A forum for reverse engineering, OS internals and malware analysis 

Win32/Upatre (alias Waski)

Forum for analysis and discussion about malware.

Re: Win32/Upatre (alias Waski)

 #25728  by sysopfb
 Thu Apr 23, 2015 12:13 pm
The "config" is sitting in the shellcode that gets unxored.

That one has the following data
UserAgent to use: Mozilla/5.0 (Windows NT 6.1)
Run from temp as: installtessa.exe
Download payload to temp as: tessaFEB.tmp
Find host ip form: icnahazip.com
Upatre Checkin: 81.7.109.65
campaign: SATK12
Payload downloads:
217.12.59.234/satk012.png
91.240.97.54/satk012.png
80.87.220.102/satk012.png
91.240.97.38/satk012.png
46.151.130.90/satk012.png
91.240.97.64/satk012.png
91.240.97.66/satk012.png
91.240.97.45/satk012.png

The payloads are the png files in this case which is a LZNT compressed dropper with shellcode and some variable data sitting on top of it(after you decode it)

I don't see an exploit being used by that sample

Re: Win32/Upatre (alias Waski)

 #25729  by sysopfb
 Thu Apr 23, 2015 3:22 pm
The CVE string you're seeing there appears to be from the loader used by the payload (Dyre). Not sure if it's actually exploiting that or just putting that string in the loader for whatever reason.

Re: Win32/Upatre (alias Waski)

 #25730  by EP_X0FF
 Thu Apr 23, 2015 4:12 pm
@sysopfb

Can you attach payload btw? For me it does nothing.

Re: Win32/Upatre (alias Waski)

 #25731  by sysopfb
 Thu Apr 23, 2015 4:40 pm
Yup, some pretty interesting strings in the unpacked one. Looks like it has the normal dyre shim uac bypass, references to an av config file and the cve mentioned earlier

Not a normal loader for dyre that I'm used to seeing
Attachments
infected
(1.32 MiB) Downloaded 58 times

Re: Win32/Upatre (alias Waski)

 #25732  by sysopfb
 Thu Apr 23, 2015 4:53 pm
And here is the normal dyre the loader drops in temp packed and unpacked, it doesn't run properly in my windows 8 vm so I had to patch the check in the highlighted section
Image
Attachments
infected
(858.09 KiB) Downloaded 54 times

Re: Win32/Upatre (alias Waski)

 #26001  by sysopfb
 Thu Jun 04, 2015 9:34 pm
They've been changing up their payload xor routine quite often lately, today it was a rolling xor with a ROL (ROLling Xor?) on the xor value.

Image
Attachments
pass: infected
(14.62 KiB) Downloaded 51 times

Re: Win32/Upatre (alias Waski)

 #26224  by Mosh
 Wed Jul 01, 2015 10:37 pm
Hi All

Looks like Upatre (cancelation_invoice_information.zip) continue dropping Dyre Malware from these IP addresses:

62.204.250.26 (Czech Republic)
87.229.109.250 (Hungary)
217.168.210.122 (Czech Republic)
80.87.220.102 (Slovakia)
93.185.4.90 (Czech Republic)
Attachments
(878.57 KiB) Downloaded 49 times
 Return to “Malware”