An Overview of Exploit Packs (Update 25) May 2015

Update May 12, 2015

Added CVE-2015-0359 and updates for CVE-2015-0336

 Exploit kit table 2014- 2015 (Sortable HTML table)

Reference table : Exploit References 2014-2015

Ask and you shall receive

I get emails from readers asking for specific malware samples and thought I would make a mini post about it.

Yes, I often obtain samples from various sources for my own research.

 I am sometimes too lazy/busy to post them but don't mind sharing.
If you are looking for a particular sample, feel free to ask. I might have it.

Send MD5 (several or few samples). I cannot provide hundreds/thousands of samples or any kind of feeds. If you ask for a particular family, I might be able to help if I already have it.

Unfortunately, I do not have time to do homework for students and provide very specific sets for malware with specific features as well as guarantee the C2s are still active.  Send your MD5(s) or at least malware family and I check if I have it :) If i have it, I will either send you or will post on the blog where you can download.

If you emailed me in the past and never got an answer, please remind me. Sometimes emails are long with many questions and I flag them to reply to later, when I have time and they get buried or I forget. It does not happen very often but accept my apologies if it happened to you.

Before you ask, check if it is already available via Contagio or Contagio Mobile.
1. Search the blog using the search box on the right side
2. Search here https://www.mediafire.com/folder/b8xxm22zrrqm4/BADINFECT
3. Search here https://www.mediafire.com/folder/c2az029ch6cke/TRAFFIC_PATTERNS_COLLECTION
4. Search here https://www.mediafire.com/folder/78npy8h7h0g9y/MOBILEMALWARE

Cheers,  Mila

Collection of Pcap files from malware analysis

Update: Feb 19. 2015

We have been adding pcaps to the collection so remember to check out the folder ( Pcap collection) for the recent pcaps.

I had a project to test some malicious and exploit pcaps and collected a lot of them (almost 1000) from various public sources. You can see them in the PUBLIC folder. The credits go to the authors of the pcaps listed in the name of each file. Please visit their blogs and sites to see more information about the pcaps, see their recent posts, and send them thanks. The public pcaps have no passwords on them.

Equation samples - from the Kaspersky Report and additional

Here are a few samples from the report by Kaspersky Lab "Equation: The Death Star of Malware Galaxy" and additional samples of the same family. The full list is below




Download all the samples listed below. Email me if you need the password (New link)

List of files

Files from the report:

File Name	MD5	Size
_SD_IP_CF.dll_03718676311DE33DD0B8F4F18CFFD488	03718676311de33dd0b8f4f18cffd488	368 KB
Disk from Houston_6FE6C03B938580EBF9B82F3B9CD4C4AA	6fe6c03b938580ebf9b82f3b9cd4c4aa	61 KB
DoubleFantasy_2A12630FF976BA0994143CA93FECD17F	2a12630ff976ba0994143ca93fecd17f	216 KB
EquationDrug_4556CE5EB007AF1DE5BD3B457F0B216D	4556ce5eb007af1de5bd3b457f0b216d	372 KB
EquationLaser_752AF597E6D9FD70396ACCC0B9013DBE	752af597e6d9fd70396accc0b9013dbe	130 KB
Fanny_0A209AC0DE4AC033F31D6BA9191A8F7A	0a209ac0de4ac033f31d6ba9191a8f7a	180 KB
GrayFish_9B1CA66AAB784DC5F1DFE635D8F8A904	9b1ca66aab784dc5f1dfe635d8f8a904	560 KB
GROK_24A6EC8EBF9C0867ED1C097F4A653B8D	24a6ec8ebf9c0867ed1c097f4a653b8d	160 KB
nls_933w.dll_11FB08B9126CDB4668B3F5135CF7A6C5	11fb08b9126cdb4668b3f5135cf7a6c5	208 KB
TripleFantasy_9180D5AFFE1E5DF0717D7385E7F54386	9180d5affe1e5df0717d7385e7f54386	18 KB
TripleFantasy_BA39212C5B58B97BFC9F5BC431170827	ba39212c5b58b97bfc9f5bc431170827	199 KB

Additional Files:

Video archives of security conferences and workshops

Just some links for your enjoyment

List of security conferences in 2014

Video archives:

AlienSpy Java RAT samples and traffic information

AlienSpy Java based cross platform RAT is another reincarnation of ever popular Unrecom/Adwind and Frutas RATs that have been circulating through 2014.

It appears to be used in the same campaigns as was Unrccom/Adwind - see the references. If C2 responds, the java RAT downloads Jar files containing Windows Pony/Ponik loader. The RAT is crossplatform and installs and beacons from OSX and Linux as well. However, it did not download any additional malware while running on OSX and Linux.

The samples, pcaps, and traffic protocol information  are available below.

OnionDuke samples

Research:  F-Secure: OnionDuke: APT Attacks Via the Tor Network

Download

Download. Email me if you need the password (new link)

File attributes

Size: 219136

MD5:  28F96A57FA5FF663926E9BAD51A1D0CB

Size: 126464

MD5:  C8EB6040FD02D77660D19057A38FF769

Size: 316928

MD5:  D1CE79089578DA2D41F1AD901F7B1014

Wirelurker for OSX, iOS (Part I) and Windows (Part II) samples

PART II

Wirelurker for Windows (WinLurker)

Research: Palo Alto Claud Xiao: Wirelurker for Windows

Sample credit: Claud Xiao

PART I

Research: Palo Alto Claud Xiao WIRELURKER: A New Era in iOS and OS X Malware

Palo Alto |Claud Xiao - blog post Wirelurker

Wirelurker Detector https://github.com/PaloAltoNetworks-BD/WireLurkerDetector

Sample credit: Claud Xiao

Download

Download Part I
Download Part II

Email me if you need the password

ShellShock payload sample Linux.Bashlet

Someone kindly shared their sample of the shellshock malware described by the Malware Must die group - you can read their analysis here:

MMD-0027-2014 - Linux ELF bash 0day (shellshock): The fun has only just begun...

Download

Download. Email me if you need the password

CZ Solution Ltd. signed samples of Xtreme Rat, Zeus, Spy-Net, Gh0st, BozokRAT and other

Here are all samples (+ more) mentioned in this post by Fireeye : The Little Signature That Could: The Curious Case of CZ Solution"
All files are digitally signed with a "CZ Solutions" certificate making it easy to create a Yara or ClamAV signature.

A few Zeus samples seem to be still beaconing. Most are sinkholed.
The certificate is now revoked by VeriSign.

Enjoy

Download

Download. Email me if you need the password (new link)

OSX malware and exploit collection (~100 files) + links and resources for OSX malware analysis

'Tis the season.

Here is a nice collection of ~100 Mac OS malware and Word document exploits carrying MacOS payload (all are CVE-2009-0563) along with links for OSX malware analysis.

Please send your favorite tools for OSX if they are not listed.

CVE-2009-0563

CVE-2009-0563
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."

Links

Some OSX malware analysis tools and links 

• http://computer-forensics.sans.org/community/papers/gcfa/mac-os-malware-analysis_2286
• http://en.wikibooks.org/wiki/Reverse_Engineering/Mac_OS_X
• http://contagiodump.blogspot.com/2012/12/osxdockstera-and-win32trojanagentaxmo.html

Tools

• Activity Monitor (Max OSX Utilities folder)
• MacMemoryze (support for Mountain Lion) free, 
• Volatility (partial support for Mountain lion) free
• fseventer (graphical event representation) - works on Mountain lion 
• Wireshark
• IDA pro
• OSXpmem (kernel extension)
• http://osxbook.com/ OSX internals
• 2009 Mac OS X Malware Analysis Author: Joel Yonts
• Apple OS X ABI Mach-O File Format Reference  
• FileXray $79 but looks like it is worth it if you do OSX forensics
• ...let us know what you use

Malware in the provided package - links to research and news articles

• OSX_AoboKeylogger http://aobo.cc/
• OSX_BackTrack-A
• OSX_Boonana http://contagiodump.blogspot.com/2010/11/nov-14-javaboonana-facebook-trojan.html
• OSX_ChatZum http://www.thesafemac.com/chatzum-discovered-in-another-installer/
• OSX_Clapzok http://www.intego.com/mac-security-blog/clapzok-a-multi-platform-virus/ 
• OSX_Crisis http://www.intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/
• OSX_Dockster_Backdoor http://contagiodump.blogspot.com/2012/12/osxdockstera-and-win32trojanagentaxmo.html
• OSX_FkCodec http://www.thesafemac.com/osxfkcodec-a-in-action/
• OSX_Flashback http://www.symantec.com/security_response/writeup.jsp?docid=2012-041001-0020-99
• OSX_Fucobha_IceFog http://www.securelist.com/en/blog/208214064/The_Icefog_APT_A_Tale_of_Cloak_and_Three_Daggers
• OSX_GetShell http://www.symantec.com/security_response/writeup.jsp?docid=2013-020412-3611-99
• OSX_Hacktool_Hoylecann
• OSX_HellRaiser http://macscan.securemac.com/hellraiser-aka-osxhellrtsd/
• OSX_HellRTS http://macscan.securemac.com/hellraiser-aka-osxhellrtsd/
• OSX_Hovdy_Backdoor http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/OSX~Hovdy-A.aspx
• OSX_Inqtana http://www.symantec.com/security_response/writeup.jsp?docid=2006-021715-3051-99&tabid=2
• OSX_Iservice http://www.symantec.com/connect/blogs/osxiservice-it-s-not-going-iwork-you
• OSX_Jahlav http://macscan.securemac.com/osxjahlav-c-dnschanger-trojan-horse/
• OSX_Kitmos http://blog.sbarbeau.fr/2013/05/osx-kitmos-analysis.html
• OSX_Lamadai http://www.welivesecurity.com/2012/03/28/osxlamadai-a-the-mac-payload/
• OSX_Leverage_A_Backdoor http://www.alienvault.com/open-threat-exchange/blog/osx-leveragea-analysis
• OSX_LocalRoot https://www.trustedsec.com/august-2013/osx-10-8-4-local-root-privilege-escalation-exploit/
• OSX_Macarena_A http://www.securelist.com/en/analysis/204791948/Mac_OS_X#macarena
• OSX_MacDefender http://www.intego.com/mac-security-blog/macdefender-rogue-anti-malware-program-attacks-macs-via-seo-poisoning/
• OSX_MacKontrol http://www.securelist.com/en/blog/208193616/New_MacOS_X_backdoor_variant_used_in_APT_attacks
• OSX_Macsweeper http://en.securitylab.ru/viruses/311798.php
• OSX_Miner_DevilRobber http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/OSX~Miner-D/detailed-analysis.aspx
• OSX_Olyx_Backdoor http://contagiodump.blogspot.com/2011/07/jul-25-mac-olyx-gh0st-backdoor-in-rar.html
• OSX_OpinionSpy http://www.f-secure.com/sw-desc/spyware_osx_opinionspy.shtml
• OSX_PSides
• OSX_Genieo http://www.thesafemac.com/malicious-genieo-installers-persist/
• OSX_PUP_PerfectKeylog http://www.blazingtools.com/mac_keylogger.html
• OSX_Renepo / Pintsized http://www.intego.com/mac-security-blog/pint-sized-backdoor-for-os-x-discovered/
• OSX_Revir http://contagiodump.blogspot.com/2012/11/group-photoszip-osxrevir-osximuler.html
• OSX_Safari
• OSX_SniperSpy http://www.sniperspymac.com/download.html
• OSX_Wirenet http://www.webroot.com/blog/2012/09/14/wirenet-the-password-stealing-trojan-lands-on-linux-and-os-x/
• OSX_Yontoo http://www.macrumors.com/2013/03/21/new-yontoo-adware-trojan-targets-major-browsers-on-os-x/
• OSXWeapoX http://www.virusradar.com/OSX_Rootkit.Weapox.A/description
• ------------------------------------
• CVE-2009-0563 Word exploit

• MacControl payload  http://www.securelist.com/en/blog/208193616/New_MacOS_X_backdoor_variant_used_in_APT_attacks
• OSX.SabPub payload http://www.securelist.com/en/blog/208193470/New_Version_of_OSX_SabPub_Confirmed_Mac_APT_attacks
• OSX/Dockster.A payload  http://www.intego.com/mac-security-blog/new-targeted-attack-on-tibetan-activists-using-os-x-discovered/
• OSX_Docklight payload  http://contagioexchange.blogspot.com/2012/05/019-speechdoc-macosxms09-027a-word.html and http://blogs.technet.com/b/mmpc/archive/2012/04/30/an-interesting-case-of-mac-osx-malware.aspx

Sandbox MIMIng. CVE-2012-0158 in MHTML samples and analysis

Wikipedia

Update - Sept 4, 2013
I added more descriptions and changed NjRat / Backdoor.LV to Vidgrab - in the traffic communications are similar to NjRat/Backdoor;lv but it does not use base64 and sends initial request starting with ...3 (0x01 0x00 0x00 0x00 0x33) followed by null bytes  - it does not start with  lv|

I am still looking for names for a few other backdoors below, so if you recognize them, please let me know. 

Recently, my custom sandbox has been trying to open some Word attachments in a browser because the filetype fingerprint service detected them as MIME HTML files. Browsers are usually the default applications for such types and they did contain the CVE-2012-0158 exploit. A quick Google lookup yielded a May 2013 report from the Chinese company Antiy  "The Latest APT Attack by Exploiting CVE-2012-0158 Vulnerability", which described this new exploit vector.
Antiy noted that these MHTML files evade antivirus and indeed only half of vendors represented on Virustotal detect. However, many companies rely on their automated tools, inline and standalone sandboxes not just Antivirus to determine if the file is malicious.

I checked how these files (file without any extension) were processed by other commercial and open source mailboxes. 3 out of 5 well known commercial and open source mail scan and web sandbox vendors returned no output or informed me that that filetype was not supported. While writing this post, I noticed that Malwaretracker also mentioned the rise in this vector usage in his post on Friday, so I am sure the sandbox vendors are fixing the issue as we speak.

I checked 25 MHTML CVE-2012-0158 files and compared their targets (at least those I could obtain) and payload. The analysis showed a good variety of trojans and predominantly human rights (Tibet, Uyghur) activists. I will post a month worth of these files.

DeepEnd Research: List of malware pcaps, samples, and indicators for the Library of Malware Traffic Patterns

The library of malware traffic patterns have been popular. We found it very useful as well ourselves and we encourage you to send your contributions. I know at some point the spreadsheet will become unwieldy but I personally find it the most easy way (easy sort, search etc)

Currently, most of the samples described have the corresponding samples and pcaps available for download (email Mila @contagio for the password)

such as you see in the links below

http://bit.ly/crimesamples | http://bit.ly/crimepcaps

http://bit.ly/aptsamples | http://bit.ly/aptpcaps

>>>> VIEW OR DOWNLOAD "MALWARE TRAFFIC PATTERNS"   <<<<

Email us at mila [a t ] Deependresearch.org or adimino [a t] deependresearch.org

The current list of malware described (as of Aug. 9, 2013)

Defcon 21 Archives Speaker Materials

Hope it is not a copyright violation and won't cause too much hate. I know Defcon will post better and complete data soon but many / most attendees did not receive the presentation CDs to their great sadness because there were not enough CDs available for all. Many authors and attendees published Defcon and Blackhat presentations online as well -you can track them via Twitter

You can download it here for now. Check Defcon website often, they will post it soon. The list of files of the speaker materials is below. The zip file also includes short stories. Please note that some presentations submitted for the DVD were somewhat / significantly different from what was presented. But better this than nothing, right?


SPEAKER MATERIALS - LIST OF PRESENTATIONS

DeepEnd Research: Under this rock... Vulnerable Wordpress/Joomla sites... Overview of the RFI botnet malware arsenal

Exploits directed at Wordpress and/or Joomla content management systems(CMS) have been increasing at a dramatic rate over the past year. Internet blogs and forums are flooded with posts about hacked CMS installations. Popular jargon refers to the attackers as "hackers", but it is generally understood that these mass compromises are being performed via automated scanners and tools. However, we believe that there is not enough coverage of the actual malware involved.

One such infection scheme is essentially the following:

A downloader trojan  (Mutopy  - Win32) (20a6ebf61243b760dd65f897236b6ad3 Virustotal) instructs the infected host to download:
1) Remote File Injector "Symmi" (Win32) 7958f73daf4b84e3b00e008258ea2e7a Virustotal 
2) SDbot (Win32) - aaee52bfb589f6534c4b51e3b144dc08 Virustotal 
3) PHP scripts for injecting into compromised Wordpress sites. Among them a PHP spambot (victimized site owners often get alerted about copious amount of meds and spam porn emanating from their sites). This is also the source of varied links for spam using thousands of various links redirecting to the same sites (e.g. weightloss, work at home scams, or porn sites)

Read more at DeepEnd Research>>>

Download files (see below)

DeepEnd Research - Library of Malware Traffic Patterns

Update May 6, 2013 We added ability to download corresponding samples and pcaps (when available)

Traffic analysis has been the primary method of malware identification and thousands of IDS signatures developed are the daily proof. Signatures definitely help but ability to visually recognize  malware traffic patterns and see the trends when they change has been always an important skill for anyone tasked with network defense. The number of malware analysis blogs and papers is overwhelming and it is difficult to keep track of malware features if you don't have access to a well designed and constantly updated malware database. This started as "personal notes" spreadsheet with GET and   POST requests for different malware families with information from open sources. We decided others might find it useful too.

>>  read more on DeepEnd Research

CVE-2013-0640 samples listing

This is a detailed MD5 listing of CVE-2013-0640 pdf files that were posted earlier. I got a few requests for samples that were already posted as a pack in this post ( 16,800 clean and 11,960 malicious files for signature testing and research.)  Now you can see them  in all their glory below.
I can post listings for other malware from that large post if there is need and interest.

PDF
MALWARE PDF NEW -170 FILES MALWARE PDF PRE_04-2011_10982_files

• Vinsula. CVE-2013-0640 – Further Investigation into an Adobe PDF Zero-day Malware Attack
• Kaspersky: The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A Micro Backdoor  

CVE-2013-0804 Novell GroupWise 2012 Multiple Untrusted Pointer Dereferences Exploitation by Brian Mariani & Frédéric Bourla

This is another excellent publication by Brian Mariani & Frédéric Bourla (High Tech Bridge) describing their discovery and research of  CVE-2013-0804 Novell GroupWise 2012 Multiple Untrusted Pointer Dereferences Exploitation

CVE-2013-0804
The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.

You can download it from here: High Tech Bridge Novell GroupWise 2012 Multiple Untrusted Pointer Dereferences Exploitation by Brian Mariani & Frédéric Bourla 

16,800 clean and 11,960 malicious files for signature testing and research.

Signature and security product testing often requires large numbers of sorted malicious and clean files to eliminate false positives and negatives. They are not always easy to find, but here are some that I have.

Clean documents are collected from various open sources. All the copyright rights belong the the authors of each document and file. You must not use the documents for their content but only as samples of particular file types.

DarkSeoul - Jokra - MBR wiper samples

If all you needed for happiness is to destroy a few virtual machines, here are the samples for today's headline maker.
The malware overwrites master boot record (MBR) as described here:
* Trojan.Jokra - Symantec
* DarkSeoul: SophosLabs identifies malware used in South Korean internet attack
* South Korean Banks, Media Companies Targeted by Destructive Malware - McAfee
* South Korean Banks and Broadcasting Organizations Suffer Major Damage from Cyber Attack - Symantec.