Wednesday, December 30, 2009

Dec. 29 CVE-2008-3005 / MS08-043 Darkmoon RAT Excel Russia Foreign Minister Meeting from spoofed Dec 2009 06:50:10 -0000

Download the infected Excel file 1229.xls plus extracted bin files as 1229+bin (password protected archive, you need to contact me for the password)


This message was received from a spoofed email address of an official at the Foreign Ministry of Japan. The message came from China, it is crafted to install a remote administration tool known as Darkmoon (similar to  ProRAT). I will post more details as soon as I can.





....................... see the full text in the end of the post. The text is actually copied from the website of the Foreign Ministry of Japan (here is the page from the Google cache)
    Daisuke HASEGAWA
    International Counter-Terrorism Cooperation Division Foreign Policy Bureau, Ministry of Foreign Affairs
    TEL: 03-5501-8000 ext.4180, FAX: 03-5501-8205

Received: from unknown (HELO (
  by xxxxx ; 29 Dec 2009 06:50:10 -0000
Received: from SSSSSS-2F0F04F3[] by
  with SMTP id 2F55449C; Tue, 29 Dec 2009 14:50:01 +0800
From: ""
Subject: =?ISO-2022-JP?B?GyRCRnxPKjMwQWoycUNMRXkbKEI=?=
Content-Type: multipart/mixed;
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Date: Tue, 29 Dec 2009 14:50:11 +0800
X-Mailer: Foxmail 4.2 [cn]

Robtex Whois
CNC Group CHINA169 Tianjin Province Network
China-Network-Communications-Group China Network Communications (CNC Group)

ISP: CNCGROUP Tianjin province network
Organization: CNCGROUP Tianjin province network
Country: China
State/Region: 28
City: Tianjin

File 1229.xls received on 2009.12.29 16:04:15 (UTC)
Result: 4/41 (9.76%)
Authentium 2009.12.29 MSExcel/Dropper.B!Camelot
DrWeb 2009.12.29 Office.Exploit
Norman 6.04.03 2009.12.29 ShellCode.A
TrendMicro 2009.12.29 HEUR_OLEXP.B
File size: 86016 bytes
MD5   : 0e4e3c2d84a9bc726a50b3c91346fbb1 

OfficeMalScanner v0.5
Workbook   [TYPE: Stream - OFFSET: 0x200 - LEN: 13116]
SummaryInformation   [TYPE: Stream - OFFSET: 0x3600 - LEN: 4096]
DocumentSummaryInformation   [TYPE: Stream - OFFSET: 0x3600 - LEN: 4096]
FS:[30h] (Method 1) signature found at offset: 0x37a2
API-Hashing signature found at offset: 0x3ad1
Embedded OLE signature found at offset: 0x10a00
XOR encrypted MZ/PE signature found at offset: 0x5a00 - encryption KEY: 0x97

Sourcefire OFFICE CAT v2
        OCID: 51
        Type: Excel
        Malformed FORMAT record

File 1229__PEFILE__OFFSET_0x5a00__XOR- received on 2009.12.29 16:48:06 (UTC)
Result: 11/41 (26.83%)
AhnLab-V3 2009.12.29 Win-Trojan/Agent.45056.AMQ
Antiy-AVL 2009.12.29 Trojan/Win32.Agent.gen
CAT-QuickHeal 10.00 2009.12.29 Trojan.Agent.cvpr
Comodo 3405 2009.12.29 TrojWare.Win32.Trojan.Agent.~IAZ
Jiangmin 13.0.900 2009.12.29 Trojan/Agent.cule
Kaspersky 2009.12.29 Trojan.Win32.Agent.dbzx
McAfee-GW-Edition 6.8.5 2009.12.29 Heuristic.LooksLike.Trojan.Agent.L
nProtect 2009.1.8.0 2009.12.29 Trojan/W32.Agent.45056.TM
Sophos 4.49.0 2009.12.29 Troj/DarkMoon-B
TrendMicro 2009.12.29 BKDR_POISON.SME
ViRobot 2009.12.29.2114 2009.12.29 Trojan.Win32.Agent.45056.HO
VirusBuster 2009.12.29 -
Additional information
File size: 45056 bytes
MD5   : b6b9a229349244b5129adbc82246f1fa 

 File malicious payload -
Darkmoon RAT (Remote Administration Tool) 

Google Translation

Japanese to English translation
December 28, Minister Okada, in Moscow, Russia Foreign Minister hold talks with Foreign Minister Ravurofu, I met with Presidential Secretary Naruishukin, summary results are as follows.

● In the meeting of Ministers, Minister Okada, want to drive a car like the wheels of political and economic power as Hatoyama, while forward-Russia relations based on Japan-Russia Action Plan, tangible progress on the territorial issue of the attribution of not without some effort at foreign minister level to reach a tangible progress on the territorial issue should not be, want to find support in the form stated Japan's position to be based on the Russian side about the issue of attribution.
● Foreign Ravurofu is for diplomacy between Japan and Russia's foreign policy priorities while explaining that, with regard to the territorial issue, will not artificially delay the resolution, the first international law and must be based on the results of two World War II being said, explain the principles of the Russian position.
● Minister Okada, President Medvedev, Prime Minister Vladimir Putin, should aim to move forward without missing a prime opportunity to have all the faces that Hatoyama, said Foreign Minister should address each other particularly well.
● between Ministers, agreed to initiate a dialogue for peace and stability between Afghanistan and Russia. The early matches hold strategic dialogue with Russia.
● At the meeting with Chief Minister Naruishukin Okada is consistent with the need to accelerate negotiations on the territorial issue. Minister Okada, who introduced the passage from the late Solzhenitsyn advocated to resolve the territorial dispute between Japan and Russia.

1. Japan-Russia foreign ministerial meeting (10 am at half-time)
(1) basic policy on Japan-Russia relations (including the territorial issue.)
(B) the Minister Okada, Hatoyama as the government, at the same time want to move forward to give effect to the political and economic wheels of the car, Pursuant to the place between the two leaders confirmed the tangible progress on the territorial issue attached sheet stated.
In response, Foreign Minister Ravurofu is for diplomacy between Japan and Russia has said diplomacy is a priority effect, was adopted in January 2003 "Japan-Russia Action Plan" is still valid, according to Japan-Russia relations plan stated aim is to develop.
(B) from the Minister Okada, while forward-Russia relations based on Japan-Russia Action Plan, emphasizing that the problem is that there is no tangible progress in the attribution of territorial issues, the two leaders move forward concrete To maximize, we have pointed out the importance of efforts by the two foreign ministers called for the support given the position of Japan in the form of belonging to the Russian side about the issue.
In response, Foreign Minister Ravurofu, with respect to the territorial issue, ① will not artificially delay the resolution, ② of international law and must be based on the results of two World War, ③ the Prime Minister to President Putin, Medvedev also, there is political will to seek a solution acceptable to both, ④ stated to expect that ended in an emotional exchange was seen briefly in the talks both sides.
(C) As a result, the Minister Okada, Japan-Russia relations is more abundant, but the original should be involved, hence there is a territorial dispute that the real relationship of trust and 深Maranai exchanges between Japan and Russia The regrettable fact said, and should discuss the issue of the attribution of the island is now 4, President Medvedev, Prime Minister Vladimir Putin, should aim to move forward without missing a prime opportunity to have all the faces that Hatoyama, so strong among foreign ministers stated and would like to discuss.

(2) initiation of a dialogue towards peace and stability in Russia in Afghanistan
Ministers, to address the threat of terrorism, to support nation-building in Afghanistan, it is important that cooperative efforts by neighboring countries to begin a dialogue for peace and stability in Afghanistan between Russia match.

(3) political dialogue in the future
Japan-Russia Strategic Dialogue (Vice Minister level) early next year we agreed to hold.

(4) the international situation
(B) with regard to North Korea, Foreign Minister Ravurofu, have seen recent signs of softening in the North showed that in view of the idea of dialogue could be resumed soon. The abduction issue, said that there was a clear understanding of the position of the Japanese side.
(B) regarding Iran's nuclear issue, Foreign Minister Ravurofu, the effectiveness of sanctions when they saw a dim future, depending on the response of Iran, and there will be additional discussions about the UN sanctions If the remarks had the effect that Russia is willing to even discuss.

Two. Naruishukin presidential meeting with the minister (13:20 to 14:00)
(1) from the Secretary Naruishukin, "Hatoyama administration and holding hands, want to be a major step forward in relations between Russia Hatoyama administration" had a message to the Prime Minister Hatoyama said. In addition, Rubin said, but it has been an intensive dialogue among leaders this year, which shows the importance of meaningful strategic relationship with Russia, and had said.
(2) from the Minister Okada, Hatoyama during a recent courtesy call on Prime Minister Naruishukin, pointed out that in relation to public opinion in Russia is difficult, the late Mr. Solzhenitsyn (Note) in his book "Among the ruins of Russia" in the in the introduction that will appeal to Russia's interests to resolve the territorial dispute with Japan in the east to get a friend of Russia, delivered personally to the Commissioner of Naruishukin Appendix for reference. Also said the right to convey to President Medvedev.
(Note) widely known as a patriot of Russia. He quoted the words of political repression during Stalin criticized recently by President Medvedev.
(3) from the Minister Okada, the two leaders have a mind is a powerful desire to resolve the territorial dispute in their own generation, as well as a solid effort to give effect to achieve these feelings, in order to accelerate the negotiations The effect should be pointed out that the leadership of the two leaders. In response, Secretary Naruishukin is not stated and should accelerate the work of all officials of the territorial dispute.

Solzhenitsyn's work "among the ruins of Russia" (1998) in describing the relationship between Japan and Russia (excerpt)

"Our government is relieved, the South Kuril Islands (Kuril Islands), the issue has taken a consistent stance. This attitude, however, too stupid, which is inexcusable. The Russian recklessly transferred to Ukraine and Kazakhstan in dozens of states are vast, from the late 80's in my administration has 取Ri入Tsu stage of international politics in the United States. Yet, like other exceptional cases from bigotry and arrogance of patriotism and ESSEY that the return of the Kuril Islands to Japan has refused to come. that Russia had to belong to these islands and was once the ownership of the pre-revolutionary Russia was also claimed that once (Gorovunin captain in the early 19th century, the 1855 Admiral Putyatin was recognized borders are currently claimed by Japan. 1904 attacks in Japan last year, when the domestic game from the interference of Russia's excuse was that he had an injury, which was signed in 1941 expires five years was "neutral" to break the treaty that Japan attacked the Soviet Union, the contempt exactly Should we even arguing with). As if Russia's future is at stake, keep a 抱Ekon these islands. To request the return of these islands are Japan's land is a narrow, national honor, Wei

Because M is related to a major problem. The problem is far beyond the issue of fishery resources in the area. Good agreement was signed a fishery resource issues. In the coming century, could not find a friend to the west and south of Russia, if you will ever feel uncomfortable, good-neighborly relations can be considered fully realized this, and even friendly relations 斥Keru There is no reason for anything. "
Contribute a better translation

No comments:

Post a Comment