[Kafeine]

Cf : http://www.virusradar.com/en/Win32_Bedep.A/description

http://malware.dontneedcoffee.com/2014/ ... eless.html

and this :



Here are samples (sorry only one 64 bits....but is distributed in 64bits too).

[EP_X0FF]

Interesting part of it seems to be able to create native usermode threads with CSRSS self notification plus it have a piece of x64 code in win32 loader, so I think it will work for x64 too.

5ff4f9c65e5e14db4cda736a374236fe_0b249f61a58aa5a1f8b01c4ea866b1c6 unpacked in attach.
https://www.virustotal.com/en/file/755e ... 412030155/

sup dlls mentioned above x86-x64 in attach

[kloent]

One more from Angler EK.

[Munsta]

create native usermode threads with CSRSS self notification

This means that it has ring0 component and it is creating new thread in the Windows fashion instead of some APC shellcode injection to usermode?

[EP_X0FF]

create native usermode threads with CSRSS self notification

This means that it has ring0 component and it is creating new thread in the Windows fashion instead of some APC shellcode injection to usermode?

There are no ring0 components. You do not understand the post. See @1000736B in unp.dmp -> NtCreateThread -> CsrClientCallServer.

[Munsta]

There are no ring0 components. You do not understand the post. See @1000736B in unp.dmp -> NtCreateThread -> CsrClientCallServer.

Right. Good, I remember now that it was used in some game hack, the tricky part was cross session thread creation, is this the case here? (creating hack thread from different user session via Csr* API and then you switch users to play the game :lol: )

[EP_X0FF]

Few samples of dropped Bedep components. Samples courtesy of Cody Johnston.

dpwsocksx_fake.dll
trksvr_fake.dll

both contain inside Win32/Bedep downloader.

bedep_stage2.dll extracted from them.

To manually extract payload - set break on RtlDecompressBuffer.

[forty-six]

Bedep stage 1 & 2.

[R136a1]

Hi folks,

attached are the samples of a test version of Bedep that uses a fileless persistency method. More info:
https://translate.google.com/translate? ... edit-text=

[Blaze]

Dropped Bedep x64 component. (hides as ipsecsnp.dll)