.1
Key: A9 B6 0C E0 9E 1D CB EF 75 57 7F DA 13 B8 7B 25
Citadel login key: F5F4D5EBD5855E904AB8DB757D320604
Drop: http://vg-update.ru/Nqcrtm/rKM6Eg/6LmAUI/header.php
Infection: http://vg-update.ru/Nqcrtm/rKM6Eg/6LmAUI/file.php|file=great.exe
Config: http://vg-update.ru/Nqcrtm/rKM6Eg/6LmAUI/file.php|file=config-bin.dll

[Xylitol]

Solving old stuff

Citadel 1.3.5.1 Rain Edition sample. It have some anti-VM and anti-AVS functions, couldn't run it under Comodo and didn't try manually, maybe someone will do.

Code: Select all

Version 1.3.5.1
Key: 15 7E B5 8D CE DC BA E6 CB 39 84 F6 36 36 5C DB
Citadel login key: C1F20D2340B519056A7D89B7DF4B0FFF
Dead config: http://citab-test.tk/net/file.php|file=test.dat

---

zeus mode (maybe citadel)
cant decrypt config file

I don't think this is Citadel... not communicating like Cit.
And communicate with a WSO Shell (??!) hxxp://doshiamit.net/wp-content/plugins/widgets/blog.php?t=1
---

Some files (php/exe) dumped from Citadel 1.3.4.5 server


https://zeustracker.abuse.ch/monitor.ph ... orumin.net
There is also a bleeding life v2:

Code: Select all

hxxp://fastforumin.net:808/sp/statistics/login.php

Real gate:

Code: Select all

hxxp://5.9.62.149:50800/mainsession/gate.php

C&C:

Code: Select all

hxxp://5.9.62.149:50800/mainsession/cp.php

lulz:

Code: Select all

hxxp://5.9.62.149:50800/mainsession/install/
• [0] - Connecting to MySQL as 'joe'.
• [0] - Selecting DB 'joe_bot_db1'.
• [0] - Updating table 'botnet_list'.
• [0] - Creating table 'botnet_reports'.
• [0] - Updating table 'botnet_reports_120812'.
• [0] - Updating table 'botnet_reports_120813'.
• [0] - Updating table 'botnet_reports_120814'.
• [0] - Updating table 'botnet_reports_120815'.
• [0] - Updating table 'botnet_reports_120816'.
• [0] - Updating table 'botnet_reports_120817'.
• [0] - Updating table 'botnet_reports_120818'.
• [0] - Updating table 'botnet_reports_120819'.
• [0] - Updating table 'botnet_reports_120820'.
• [0] - Updating table 'botnet_reports_120821'.
• [0] - Updating table 'botnet_reports_120822'.
• [0] - Updating table 'botnet_reports_120823'.
• [0] - Updating table 'botnet_reports_120824'.
• [0] - Updating table 'botnet_reports_120825'.
• [0] - Updating table 'botnet_reports_120826'.
• [0] - Updating table 'botnet_reports_120827'.
• [0] - Updating table 'botnet_reports_120828'.
• [0] - Updating table 'botnet_reports_120829'.
• [0] - Updating table 'botnet_reports_120830'.
• [0] - Updating table 'botnet_reports_120831'.
• [0] - Updating table 'botnet_reports_120901'.
• [0] - Updating table 'botnet_reports_120902'.
• [0] - Updating table 'botnet_reports_120903'.
• [0] - Updating table 'botnet_reports_120904'.
• [0] - Updating table 'botnet_reports_120905'.
• [0] - Updating table 'botnet_reports_120906'.
• [0] - Updating table 'botnet_reports_120907'.
• [0] - Updating table 'botnet_reports_120908'.
• [0] - Updating table 'botnet_reports_120909'.
• [0] - Updating table 'botnet_reports_120910'.
• [0] - Updating table 'botnet_reports_120911'.
• [0] - Updating table 'botnet_reports_120912'.
• [0] - Updating table 'botnet_reports_120925'.
• [0] - Updating table 'botnet_reports_120926'.
• [0] - Updating table 'botnet_reports_120929'.
• [0] - Updating table 'botnet_reports_120930'.
• [0] - Updating table 'botnet_reports_121001'.
• [0] - Updating table 'botnet_reports_121002'.
• [0] - Updating table 'botnet_reports_121003'.
• [0] - Updating table 'botnet_reports_121004'.
• [0] - Updating table 'botnet_reports_121005'.
• [0] - Updating table 'botnet_reports_121006'.
• [0] - Updating table 'botnet_reports_121007'.
• [0] - Updating table 'botnet_reports_121011'.
• [0] - Updating table 'botnet_reports_121012'.
• [0] - Updating table 'botnet_reports_121013'.
• [0] - Updating table 'botnet_reports_121014'.
• [0] - Updating table 'botnet_reports_121015'.
• [0] - Updating table 'botnet_reports_121016'.
• [0] - Filling table 'ipv4toc'.
• [1] - Creating table 'ipv4toc'.
• [3] - Updating table 'cp_users'.
• [3] - Updating table 'botnet_scripts'.
• [3] - Updating table 'botnet_scripts_stat'.
• [3] - Updating table 'botnet_software_stat'.
• [3] - Updating table 'exe_updates'.
• [3] - Updating table 'exe_updates_crypter'.
• [3] - Updating table 'botnet_rep_domains'.
• [3] - Updating table 'botnet_rep_domainlogs'.
• [3] - Updating table 'accparse_rules'.
• [3] - Updating table 'accparse_accounts'.
• [3] - Updating table 'vnc_bot_connections'.
• [3] - Updating table 'botnet_rep_dedup'.
• [3] - Updating table 'jabber_messages'.
• [3] - Updating table 'botnet_rep_iframer'.
• [3] - Updating table 'botnet_rep_filehunter'.
• [3] - Updating table 'botnet_screenshots'.
• [3] - Updating table 'botnet_rep_favorites'.
• [3] - Updating table 'botnet_activity'.
• [3] - Creating folder '_reports102979970'.
• [3] - Writing config file
• [3] - Searching for the god particle...
• [3] - Creating folder 'system/data'.
• [3] - Creating folder 'public'.
-- Update complete! --

Code: Select all

Version: 1.3.4.5
Key: 95 CE CC E5 25 E2 5B 0B 0C 5E 12 A4 14 B8 9A 26
Login key: 13848FB885AC32D12CDEEB5FD78D1CB9
Drop: http://fastforumin.net:808/gameallodonline.php
Infection: http://fastforumin.net:808/file.php|file=bbbllasw.exe
Config: http://rezervniy-domain.ru/webserver/file.php|file=citadelconfig.bin

config decoded in attach.

[Xylitol]

Citab builder leaked (C1F20D2340B519056A7D89B7DF4B0FFF)
https://www.virustotal.com/en/file/1031 ... 373457354/
https://www.virustotal.com/en/file/f9e9 ... 373459345/
Malwarebytes: Hacktool.Citadel.Builder
epic detection

[rough_spear]

Hi All, :D

Citadel 1.3.4.5 builder+Panel and User Manual.

I know version is older than what xylitol had posted earlier, but i m posting it along with user Manual.

This manual includes information regarding bot(Zeus) and its commands.

How to setup and configure the servers(http and mysql).

Regards,

rough_spear. ;)