[Xylitol]

Targeting World of Warcraft people.
http://us.battle.net/wow/en/forum/topic ... 892?page=1


Troj.WowSpy-A:
https://www.virustotal.com/en/file/850d ... 388771269/

Mal/DllHook-A:
https://www.virustotal.com/en/file/c4b8 ... 388772032/


Trojan.Siggen5.64266 (http://www.drwebhk.com/en/virus_techinf ... 64266.html):
https://www.virustotal.com/en/file/12f1 ... 388771664/
https://www.virustotal.com/en/file/f798 ... 388771670/

[Win32:Virut]

more related files

https://www.virustotal.com/file/09943ba ... 388771386/
https://www.virustotal.com/file/4ca51fb ... 388771011/
https://www.virustotal.com/file/3c7c951 ... 388771134/
https://www.virustotal.com/file/850dc3e ... 388772681/

[patriq]

Targeting World of Warcraft people.
http://us.battle.net/wow/en/forum/topic ... 892?page=1

Troj.WowSpy-A:
https://www.virustotal.com/en/file/850d ... 388771269/

I cant unpack these with UPX -d .. something I'm doing wrong?

Code: Select all

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
upx: wow_1031_v2_done!.exe: NotPackedException: not packed by UPX

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
upx: DOMAIN EXE.EXE: NotPackedException: not packed by UPX

but I can see sections UPX0 and UPX1 - dead giveaway ?

Does this run without WoW installed? I don't see anything checking the registry..and error messages on Malwr.
How are victims targeted? (Maybe BitTorrent, as a name looks to be a WoW related file "wow_1031_v2" ?? )

Anyone seen any C&C traffic for this campaign?

[Win32:Virut]

How are victims targeted? (Maybe BitTorrent, as a name looks to be a WoW related file "wow_1031_v2" ?? )

It is dropped by:

_hxxp://www.curse.pw/
_hxxp://www.curse.pw/setup.exe

(the links are dead now)

Another file: https://www.virustotal.com/file/6b654c5 ... 388824597/

[Xartrick]

I cant unpack these with UPX -d .. something I'm doing wrong?

Don't bother with the loader, you can directly look into w_win.dll and w_64.dll, they contains the full payload.

Does this run without WoW installed? I don't see anything checking the registry..and error messages on Malwr.

It will hook wow.exe (World of Warcraft) if present, but also target iexplorer.exe (Internet Explorer) as well.
The DLL add an entry into registry to be run at every startup.

Code: Select all

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Disker => rundll32.exe X:\[..]\w_win.dll,DW

[patriq]

How are victims targeted? (Maybe BitTorrent, as a name looks to be a WoW related file "wow_1031_v2" ?? )

It is dropped by:

_hxxp://www.curse.pw/
_hxxp://www.curse.pw/setup.exe

(the links are dead now)

Another file: https://www.virustotal.com/file/6b654c5 ... 388824597/

Cool, thanks. The links seem fine to me?

There is an advert on the page about this "addon manager" for gamers. I dunno, not very interesting.

false positive?

[patriq]

I cant unpack these with UPX -d .. something I'm doing wrong?

Don't bother with the loader, you can directly look into w_win.dll and w_64.dll, they contains the full payload.

Does this run without WoW installed? I don't see anything checking the registry..and error messages on Malwr.

It will hook wow.exe (World of Warcraft) if present, but also target iexplorer.exe (Internet Explorer) as well.
The DLL add an entry into registry to be run at every startup.

Code: Select all

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Disker => rundll32.exe X:\[..]\w_win.dll,DW

Check. Thanks.

(also, did you really register in 2011 and just post first right now? )

[Xartrick]

Check. Thanks.

(also, did you really register in 2011 and just post first right now? )

I always get an interest into malware, but never go deeper.

[rinn]

Hello.

It's really UPX. Just a bit scrambled. In attach unpacked, all interesting dll's inside in rsrc section. Even if upx -d failed you still can unpack it manually.

Best Regards,
-rin

I cant unpack these with UPX -d .. something I'm doing wrong?

Code: Select all

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
upx: wow_1031_v2_done!.exe: NotPackedException: not packed by UPX

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
upx: DOMAIN EXE.EXE: NotPackedException: not packed by UPX

but I can see sections UPX0 and UPX1 - dead giveaway ?

[Xartrick]

It's really UPX. Just a bit scrambled. In attach unpacked, all interesting dll's inside in rsrc section. Even if upx -d failed you still can unpack it manually.

Did you figure what makes upx -d failing?