contagio: Sep 28 CVE-2010-3333 Manuscript with Taidoor (Trojan.Matryoshka by CyberESI)

Thursday, October 6, 2011

Sep 28 CVE-2010-3333 Manuscript with Taidoor (Trojan.Matryoshka by CyberESI)

CyberESI

Jared Myers from CyberESI posted a fantastic detailed analysis of Taidoor trojan variant he called Trojan. Matryoshka for being just a container/carrier for another malicious file "Trojan.Einstein". See Trojan.Matryoshka and Trojan.Einstein The trojan arrived in a malicious RTF attachment CVE-2010-3333 from a a spoofed address of the National Chengchi University / NCCU of Taiwan. The actual sending host was a server IBM111, which is used by a particular group of attackers and is seen quite frequently. This sample was donated by a reader but I have a lot of IBM111-produced attachments if you are after them.

Common Vulnerabilities and Exposures (CVE)number

CVE-2010-3333

Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability

General File Information

File Name: 過程論的觀點分析六方會談審查意見.doc

File Size: 61455 bytes

MD5: 8406c1ae494add6e4f0e78b476fb4db0

Download

Download -8406c1ae494add6e4f0e78b476fb4db0 - as a password protected archive (contact me if you need the password)

Message + Headers

From: 戰略學刊 [mailto:95273503@nccu.edu.tw]

Sent: Wednesday, September 28, 2011 5:22 AM
Subject: 稿件
如附檔，請收悉。

From: Strategy Journal [mailto: 95273503@nccu.edu.tw]
Sent: Wednesday, September 28, 2011 5:22 AM
Subject: manuscript

Such as the attached file, please acknowledge receipt.

The viewpoint of the process of six-party talks on the review comments

Received: from IBM111 (60-249-219-82.HINET-IP.hinet.net [60.249.219.82])
xxxxxxxxxxxxxx; Wed,
28 Sep 2011 17:22:14 +0800 (CST)
Date: Wed, 28 Sep 2011 17:21:43 +0800
From: =?big5?B?vtSypL7HpVo=?= <95273503@nccu.edu.tw>
Subject: =?big5?B?vVql8w==?=
xxxxxxxxxxxxxxxxxxxxx
Message-id: <051c01cc7dc0$15472a40$c900a8c0@IBM111>
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
Content-type: multipart/mixed; boundary="Boundary_(ID_6HJcv7WYiwyCKpqySxUA2g)"
X-Priority: 3
X-MSMail-priority: Normal

Sender

60.249.219.82
60-249-219-82.HINET-IP.hinet.net
Da Shi Yung Co., Ltd
Tainan County County Taiwan
Taiwan

Automated Scans

doc
http://www.virustotal.com/file-scan/report.html?id=ca3744ae693409b2f8addd3de99c1ccae0bc8c709678ea357898bd02e8fb362a-1317347501
Submission date:2011-09-30 01:51:41 (UTC)
AntiVir     7.11.15.74     2011.09.29     EXP/CVE-2010-3333
Antiy-AVL     2.0.3.7     2011.09.29     Exploit/MSWord.CVE-2010-3333
Avast     6.0.1289.0     2011.09.30     RTF:CVE-2010-3333 [Expl]
AVG     10.0.0.1190     2011.09.30     Suspicion: unknown virus
BitDefender     7.2     2011.09.30     Exploit.RTF.Gen
ClamAV     0.97.0.0     2011.09.30     PUA.RFT.EmbeddedOLE
Commtouch     5.3.2.6     2011.09.30     CVE-2010-3333!Camelot
DrWeb     5.0.2.03300     2011.09.30     Exploit.Rtf.based
F-Secure     9.0.16440.0     2011.09.30     Exploit.RTF.Gen
Fortinet     4.3.370.0     2011.09.30     Data/CVE20103333.A!exploit
GData     22     2011.09.30     Exploit.RTF.Gen
Kaspersky     9.0.0.837     2011.09.30     Exploit.MSWord.CVE-2010-3333.r
Microsoft     1.7702     2011.09.29     Exploit:Win32/CVE-2010-3333
nProtect     2011-09-29.01     2011.09.29     Exploit.RTF.Gen
PCTools     8.0.0.5     2011.09.30     HeurEngine.MaliciousExploit
Sophos     4.69.0     2011.09.30     Troj/RTFDrp-C
Symantec     20111.2.0.82     2011.09.30     Bloodhound.Exploit.366
TrendMicro     9.500.0.1008     2011.09.29     Possible_ARTIEF
TrendMicro-HouseCall     9.500.0.1008     2011.09.30     Possible_ARTIEF
VIPRE     10616     2011.09.30     Exploit.RTF.CVE-2010-3333 (v)
MD5   : 8406c1ae494add6e4f0e78b476fb4db0

Payload

File name:payload.exe
Submission date:2011-10-06 12:39:32 (UTC)
Result:17 /42 (40.5%)
http://www.virustotal.com/file-scan/report.html?id=53d03f3db44d40de762ca445b85011a93e6b549788c5713862e42eed173eefa3-1317904772
AhnLab-V3    2011.10.05.00    2011.10.05    Backdoor/Win32.CSon
AntiVir    7.11.15.137    2011.10.06    TR/Hijacker.Gen
AVG    10.0.0.1190    2011.10.06    BackDoor.Generic14.AJZQ
BitDefender    7.2    2011.10.06    Trojan.CryptRedol.Gen.3
DrWeb    5.0.2.03300    2011.10.06    Trojan.Taidoor
Emsisoft    5.1.0.11    2011.10.06    Backdoor.Win32.Simbot!IK
eTrust-Vet    36.1.8602    2011.10.06    -
F-Secure    9.0.16440.0    2011.10.06    Trojan.CryptRedol.Gen.3
GData    22    2011.10.06    Trojan.CryptRedol.Gen.3
Ikarus    T3.1.1.107.0    2011.10.06    Backdoor.Win32.Simbot
Kaspersky    9.0.0.837    2011.10.06    HEUR:Trojan.Win32.Generic
Microsoft    1.7702    2011.10.06    Backdoor:Win32/Simbot.gen
NOD32    6521    2011.10.06    a variant of Win32/Injector.JQA
nProtect    2011-10-06.01    2011.10.06    Trojan.CryptRedol.Gen.3
Panda    10.0.3.5    2011.10.05    Suspicious file
Rising    23.77.04.01    2011.09.30    Suspicious
Symantec    20111.2.0.82    2011.10.06    Suspicious.Cloud.5
VBA32    3.12.16.4    2011.10.06    TrojanDownloader.Rubinurd.f
MD5   : d24a5c27628327da1cea545be2f99756

Pages