Aug 2012 W32.Crisis and OSX.Crisis - JAR file Samples - APT

End of the year presents:
Malicious Java file containing W32.Crisis and OSX.Crisis
Related News and Analysis:
Aug 2012
Crisis for Windows Sneaks onto Virtual Machines - Symantec
New Apple Mac Trojan Called OSX/Crisis Discovered - Intego

CVE-2012-5076 Java sample from "Cool" exploit pack

Here is quick post for a CVE-2012-5076 sample (from Cool pack, as described by Kafeine here Cool EK : "Hello my friend..." CVE-2012-5076 )

DeepEnd Research: Java 7 0-Day vulnerability information and mitigation.

img.kids.discovery.com

The cat is out of the bag. There is 0-day out there currently being used in targeted attacks.  The number of these attacks has been relatively low, but it is likely to increase due to the fact that this is a fast and reliable exploit that can be used in drive-by attacks and all kinds of links in emails. Interestingly, Mark Wuergler mentioned on August 10 that VulnDisco SA CANVAS exploit pack now has a new Java 0-day. It makes you wonder if it is the same exploit that leaked from or was found in the wild and added to the CANVAS pack. Or if it is totally unrelated and there are two 0-day exploits now.

The purpose of this post is not to provide the vulnerability analysis or samples but to offer additional information that may help  prevent infections on some targeted networks.   We all know what kind of damage Java vulnerabilities can cause if used in drive by exploits or exploit packs and we think that revealing technical vulnerability details  in the form of a detailed technical analysis is dangerous, while releasing working exploits before the patch is vain and irresponsible.

Oracle patch cycle is 4 months (middle of February, June, October) with bugfixes 2 months after the patch. The next patch day is October 16 - almost two months away. Oracle almost never issue out-of-cycle patches but hopefully they will do consider it serious enough to do it time.

Read more at DeepEndResearch.org

Java OSX CVE-2012-0507, CVE-2011-3544 and Flashback.35/J sample

Dr. Web published BackDoor.Flashback.39 (Flashback.K-11th variant) epidemic chronology to augment their discovery of the Mac botnet "Doctor Web exposes 550 000 strong Mac botnet".  In general, the Flashback OSX epidemic started on or before August 2011 (F-Secure) with variants distributed as a fake Adobe Flash player. In January 2012, Intego reported Flashback.35/ J (the 10th) which was also distributed as a fake Flash download.

 I am posting here 3 Java exploits used to distribute Flashback trojans:

SAMPLE 1 JAVA CVE-2012-0507 is dated April 4, and appears to be distributing Flashback.35/J - as seen from the payload
SAMPLE 2 is java_signed_applet social engineering exploit (see Michael Schierl's comment below)
and 3 is JAVA CVE-2011-3544 and are dated February 2012.


I don't know which domains distributed these exploits (let me know if you do) but perhaps we are seeing the malware distribution scheme common for Windows-targeting exploit packs

ESET Nod32 false positive on Java

Update March 16, 2011.

Argh, once again, they detect java as malware. If you have a large enterprise and every user clicks "Clean", you  have a lot of computers with damaged Java. Annoying.

Anyway, it is fixed in update 5960. It will not fix the broken java or your nerves but will stop the nagging screens.

Aug 27 SMS Send JAVA Mobile malware

I was planning to do something else tonight when my blackberry buzzed with a new message.Unfortunately, this was not the message I'd like to receive. ICQ spam is common and fairly predictable - invitations to new "cool chat rooms", offers to DDoS my competitors until they revert to using paper and pencil or spam every person on earth for pennies.This one offered a new 3D game called Little Tanks.

Download Tank_3d.jar 6fe6d19f61f2222421c2eda1f8c1dabe  as a password protected archive (contact me if you need the password)

369506328 Теперь новые ТАНЧИКИ 3 Д на телефонах. Скачать можно по ссылке: http:/ /slil.ru/29608317/1326f51.4c78f7e8/Tank_3d.jar
* игра работает только на мобильных


369506328 Now new LITTLE TANKS 3D on phones. You can download it from this link http:/ /slil.ru/29608317/1326f51.4c78f7e8/Tank_3d.jar
* The game works only on mobile phones








Tank_3d\аларм наш

The file appears to be an sms sender like many. Donato Ferrante from InReverse analyzed a similar sample earlier this year.

 File name: Tank_3d.jar
http://www.virustotal.com/file-scan/report.html?id=bc06cf72c2b44f17808dff5b38373486346ea563220a6c7163e1e115f63f0040-1282962855
Submission date: 2010-08-28 02:34:15 (UTC)
Result: 17 /42 (40.5%)
AntiVir 8.2.4.46 2010.08.27 TR/SMS.J2ME.Smmer.f
Antiy-AVL 2.0.3.7 2010.08.26 Trojan/J2ME.Smmer
Avast 4.8.1351.0 2010.08.27 Other:Malware-gen
Avast5 5.0.594.0 2010.08.27 Other:Malware-gen
Comodo 5881 2010.08.28 UnclassifiedMalware
DrWeb 5.0.2.03300 2010.08.28 Java.SMSSend.185
Emsisoft 5.0.0.37 2010.08.27 Trojan-SMS!IK
F-Secure 9.0.15370.0 2010.08.28 Riskware:Java/SmsSend.Gen!A
GData 21 2010.08.28 Other:Malware-gen
Ikarus T3.1.1.88.0 2010.08.27 Trojan-SMS
Kaspersky 7.0.0.125 2010.08.28 Trojan-SMS.J2ME.Smmer.f
Microsoft 1.6103 2010.08.27 Trojan:Java/SMSer.I
NOD32 5403 2010.08.27 probably a variant of J2ME/TrojanSMS.Konov.L
PCTools 7.0.3.5 2010.08.28 Trojan.Gen
Symantec 20101.1.1.7 2010.08.28 Trojan.Gen
TrendMicro 9.120.0.1004 2010.08.27 TROJ_SMMER.B
TrendMicro-HouseCall 9.120.0.1004 2010.08.28 TROJ_SMMER.B
Additional informationShow all 
MD5   : 6fe6d19f61f2222421c2eda1f8c1dabe 

CVE-2009-3867 + CVE-2008-5353 JAVA low detection obfuscated malware

All the credit for this post goes to TomU (c-apt-ure.blogspot.com) .

Also, many thanks to Donato "ratsoul" Ferrante (inReverse.net) for his help with the identification.

FILE 1

CVE-2008-5353 The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

FILE 2

CVE-2009-3867 Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303. 

Download  8d3dc9f89904405efac99d1209a31827 +  c093d9e1354c3c7a7f7dd85ccaa83d74 as a password protected archive (please contact me for the password if you need it)

FILE 1
CVE-2008-5353 The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".


Read more at InReverse JAVA Exploit Kit Malware #1



 File jar_cache5159677240627350244.tmp. received on 2010.07.30 07:02:21 (UTC)
http://www.virustotal.com/analisis/3ab2dd42406dc92e157ad10ae51fd4a05fa2db0787179b9e5a50e4571964be78-1280473341
Result: 1/41 (2.44%)
DrWeb     5.0.2.03300     2010.07.30     Exploit.Java.89
File size: 11062 bytes
MD5   : 8d3dc9f89904405efac99d1209a31827


Low detection is due to obfuscation

FILE 2

CVE-2009-3867 Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303. 

Read more at  inReverse JAVA Sound Malware

 
File jar_cache924482195637021488.tmp.j received on 2010.08.02 04:06:58 (UTC)
http://www.virustotal.com/analisis/41d5826e1c8eae1d8d10e9f3cc5e1fe9e96b17039a3976aabaa21d533b9b859a-1280722018
Result: 1/42 (2.39%)
DrWeb    5.0.2.03300    2010.08.02    Exploit.Java.88
Additional information
File size: 4071 bytes
MD5...: c093d9e1354c3c7a7f7dd85ccaa83d74

 

Low detection is due to obfuscation

Until recently, the detection was 0/41
https://www.virustotal.com/analisis/41d5826e1c8eae1d8d10e9f3cc5e1fe9e96b17039a3976aabaa21d533b9b859a-1280305057
https://www.virustotal.com/analisis/3ab2dd42406dc92e157ad10ae51fd4a05fa2db0787179b9e5a50e4571964be78-1280305067

infected website:  hxxp://www.formel1.de/

malware site:  hxxp://meinvorun.biz/zl/s1/ 

Tom pointed out that the traffic/ URL patterns are similar to those described here Webseite des US-Finanzministeriums gehackt,  where the malware loaded was from Eleonore v.1.3.2. Eleonore 1.4.1 does not contain CVE-2008-5353,  which makes us think these files could be indeed from Eleonore 1.3.2 Another possibility is Phoenix 2.0, which contains the same java exploits (if you figure out which exploit pack is hanging on that IP, let me know)

188.40.232.254

Host names sharing IP are made by a Russian speaker and point to Russian speaking cybercriminals
http://www.robtex.com/dns/meinvorun.biz.html#shared

Ip address 188.40.232.254 is in many blacklists

Phoenix 2.0 Exploit kit

I normally do not post exploit packs, even partial but I am posting it in this case as it appears to be the source of the java files analyzed by InReverse.  Read this for more details and Java analysis.

The other possibility is the Crimepack. Let me know if there are others, I may post them too.

 Download  Phoenix2.zip as a password protected archive (contact me if you need the password)

   

List of included files


AdgredY.java    11895    416ff21ed3ddb4ce5665a4917964c5ce
all.js    5167    9432b83d52fc325f5bda83d58598e825  -- All listed except newplayer cve-2009-4324
deie.html    15097    a88f45102b57595d6c7b1cf2c2b4b241  --
flash.as    2746    718803346bbbed11e934c63af99c4a9f
ie.html    14939    1c8bd04644942a0f1832844ee4b44e63
newplayer.js    2595    a2344d3a54f26ae863011323a0973ac8 newplayer cve-2009-4324

Filename	MD5	File Size		Extension
flash.swf	C643C2B8E901E52C14A8D6CE8096E327	1,645		swf
all.pdf	66BDB0DC68294890E359E91F1EF18D9E	2,677		pdf
allv7.pdf	B948321DE93582951598F3BDDDCC5735	2,465		pdf
collab.pdf	EF68F7B0018EDA2C149EF92EAAA666E2	2,012	CVE-2007-5659	pdf
geticon.pdf	1ED11F0EEE47135067F36E73FD5E889E	2,003	CVE-2009-0927	pdf
libtiff.pdf	E1E581CC0D817A808DC33CEB230F91B4	3,514	CVE-2010-0188	pdf
newplayer.pdf	37F28E5BE542AD2E32DA19EE5C44967C	1,975	CVE-2009-4324	pdf
printf.pdf	AF680ECCA07B3294553F672F78554588	1,907	CVE-2008-2992	pdf
index.js	B07E39D831F8EA3F8BCD84DCC9A60FFF	14,272		js
des.jar	98F5ACDB21E8B8116FE5C7B4BA17D0E9	8,539		jar
ie.html	30C1A7B87C419A1427932773642FEEE7	14,929	CVE-2009-3867	html
index.html	9939596B9BA5ECD4EE5FD648171EF01C	14,462		html
vistaie7.html	E8888E4EDA75F6CE016A5FBA9BE02FA3	14,415		html
vistan7ie8.html	6D11908E6CCC01B14ED0097561853F86	8,747		html
vistan7other.html	3E4B94ED2A6ED5F7FF42165BB165A46B	13,734		html
xpie7.html	EDE58120D8C76212E458898B348D2B80	14,420		html
xpie8.html	A18CCEEE89E13B137C77F88688668CED	8,714		html
xpother.html	355A809F8B5BDE1E511C628DD75CD871	14,129		html

Flash exploits are

CVE-2009-1869
CVE-2007-0071

PDF exploits
 CVE-2007-5659
 CVE-2009-0927
 CVE-2010-0188
 CVE-2009-4324
 CVE-2008-2992

Internet Explorer Exploits
CVE-2009-0806

Java Exploits
CVE-2009-3867
CVE-2008-5353

Let me know if i missed any

Java exploit GetSoundBank Read inReverse Ratsoul's posts for more information here or on their new blog here 
Also, see some malware links with this exploit here

deie.html
MDAC exploit

 Flashloader - using object and embed for different browsers. Read this article for more details http://borodin.livejournal.com/10471.html

Actionscript

 

IE 2010-0806

JAVA from Crimepack

 Download   95f3ec9b3bb5e1792fd604eb6a0b5af0 gsb50  as a password protected archive (contact me if you need the password)


I think, correct me if I am wrong, this exploit was available in Crimepack since at least 2.2.1 , not sure if this is from 2.2.1 or 2.8


File gsb50 received on 2010.05.14 02:44:37 (UTC)
http://www.virustotal.com/analisis/44916e0b40e2b8709a89f1209cceffab9a9bf8e26296ff85236cadd7d7a76258-1273805077
Result: 18/40 (45%)
AhnLab-V3    2010.05.14.00    2010.05.13    JAVA/Exploit
AntiVir    8.2.1.242    2010.05.13    EXP/Java.WebStart
Antiy-AVL    2.0.3.7    2010.05.13    Exploit/Java.CVE-2009-3867
AVG    9.0.0.787    2010.05.13    Generic2_c.XRX
DrWeb    5.0.2.03300    2010.05.14    Exploit.Java.27
eSafe    7.0.17.0    2010.05.13    Win32.Exploit.ByteVe
Ikarus    T3.1.1.84.0    2010.05.14    Exploit.Java.WebStart
Kaspersky    7.0.0.125    2010.05.14    Exploit.Java.CVE-2009-3867.b
McAfee    5.400.0.1158    2010.05.14    Exploit-ByteVerify
McAfee-GW-Edition    2010.1    2010.05.13    Exploit-ByteVerify
NOD32    5113    2010.05.13    OSX/Exploit.Smid.B
Norman    6.04.12    2010.05.13    JAVA/CrimePack.gen
PCTools    7.0.3.5    2010.05.14    Trojan.Generic
Sophos    4.53.0    2010.05.14    Exp/WebStart-A
Sunbelt    6301    2010.05.14    Trojan.Java.Webstart.a (v)
Symantec    20101.1.0.89    2010.05.14    Trojan Horse  -laconic, as usual .. but nothing wrong with it, this covers most them anyway (M)
TrendMicro    9.120.0.1004    2010.05.13    JAVA_WEBSTART.A
TrendMicro-HouseCall    9.120.0.1004    2010.05.14    JAVA_WEBSTART.A
Additional information
File size: 2909 bytes
MD5...: 95f3ec9b3bb5e1792fd604eb6a0b5af0

Malware Links April 2010

• Update This is a file is from Phoenix 2.0 exploit kit and maybe others. Email me if you need other files used by that kit.
• hxxp://xgazz.biz/var/tmp/des.jar Virustotal
  Download 98F5ACDB21E8B8116FE5C7B4BA17D0E9 desr.jar as a password protected archive (contact me if you need the password)  
  
  Details
  
  
   CVE-2009-3867 Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.
 

• hxxp://lindaritchies.com/1.jar Virustotal    
  Download JAR C354C0E11DB8F98EF126063479EF71B1--1. Jar as a password protected archive (contact me if you need the password)  


• hxxp://cupilostax.com/xvxx/bbb.jar contains  a variant of Java/TrojanDownloader.Agent.NAI trojan, which is  CVE-2008-5353 The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".   (thank you, Dave)
  
  
• hxxp://81.235.132.32:81/5ea2992f2357b/setup5046608.exe contains Win32/Koobface.NCT worm.

Apr 13 JAVA Malware evading decompilation by Donato "ratsoul" Ferrante - www.InReverse.net Post #5

The following article was written and published by Donato "ratsoul" Ferrante (www.inreverse.net) on April 13, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010 (this is their new blog - replacing www.inreverse.net) .  DDoS is still in progress today, April 25, 2010. They sent their  demands - remove the analysis articles because it hurts their 'business'.

www.inreverse.net is currently inaccessible, therefore, we are publishing the InReverse java analysis here (this is Post #5) but this time together with the malware samples provided by the InReverse crew.   We ask antivirus and security companies to download, analyze, and develop protection (if you have not done yet).  Thank you.

Donato "ratsoul" Ferrante can be reached at ratsoul -at- inreverse-net

Download 9 files listed below as a password protected archive (please contact me for the password, if you need it)



All Virustotal scan results are from April 25, 2010. Compare to the initial scan results of some of the samples (1/42 a 0/42 - see post #5

1. 8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1                       Virustotal 26/40
2. 7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2                         Virustotal 17/41  
3. 38f083169319d0141532db992d295448.jar  from JAVA Sound malware Post #3                          Virustotal 11/41
4. 52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3                             Virustotal  19/41
5. 3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4                                    Virustotal 20/38
6. a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4                                   Virustotal 21/39
7. d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4                                      Virustotal 16/40
8. 2138bfc0c92b726a13ff5095bd2f2b72.jar  from JAVA Malware evading decompilation Post #5      Virustotal 11/39
9.  a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5      Virustotal 10/40

       

----------------------------------------
Tuesday, April 13, 2010

Donato "ratsoul" Ferrante

www.InReverse.net

 JAVA Malware evading decompilation

Hello,

some days ago Param (thanks!) one of our blog readers sent me a couple of undetected JAVA malwares, which I'm going to analyze, the md5 are:

(Sample 1) 2138bfc0c92b726a13ff5095bd2f2b72
(Sample 2) a0585edf638f5d1c556239d3bfaf08db

At this time, both of this malware have a low detection, the first one 1/42 and the second one 0/42 from VirusTotal.

One of the interesting things is that if you try to decompile these samples by using jD you will get the following notice:

So after a little investigation I figured out the reason. The reason is that jD is unable to handle methods with a large body.

Is it a problem ? No. To proceed with the analysis we can summon JAD. In fact by using JAD we can obtain the full code. Here are some snippets taken from the two samples.

(I will go fast on the analysis, at the end of the post you can find a couple of links with more details about these malwares.)

Sample 1:
([CVE-2009-3867])

Imports reveal a lot of information about what the malware is trying to "use"...

Mar 17 JAVA Malware Family by Donato "ratsoul" Ferrante - www.InReverse.net Post #4

The following article was written and published by Donato "ratsoul" Ferrante (www.inreverse.net) on March 17, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010.  DDoS is still in progress today, April 25, 2010. They sent their  demands - remove the analysis articles because it hurts their 'business'.

www.inreverse.net is currently inaccessible, therefore, we are publishing the InReverse java analysis here (this is Post #4) but this time together with the malware samples provided by the InReverse crew.  We ask antivirus and security companies to download, analyze, and develop protection (if you have not done yet).  Thank you.

Download 9 files listed below as a password protected archive (please contact me for the password, if you need it)


All Virustotal scan results are from April 25, 2010. Compare to the initial scan results of some of the samples (1/42 a 0/42 - see post #5

1. 8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1                       Virustotal 26/40
2. 7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2                         Virustotal 17/41  
3. 38f083169319d0141532db992d295448.jar  from JAVA Sound malware Post #3                          Virustotal 11/41
4. 52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3                             Virustotal  19/41
5. 3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4                                    Virustotal 20/38
6. a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4                                   Virustotal 21/39
7. d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4                                      Virustotal 16/40
8. 2138bfc0c92b726a13ff5095bd2f2b72.jar  from JAVA Malware evading decompilation Post #5      Virustotal 11/39
9.  a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5      Virustotal 10/40

        -----------------------------------------

Wednesday, March 17, 2010

Donato "ratsoul" Ferrante

www.InReverse.net

Wednesday, March 17, 2010

JAVA Malware Family

Hello guys,

do you remember one of my last post about a JAVA malware exploiting a vulnerability related to the deserialization? If not, you can read it here.

In the last days I have found a lot of variants of this malware. I picked for this post the following:

sample 1: 3af7627af6348a76d1bf3b7bf31514e0
sample 2: a022524cb52223a939ba50043d90ff94
sample 3: d45a156c76f3c34bac0cf22cb586fdd1

In this post we will try to discover a quick way to detect this "family" of malware.

Each jar comes with 3 classes as for the original sample that I analyzed. The class names are changed into AdgredY, DyesyasZ, LoaderX, for one of these samples.

First thing to note is about the class names. We can note the following relations:

C1. AppletX is AdgredY;
C2. PayloadX is DyesyasZ;
C3. LoaderX is LoaderX.

The class name length is the same as the original one, also the position of the capital letters is preserved.

Let's proceed.

Here is some snippet of code taken from the Applet subclass of each sample above.

Sample 1.

Mar 7 JAVA Sound Malware by Donato "ratsoul" Ferrante - www.InReverse.net Post #3

Update May 14. The old www.inreverse.net was indefinitely suspended by the provider last month because of the DDoS. The new blog is here http://blog.inreverse.net/ 

It is not clear why the guys behind the DDoS got so upset over the old exploits

The following article was written and published by Donato "ratsoul" Ferrante (www.inreverse.net) on March 7, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010.  DDoS is still in progress today, April 25, 2010. They sent their  demands - remove the analysis articles because it hurts their 'business'.

www.inreverse.net is currently inaccessible, therefore, we are publishing the InReverse java analysis here (this is Post #3) but this time together with the malware samples provided by the InReverse crew.  We ask antivirus and security companies to download, analyze, and develop protection (if you have not done yet).  Thank you.

Download 9 files listed below as a password protected archive (please contact me for the password, if you need it)
All Virustotal scan results are from April 25, 2010. Compare to the initial scan results of some of the samples (1/42 a 0/42 - see post #5

1. 8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1                       Virustotal 26/40
2. 7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2                         Virustotal 17/41  
3. 38f083169319d0141532db992d295448.jar  from JAVA Sound malware Post #3                          Virustotal 11/41
4. 52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3                             Virustotal  19/41
5. 3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4                                    Virustotal 20/38
6. a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4                                   Virustotal 21/39
7. d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4                                      Virustotal 16/40
8. 2138bfc0c92b726a13ff5095bd2f2b72.jar  from JAVA Malware evading decompilation Post #5      Virustotal 11/39
9.  a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5      Virustotal 10/40

        -----------------------------------------

Sunday, March 7, 2010

Donato "ratsoul" Ferrante

www.InReverse.net 

  

JAVA Sound Malware

Hello guys,

I'm sorry for the few posts in the last weeks, but I was quite busy. Today I am going to analyze another interesting JAVA malware.

Our target is a jar, md5: 38f083169319d0141532db992d295448. The jar contains one class: AppletX.  After using a java decompiler on our target, we will get the AppletX class code.

I will report only the relevant parts. Let's go..

Firstly, the malware tries to discover the operating system in use by using System.getProperty("os.name"), then it fills str1 according to the O.S. in use.

At this point the malware proceeds by exploiting a vulnerability located into getSoundBank method [CVE-2009-3867] to execute malicious code on the victim system. It retrieves the parameters: sc and np (meaningful names) and then it uses the following spray method in order to place the shellcode:

As we can see, this function simply converts the parameters into hex and then it calls the real spray method:

Jan 17, 2010 JAVA Mobile Malware #1 by Donato "ratsoul" Ferrante www.InReverse.net Post #2

The following article was written and published by Donato "ratsoul" Ferrante (www.inreverse.net) on January 17, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010.  DDoS is still in progress today, April 25, 2010. They sent their  demands - remove the analysis articles because it hurts their 'business'.

www.inreverse.net is currently inaccessible, therefore, we are publishing the InReverse java analysis here (this is Post #2) but this time together with the malware samples provided by the InReverse crew.  We ask antivirus and security companies to download, analyze, and develop protection (if you have not done yet).  Thank you.

Download 9 files listed below as a password protected archive (please contact me for the password, if you need it)


All Virustotal scan results are from April 25, 2010. Compare to the initial scan results of some of the samples (1/42 a 0/42 - see post #5

1. 8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1                       Virustotal 26/40
2. 7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2                         Virustotal 17/41  
3. 38f083169319d0141532db992d295448.jar  from JAVA Sound malware Post #3                          Virustotal 11/41
4. 52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3                             Virustotal  19/41
5. 3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4                                    Virustotal 20/38
6. a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4                                   Virustotal 21/39
7. d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4                                      Virustotal 16/40
8. 2138bfc0c92b726a13ff5095bd2f2b72.jar  from JAVA Malware evading decompilation Post #5      Virustotal 11/39
9.  a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5      Virustotal 10/40

       
-----------------------------------------

Sunday, January 17, 2010

Donato "ratsoul" Ferrante

www.InReverse.net 

JAVA Mobile Malware #1
Hi guys,

today I will focus on a JAVA mobile malware (md5 is: 7e92d280472ca426aff1c20fbeb8d2db).

It is spread as jar, containing a class with an attractive name. The jar contains three files:


    * a java class (the malware engine);

    * an icon image (it is used in order to be attractive..);

    * an inf file (it is used to extract sms information).


The following is the class code after the usage of jd. I report only relevant parts:

LoadData:

 This method is used to read the inf file in order to fill smsnumber and smstext fields. It uses the first byte of the inf file to know how many sms should be sent.

InputStreamString:

This method is used to read user-defined strings from the inf file.