Aug 2012 Backdoor.Wirenet - OSX and Linux

End of the year presents:
Backdoor.Wirenet.1
Related News and Analysis:
August 2012
The first Trojan in history to steal Linux and Mac OS X passwords  Dr.Web

Nov 2012 - W32.Narilam Sample

End of the year presents:
This is a sample of W32.Narilam 

Related News and Analysis:
Nov 2012 (malware is much older but re-surfaced in Nov 2012)
W32.Narilam – Business Database Sabotage
W32.Narilam | Symantec

Oct 2012 - Skype Dorkbot / W32.Phopifas samples

End of the year presents:
These are 4 samples of Skype Dorkbot / W32.Phopifas
Related News and Analysis:
October 2012
Infection Spreads Profile Pic Messages to Skype Users -GFI
W32.Phopifas | Symantec

OSX/Dockster.A and Win32/Trojan.Agent.AXMO Samples, pcaps, OSX malware analysis tools

Img.baronet4tibet. Tibetan furniture
 featuring a leopard and a lion

Better late than never. Here are the samples of the recent twin newsmakers OSX/Dockster.A and Win32/Trojan.Agent.AXMO.  The malware was already described and hashes published but I thought I would add traffic captures and samples themselves.

 I ran these samples on Thursday, November 29  (OSX) and Friday, November 30 (Agent.AXMO) when the C&C servers were still online. Intego mentioned the address itsec.eicp.net was not registered and it was possibly a test but it is a dynamic DNS address and it was down by the weekend.Credit for the sample goes to an anonymous Santa. 

I have to admit that my knowledge of  OSX malware leaves much to be desired. When we deal with Windows malware, range of choices for capturing, logging, recording, and analyzing is similar to this. I cannot name more than a few for MAC OSX - Wireshark, native Apple syslogs, IDA, Macmemoryze from Mandiant, and a few more below. If you have some good recent papers and tools lists for OSX malware analysis please share.

Read more here
http://www.f-secure.com/weblog/archives/00002466.html

Common Exploit Kits 2012 Poster (based on Exploit pack table Update 18, Nov 12, 2012)

Update November 14, 2012
1. We forgot to mention that in the best tradition of the Antivirus industry, all posters come with one (1) year of free updates. Email us when a new version of the poster comes out ( use same email address or reply to the original message) and we will send you the file (same size you ordered, in JPG format). We cannot reprint Zazzle posters but you can use your own printing, or upload and order your own from Zazzle.

2. We added two more sizes for smaller wall spaces and budgets (asking for $15 and $10 to be donated to charity )

Hurricane Sandy, Jersey Shore
Src. Twitter Oct 28,2012
 author unknown

This update to the exploit pack table comes in the form of a poster (Exploit pack table update 18 is coming soon too).
The poster includes most common exploit packs of 2012. The poster will be updated and new issues posted in the future.







Poster sizes: 

If you wish to order a larger poster print,  (up to 60"x40" or 152cm x 101cm), follow this link to Zazzle.com 
Zazzle cancelled orders due to logos in fish images, despite the fact that their use falls under "Nominative Fair use" policy  (Read: "Lawful use of another's trademark") and we make zero money on it. Here is an example of PC magazine using it lawfully to compare browsers  - they also publish and sell their magazine is stores.
We filed a complaint with Zazzle. But even if they don't cancel,  Zazzle is also very overpriced so you are likely to find cheaper ways to print it. so we do not recommend using it anymore.

If Zazzle cancelled your order, email us and we will send you the full file for free. 

 Staten Island Hurricane Sandy Relief (Staten Island Project Hospitality).

See Staten Island hurricane aftermath photos here:

Time.com   NY Times

• If you wish to use your own printing services and/or need multiple copies, you can request the poster file (see sizes below)  in exchange for donation to the Hurricane Relief  or a charity of your choice. Email us (admin at deependresearch.org) a receipt of a donation made in the past month (you can partially hide/obscure your personal info, if needed) and we will send you the file.
• 8900 x 6000 px = up to 40" x 60"      (101 x 150 cm) = $25  Donate here or charity of your choice
• 5340 x 3600 px = up to 24" x 35.6"   (~ 61 x 91 cm) = $15 Donate here or charity of your choice
• 3578 x 2415 px = up to 16" x 24"      (~ 40 x 60 cm) = $10 Donate here or charity of your choice
• 1720 x 1200 px = up to 11"x14"        (~ 20 x 30 cm) = Free Download

CVE-2012-5076 Java sample from "Cool" exploit pack

Here is quick post for a CVE-2012-5076 sample (from Cool pack, as described by Kafeine here Cool EK : "Hello my friend..." CVE-2012-5076 )

Group Photos.zip OSX/Revir | OSX/iMuler samples March 2012-November 2012

Sophos posted information about a variant of iMuler OSX trojan targeting Tibet activists (New variant of Mac Trojan discovered, targeting Tibet )  and posted the MD5 2d84bfbae1f1b7ab0fc1ca9dd372d35e (FileAgent 37.3 KB) of the trojan  . This post is for the actual dropper, which is a full 1.9 MB package (Group photo.zip MD5: 9e34256ded3a2ead43f7a51b9f197937)

 I don't have a Mac OS VM handy tonight to provide more details about the traffic or behavior so I will just describe the package and post the previous version of the same trojan that was targeting fans of Russian topless models.

CVE-2012-1535 Sep.9, 2012 "房號表.doc - Data for Reference.doc" and Taidoor trojan sample set for signature development

As promised, here is one sample of CVE-2012-1535 that you can use to follow the exploit analysis in the previous post CVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis by Brian Mariani & Frédéric Bourla. It is from September 9, 2012, I have one from October, which I will post shortly as well. If you are not interested in the exploit, you can use the Taidoor payload plus 18 other Taidoor binaries to develop your own signatures for this trojan or test your AV. 

This message was sent to Taiwan government and is digitally signed with a valid signature. I am not sure if the signature is obtained for a fake account or the account is hijacked, this is why I am not posting the email address. If you work for TW government, you can ask for it. There was also a PDF attached with a personally identifiable information (full application) of an applicant for International Cooperation and Development Fund (Taiwan) - Women Development program. It is not included in this post. I assume it was stolen earlier as well. 

CVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis by Brian Mariani & Frédéric Bourla

Brian Mariani and Frédéric Bourla from High-Tech Bridge SA – www.htbridge.com sent their excellent deep analysis of  CVE-2012-1535 vulnerability in Adobe Flash Player. The Word documents with Flash that exploited that vulnerability appeared in August but did not become as popular as RTF CVE-2012-0158, which remains to be the most widely used exploit for targeted email attachments. 

The reason for it is that integer overflows are difficult to exploit in general and CVE-2012-1535 is less reliable than other exploits prevalent today. This does not mean it is not in use and I will post several recent samples with this exploit in the next article.
The full analysis is posted below, plus you can download it in PDF format.

Blackhole 2 exploit kit (partial pack) and ZeroAccess (user-mode memory resident version)

 This post is an addtion to the DeepEnd Research post Blackhole & Cridex: Season 2 Episode 1: Intuit Spam & SSL traffic analysis by Andre DiMino about the Blackhole 2 exploit pack and Cridex trojan alliance.

Here is for download a partial Blackhole 2 exploit pack. This pack has been shared with me a few times over the past couple of weeks as researchers discovered an blackhole server with open directories. While it is missing a few crucial files, it is still provides insight into the pack components, exploits, and structure.

The list of files in the pack are listed below. 16 files are zero in size (not on purpose, that's all I have) and are there just for your information. The zero size files are listed in the separate list below (in addition to being in the main list). The files and data directories contain the exploits ( cve-2012-1723, cve-2012-0507, cve-2010-1885, cve-2012-4681, cve-2010-0188) and the payload (ZeroAccess  among other malware, which is memory resident rootkit (thus no 'dropped', created files for ZeroAccess in the package, only the original dropper and all kinds of files genereated by the clickfraud component. Use Volatility or Redline/Memorize for analysis)
This captcha component of this pack was reviewed by
Behind the Captcha or Inside Blackhole Exploit Kit 2.0 - Exploit Kit Administration Panel (Malware Don't Need Coffee).

 Malware Must Die analysts have been tracking Blackhole 2 as well

CVE-2012-4969 Internet explorer 0day samples

The Internet Explorer 0day aka now CVE-2012-4969, have been used in a "small number of targeted attacks". The new Internet Explorer Zero day technical details came out (eromang.zataz.com), the Metasploit module is out now too and the number will increase exponentially as soon as exploit pack authors add it to their arsenal, which will happen very soon. This seems to be repeating the story of Java CVE-2012-4681. See CVE-2012-4681 samples Original (APT) and Blackhole 2.0 (crime)

There are a few mitigation workarounds you can use for now, the best is to upgrade your browser, however
Read more at http://technet.microsoft.com/en-us/security/advisory/2757760

CVE-2012-4681 samples Original (APT) and Blackhole 2.0 (crime)

Here are two samples of Java CVE-2012-4681 exploit - one from the original targeted attack described in our post on August 30, 2012 and the other from today's spam redirecting to Blackhole 2.0 exploit kit and using CVE-2012-4681 adapted from the Metasploit framework.
The Blackhole 2.0 ad is translated and posted at malware.dontneedcoffee.com along with a very good analysis.
The spam campaigns are probably different but the one I encountered was using the subject "ADP Invoice Reminder" with ADP_Online_Invoice_DoNotReply@adp.com address sent from what it looks like a spam botnet. The body of the email looks very convincing  - see the legitimate ADP email below in comparison to the fake one. The links are legitimate compromised websites redirecting to the Blackhole exploit server. The payload is Zeus (Gameover P2P version not Citadel). Many websites already cleaned and giving error 404 and some are still active. I posted approximately 50 headers below for those who deal with spam filters as well as pcap and other information.

Contagio file downloads are not available indefinitely (thanks to Mediafire and LeakID ideas about copyright)

Update5: 
Mediafire notified me the other day that they had confirmation from LeakID that the notices they submitted  were done in error. They restored all the file access.
I want to thank all who helped me with the posts and updates Paul Robert from SophosLabs, Soulskill- Slashdot, Dan Kaplan from SC Magazine for their articles, everyone who made posts on Twitter  and the Mediafire team for the über fast response to the posts and resolution. I guess LeakID do not speak to victims directly, never heard from them.

Java 7 0-day vulnerability analysis

Here is our second article about Java 7 0-day vulnerability. Read more at DeepEndResearch.org

ladyilonwick.wordpress.com

Considering that Rapid 7 posted a working exploit and addition to the exploit packs is imminent (Attackers Pounce on Zero-Day Java Exploit by Brian Krebs), plus other analysis articles are being published such as New Java 0day exploited in the wild  -by Alienvault, we decided that witholding details of the exploit will not offer additional protection but only hinder development of protection and signatures.

As we mentioned earlier, we contacted Michael Schierl, the Java expert who discovered a number of Java vulnerabilities and asked him to have a look. He sent back his detailed analysis, exploit source, the interim patch with the source code of the patched class.


Patch request:

• Interim patch with the source code of the patched class. See the Readme of the patch in the previous post (thanks to Michael Schierl). 

Email from your company email address to admin <at> deependresearch.org  and explain the planned use, please.

DeepEnd Research: Java 7 0-Day vulnerability information and mitigation.

img.kids.discovery.com

The cat is out of the bag. There is 0-day out there currently being used in targeted attacks.  The number of these attacks has been relatively low, but it is likely to increase due to the fact that this is a fast and reliable exploit that can be used in drive-by attacks and all kinds of links in emails. Interestingly, Mark Wuergler mentioned on August 10 that VulnDisco SA CANVAS exploit pack now has a new Java 0-day. It makes you wonder if it is the same exploit that leaked from or was found in the wild and added to the CANVAS pack. Or if it is totally unrelated and there are two 0-day exploits now.

The purpose of this post is not to provide the vulnerability analysis or samples but to offer additional information that may help  prevent infections on some targeted networks.   We all know what kind of damage Java vulnerabilities can cause if used in drive by exploits or exploit packs and we think that revealing technical vulnerability details  in the form of a detailed technical analysis is dangerous, while releasing working exploits before the patch is vain and irresponsible.

Oracle patch cycle is 4 months (middle of February, June, October) with bugfixes 2 months after the patch. The next patch day is October 16 - almost two months away. Oracle almost never issue out-of-cycle patches but hopefully they will do consider it serious enough to do it time.

Read more at DeepEndResearch.org

Shamoon or DistTrack.A samples

Image from Kaspersky lab

Here are a couple of Shamoon samples. Such destructive malware is rare because it does not really make much sense to destroy computers when you can steal data or use them.  

• Kaspersky Shamoon the Wiper - Copycats at Work 
•  W32/DistTrack.A Norman
• Shamoon, a two-stage targeted attack - Seculert

CVE-2012-1535 - 7 samples and info

I was still writing my analysis when Alienvault posted CVE-2012-1535: Adobe Flash being exploited in the wild and mine would be pretty much the repeat of the same. I don't like repeating so I will just post the samples and link to Jaime Biasco's article.  As you see from SSDeep they are nearly identical in size, exploit, and payload. All Word documents were authored by "Mark" and have same strings and indicators present as in the analyzed file.

3322 Dyndns badness

MD5


118f208998e12561b03200178edf826b members.3322.org PRORAT
c5ac14a3c80b3c6af4c943e0f3839fbe lengkusky1.3322.org Keylogger
03ac85edb00bcd8c6b4981ca67208f68 sfwu.3322.org
003212079a7c1de92b755a627f3913b7 sfwu.3322.org
c5a632a8e369e47a7e8f55f892c8d864 myyuming55.3322.org
c5a6de01e10c65a8894bcb32608055b5 yjdl.3322.org Puppetzombie.gen
8a41d4770858cb5af6860f95c00f8224 myyuming55.3322.org Virut
fe7d3e20d7bc640fe2edf645da218bd1 xinxin169.3322.org

Gauss samples - Nation-state cyber-surveillance + Banking trojan

Just a quick post for those who can't sleep until get to play with Gauss

Here is a great paper by Kaspersky Gauss:Abnormal Distribution 

and the blogpost: "Gauss: Nation-state cyber-surveillance meets banking Trojan"

Excerpt:
The highest number of infections is recorded in Lebanon, with more than 1600 computers affected. The Gauss code  (winshell.ocx) contains direct commands to intercept data required to work with Lebanese banks – including the Bank of  Beirut, Byblos Bank and Fransabank. 

In Israel and the Palestinian Territory, 750 incidents have been recorded." (Kaspersky)

CVE-2012-0158 generated "8861 password" XLS samples and analysis

Symantec recently posted an article by Joji Hamada titled "Password “8861” Used in Targeted Attacks", where the attackers continuously using the same passwords sent in emails together with the malicious attachment. Indeed, the password not only allows to evade detection but also makes it difficult to analyse the exploit itself.

All the samples i have that have this password appear to be created via a generator and share certain similarities. I will point out a few but you can find many more if you analyse the files and payloads.  

- Exploit CVE-2012-0158

The hallmark ListView2, 1, 1, MSComctlLib, ListView are clearly seen in the files, as well as excessive calls to MSCOMCTL.OCX during the dynamic analysis.

- Same password 

8861 could be the attacker's lucky number, or it is job related, or being a primary number, it plays some role in the RSA encryption implementation in this generator ( this one perhaps is a bit far fetched, but not more than other theories)

- Antivirus/Malware detection

These files are mostly detected as Exploit.D-Encrypted  by different AV vendors but this signature detects other malicious password protected documents  - it is not limited to this 8861 generator files.

Yara Signatures: You can develop your own yara signatures based on these and other indicators you find in the files. I will share signatures on Yara Signature Exchange Google Group. If you are interested in making and sharing, please see DeepEnd Research: Yara Signature Exchange Google Group
IDS:  Emerging threats IDS signatures - see below.

- Same file structure

They are each different sizes and have different payloads, however the first 120KB of each file are identical and are completley different from the headers of other typical user created password protected spreadsheets and other malicious and password protected XLS files. I will post two other malicious messages that were NOT generated using the same generator is seems and have a different password  (I don't know password for those two files yet, if your figure it out, please share)

- Same document code page 

Windows Simplified Chinese (PRC, Singapore)

- Same name for the dropped files (ews.exe and set.xls) 

The dropped payload and the clean XLS document are different sizes, different types of malware for trojans, but have the same names (some are renamed after creation), which suggests a template. The embedded clean XLS documents have different metadata - I guess those were downloaded from internet or stolen from different targets - some were created on the Kingsoft version of Office, different authors, etc.

- Non default encryption (RC4, Microsoft RSA SChannel Cryptographic Provider).

Default is "Office 97/2000 compatible", which I think is 40-bit RC4 encryption. The generator is probably not using Excel interface but has it's own implementation of the encryption for the VBA code.

- Targets do not seem to be related by their occupation

Targets are in different countries  - Japan, China, France and do not seem to be related by business or industry - human rights activists, businesses, politicians. This makes me think it is not the same group of attackers but it is just a generator purchased by/supplied to different groups attacking different targets. The same trojan types, C2 domains, and targets were covered on Contagio and other resources earlier.