contagio: CVE-2009-3867

Showing posts with label CVE-2009-3867. Show all posts

Monday, August 2, 2010

CVE-2009-3867 + CVE-2008-5353 JAVA low detection obfuscated malware

All the credit for this post goes to TomU (c-apt-ure.blogspot.com) .

Also, many thanks to Donato "ratsoul" Ferrante (inReverse.net) for his help with the identification.

FILE 1

CVE-2008-5353 The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

FILE 2

CVE-2009-3867 Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.

Download 8d3dc9f89904405efac99d1209a31827 + c093d9e1354c3c7a7f7dd85ccaa83d74 as a password protected archive (please contact me for the password if you need it)

FILE 1
CVE-2008-5353 The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".

Read more at InReverse JAVA Exploit Kit Malware #1

File jar_cache5159677240627350244.tmp. received on 2010.07.30 07:02:21 (UTC)
http://www.virustotal.com/analisis/3ab2dd42406dc92e157ad10ae51fd4a05fa2db0787179b9e5a50e4571964be78-1280473341
Result: 1/41 (2.44%)
DrWeb 5.0.2.03300 2010.07.30 Exploit.Java.89
File size: 11062 bytes
MD5 : 8d3dc9f89904405efac99d1209a31827

Low detection is due to obfuscation

FILE 2

File jar_cache924482195637021488.tmp.j received on 2010.08.02 04:06:58 (UTC)
http://www.virustotal.com/analisis/41d5826e1c8eae1d8d10e9f3cc5e1fe9e96b17039a3976aabaa21d533b9b859a-1280722018
Result: 1/42 (2.39%)
DrWeb 5.0.2.03300 2010.08.02 Exploit.Java.88
Additional information
File size: 4071 bytes
MD5...: c093d9e1354c3c7a7f7dd85ccaa83d74

Low detection is due to obfuscation

Until recently, the detection was 0/41
https://www.virustotal.com/analisis/41d5826e1c8eae1d8d10e9f3cc5e1fe9e96b17039a3976aabaa21d533b9b859a-1280305057
https://www.virustotal.com/analisis/3ab2dd42406dc92e157ad10ae51fd4a05fa2db0787179b9e5a50e4571964be78-1280305067

infected website: hxxp://www.formel1.de/

malware site: hxxp://meinvorun.biz/zl/s1/

Tom pointed out that the traffic/ URL patterns are similar to those described here Webseite des US-Finanzministeriums gehackt, where the malware loaded was from Eleonore v.1.3.2. Eleonore 1.4.1 does not contain CVE-2008-5353, which makes us think these files could be indeed from Eleonore 1.3.2 Another possibility is Phoenix 2.0, which contains the same java exploits (if you figure out which exploit pack is hanging on that IP, let me know)

188.40.232.254

Host names sharing IP are made by a Russian speaker and point to Russian speaking cybercriminals
http://www.robtex.com/dns/meinvorun.biz.html#shared

Ip address 188.40.232.254 is in many blacklists

Friday, May 14, 2010

Phoenix 2.0 Exploit kit

I normally do not post exploit packs, even partial but I am posting it in this case as it appears to be the source of the java files analyzed by InReverse. Read this for more details and Java analysis.

The other possibility is the Crimepack. Let me know if there are others, I may post them too.

Download Phoenix2.zip as a password protected archive (contact me if you need the password)



List of included files

AdgredY.java   11895   416ff21ed3ddb4ce5665a4917964c5ce
all.js   5167   9432b83d52fc325f5bda83d58598e825 -- All listed except newplayer cve-2009-4324
deie.html   15097   a88f45102b57595d6c7b1cf2c2b4b241 --
flash.as   2746   718803346bbbed11e934c63af99c4a9f
ie.html   14939   1c8bd04644942a0f1832844ee4b44e63
newplayer.js   2595   a2344d3a54f26ae863011323a0973ac8 newplayer cve-2009-4324

Filename	MD5	File Size		Extension
flash.swf	C643C2B8E901E52C14A8D6CE8096E327	1,645		swf
all.pdf	66BDB0DC68294890E359E91F1EF18D9E	2,677		pdf
allv7.pdf	B948321DE93582951598F3BDDDCC5735	2,465		pdf
collab.pdf	EF68F7B0018EDA2C149EF92EAAA666E2	2,012	CVE-2007-5659	pdf
geticon.pdf	1ED11F0EEE47135067F36E73FD5E889E	2,003	CVE-2009-0927	pdf
libtiff.pdf	E1E581CC0D817A808DC33CEB230F91B4	3,514	CVE-2010-0188	pdf
newplayer.pdf	37F28E5BE542AD2E32DA19EE5C44967C	1,975	CVE-2009-4324	pdf
printf.pdf	AF680ECCA07B3294553F672F78554588	1,907	CVE-2008-2992	pdf
index.js	B07E39D831F8EA3F8BCD84DCC9A60FFF	14,272		js
des.jar	98F5ACDB21E8B8116FE5C7B4BA17D0E9	8,539		jar
ie.html	30C1A7B87C419A1427932773642FEEE7	14,929	CVE-2009-3867	html
index.html	9939596B9BA5ECD4EE5FD648171EF01C	14,462		html
vistaie7.html	E8888E4EDA75F6CE016A5FBA9BE02FA3	14,415		html
vistan7ie8.html	6D11908E6CCC01B14ED0097561853F86	8,747		html
vistan7other.html	3E4B94ED2A6ED5F7FF42165BB165A46B	13,734		html
xpie7.html	EDE58120D8C76212E458898B348D2B80	14,420		html
xpie8.html	A18CCEEE89E13B137C77F88688668CED	8,714		html
xpother.html	355A809F8B5BDE1E511C628DD75CD871	14,129		html

Flash exploits are

CVE-2009-1869
CVE-2007-0071

PDF exploits
CVE-2007-5659
CVE-2009-0927
CVE-2010-0188
CVE-2009-4324
CVE-2008-2992

Internet Explorer Exploits
CVE-2009-0806

Java Exploits
CVE-2009-3867
CVE-2008-5353

Let me know if i missed any

Java exploit GetSoundBank Read inReverse Ratsoul's posts for more information here or on their new blog here
Also, see some malware links with this exploit here

deie.html
MDAC exploit

Flashloader - using object and embed for different browsers. Read this article for more details http://borodin.livejournal.com/10471.html

Actionscript

IE 2010-0806

Sunday, April 25, 2010

Apr 13 JAVA Malware evading decompilation by Donato "ratsoul" Ferrante - www.InReverse.net Post #5

The following article was written and published by Donato "ratsoul" Ferrante (www.inreverse.net) on April 13, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010 (this is their new blog - replacing www.inreverse.net) . DDoS is still in progress today, April 25, 2010. They sent their demands - remove the analysis articles because it hurts their 'business'.

www.inreverse.net is currently inaccessible, therefore, we are publishing the InReverse java analysis here (this is Post #5) but this time together with the malware samples provided by the InReverse crew. We ask antivirus and security companies to download, analyze, and develop protection (if you have not done yet). Thank you.

Donato "ratsoul" Ferrante can be reached at ratsoul -at- inreverse-net

Download 9 files listed below as a password protected archive (please contact me for the password, if you need it)

All Virustotal scan results are from April 25, 2010. Compare to the initial scan results of some of the samples (1/42 a 0/42 - see post #5

8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1 Virustotal 26/40
7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2 Virustotal 17/41
38f083169319d0141532db992d295448.jar from JAVA Sound malware Post #3 Virustotal 11/41
52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3 Virustotal 19/41
3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4 Virustotal 20/38
a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4 Virustotal 21/39
d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4 Virustotal 16/40
2138bfc0c92b726a13ff5095bd2f2b72.jar from JAVA Malware evading decompilation Post #5 Virustotal 11/39
a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5 Virustotal 10/40

----------------------------------------
Tuesday, April 13, 2010

Donato "ratsoul" Ferrante

www.InReverse.net

JAVA Malware evading decompilation

Hello,

some days ago Param (thanks!) one of our blog readers sent me a couple of undetected JAVA malwares, which I'm going to analyze, the md5 are:

(Sample 1) 2138bfc0c92b726a13ff5095bd2f2b72
(Sample 2) a0585edf638f5d1c556239d3bfaf08db

At this time, both of this malware have a low detection, the first one 1/42 and the second one 0/42 from VirusTotal.

One of the interesting things is that if you try to decompile these samples by using jD you will get the following notice:

So after a little investigation I figured out the reason. The reason is that jD is unable to handle methods with a large body.

Is it a problem ? No. To proceed with the analysis we can summon JAD. In fact by using JAD we can obtain the full code. Here are some snippets taken from the two samples.

(I will go fast on the analysis, at the end of the post you can find a couple of links with more details about these malwares.)

Sample 1:
([CVE-2009-3867])

Imports reveal a lot of information about what the malware is trying to "use"...

Mar 17 JAVA Malware Family by Donato "ratsoul" Ferrante - www.InReverse.net Post #4

The following article was written and published by Donato "ratsoul" Ferrante (www.inreverse.net) on March 17, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010. DDoS is still in progress today, April 25, 2010. They sent their demands - remove the analysis articles because it hurts their 'business'.

www.inreverse.net is currently inaccessible, therefore, we are publishing the InReverse java analysis here (this is Post #4) but this time together with the malware samples provided by the InReverse crew. We ask antivirus and security companies to download, analyze, and develop protection (if you have not done yet). Thank you.

8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1 Virustotal 26/40
7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2 Virustotal 17/41
38f083169319d0141532db992d295448.jar from JAVA Sound malware Post #3 Virustotal 11/41
52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3 Virustotal 19/41
3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4 Virustotal 20/38
a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4 Virustotal 21/39
d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4 Virustotal 16/40
2138bfc0c92b726a13ff5095bd2f2b72.jar from JAVA Malware evading decompilation Post #5 Virustotal 11/39
a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5 Virustotal 10/40

-----------------------------------------

Wednesday, March 17, 2010

Donato "ratsoul" Ferrante

www.InReverse.net

Wednesday, March 17, 2010

JAVA Malware Family
Hello guys,

do you remember one of my last post about a JAVA malware exploiting a vulnerability related to the deserialization? If not, you can read it here.

In the last days I have found a lot of variants of this malware. I picked for this post the following:

sample 1: 3af7627af6348a76d1bf3b7bf31514e0
sample 2: a022524cb52223a939ba50043d90ff94
sample 3: d45a156c76f3c34bac0cf22cb586fdd1

In this post we will try to discover a quick way to detect this "family" of malware.

Each jar comes with 3 classes as for the original sample that I analyzed. The class names are changed into AdgredY, DyesyasZ, LoaderX, for one of these samples.

First thing to note is about the class names. We can note the following relations:

C1. AppletX is AdgredY;
C2. PayloadX is DyesyasZ;
C3. LoaderX is LoaderX.

The class name length is the same as the original one, also the position of the capital letters is preserved.

Let's proceed.

Here is some snippet of code taken from the Applet subclass of each sample above.

Sample 1.

Mar 7 JAVA Sound Malware by Donato "ratsoul" Ferrante - www.InReverse.net Post #3

Update May 14. The old www.inreverse.net was indefinitely suspended by the provider last month because of the DDoS. The new blog is here http://blog.inreverse.net/

It is not clear why the guys behind the DDoS got so upset over the old exploits

The following article was written and published by Donato "ratsoul" Ferrante (www.inreverse.net) on March 7, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010. DDoS is still in progress today, April 25, 2010. They sent their demands - remove the analysis articles because it hurts their 'business'.

www.inreverse.net is currently inaccessible, therefore, we are publishing the InReverse java analysis here (this is Post #3) but this time together with the malware samples provided by the InReverse crew. We ask antivirus and security companies to download, analyze, and develop protection (if you have not done yet). Thank you.

Download 9 files listed below as a password protected archive (please contact me for the password, if you need it)
All Virustotal scan results are from April 25, 2010. Compare to the initial scan results of some of the samples (1/42 a 0/42 - see post #5

8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1 Virustotal 26/40
7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2 Virustotal 17/41
38f083169319d0141532db992d295448.jar from JAVA Sound malware Post #3 Virustotal 11/41
52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3 Virustotal 19/41
3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4 Virustotal 20/38
a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4 Virustotal 21/39
d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4 Virustotal 16/40
2138bfc0c92b726a13ff5095bd2f2b72.jar from JAVA Malware evading decompilation Post #5 Virustotal 11/39
a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5 Virustotal 10/40

-----------------------------------------

Sunday, March 7, 2010

Donato "ratsoul" Ferrante

www.InReverse.net

JAVA Sound Malware

Hello guys,

I'm sorry for the few posts in the last weeks, but I was quite busy. Today I am going to analyze another interesting JAVA malware.

Our target is a jar, md5: 38f083169319d0141532db992d295448. The jar contains one class: AppletX. After using a java decompiler on our target, we will get the AppletX class code.

I will report only the relevant parts. Let's go..

Firstly, the malware tries to discover the operating system in use by using System.getProperty("os.name"), then it fills str1 according to the O.S. in use.

At this point the malware proceeds by exploiting a vulnerability located into getSoundBank method [CVE-2009-3867] to execute malicious code on the victim system. It retrieves the parameters: sc and np (meaningful names) and then it uses the following spray method in order to place the shellcode:

As we can see, this function simply converts the parameters into hex and then it calls the real spray method:

Jan 17, 2010 JAVA Mobile Malware #1 by Donato "ratsoul" Ferrante www.InReverse.net Post #2

The following article was written and published by Donato "ratsoul" Ferrante (www.inreverse.net) on January 17, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010. DDoS is still in progress today, April 25, 2010. They sent their demands - remove the analysis articles because it hurts their 'business'.

www.inreverse.net is currently inaccessible, therefore, we are publishing the InReverse java analysis here (this is Post #2) but this time together with the malware samples provided by the InReverse crew. We ask antivirus and security companies to download, analyze, and develop protection (if you have not done yet). Thank you.

8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1 Virustotal 26/40
7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2 Virustotal 17/41
38f083169319d0141532db992d295448.jar from JAVA Sound malware Post #3 Virustotal 11/41
52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3 Virustotal 19/41
3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4 Virustotal 20/38
a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4 Virustotal 21/39
d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4 Virustotal 16/40
2138bfc0c92b726a13ff5095bd2f2b72.jar from JAVA Malware evading decompilation Post #5 Virustotal 11/39
a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5 Virustotal 10/40

-----------------------------------------

Sunday, January 17, 2010

Donato "ratsoul" Ferrante

www.InReverse.net

JAVA Mobile Malware #1
Hi guys,

today I will focus on a JAVA mobile malware (md5 is: 7e92d280472ca426aff1c20fbeb8d2db).

It is spread as jar, containing a class with an attractive name. The jar contains three files:

    * a java class (the malware engine);

    * an icon image (it is used in order to be attractive..);

    * an inf file (it is used to extract sms information).

The following is the class code after the usage of jd. I report only relevant parts:

LoadData:

This method is used to read the inf file in order to fill smsnumber and smstext fields. It uses the first byte of the inf file to know how many sms should be sent.

InputStreamString:

This method is used to read user-defined strings from the inf file.

Jan 5 JAVA Exploit Kit Malware #1 by Donato "ratsoul" Ferrante - www.InReverse.net Post #1

The following article was written and published by Donato "ratsoul" Ferrante (http://www.inreverse.net/) on January 5, 2010. His recent java analysis publications attracted attention of the exploit kit owners who launched a heavy DDoS attack on April 16, 2010. DDoS is still in progress today, April 25, 2010. They sent their demands - remove the analysis articles because it hurts their 'business'.

http://www.inreverse.net/ is currently inaccessible, therefore, we are publishing all InReverse java articles here (this is Post #1) but this time together with the malware samples provided by the InReverse crew.

8d499308df04932ed1b58a78417d6fb9.jar from JAVA Exploit Kit Malware #1 Post #1 Virustotal 26/40
7e92d280472ca426aff1c20fbeb8d2db.jar from JAVA Mobile Malware #1 Post #2 Virustotal 17/41
38f083169319d0141532db992d295448.jar from JAVA Sound malware Post #3 Virustotal 11/41
52586e8a85188a0ada59294650c91362.jar from JAVA Sound malware Post #3 Virustotal 19/41
3af7627af6348a76d1bf3b7bf31514e0.jar from JAVA malware family Post #4 Virustotal 20/38
a022524cb52223a939ba50043d90ff94.jar from JAVA malware family Post #4 Virustotal 21/39
d45a156c76f3c34bac0cf22cb586fdd1.jar from JAVA malware family Post #4 Virustotal 16/40
2138bfc0c92b726a13ff5095bd2f2b72.jar from JAVA Malware evading decompilation Post #5 Virustotal 11/39
a0585edf638f5d1c556239d3bfaf08db.jar from JAVA Malware evading decompilation Post #5 Virustotal 10/40

--------------------------------------------------

Tuesday, January 5, 2010

http://www.inreverse.net/.

Donato "ratsoul" Ferrante

JAVA Exploit Kit Malware #1

This is my first blog post of the new year. New year new target!
I am going to analyze a JAVA exploit kit malware, the md5 is: 8d499308df04932ed1b58a78417d6fb9.

Since our target is a jar, containing three class files, we try to get more information about it by using a java decompiler (i.e. jd).

After decompilation, we have a java package that contains three classes:

C1. AppletX.java

C2. LoaderX.java

C3. PayloadX.java

C1. AppletX.java

Here we have an Applet subclass that mainly does three things:

It deserializes a serialized object;

It grabs a couple of information via applet parameters: data and cc;

It plays with a custom class loader named: LoaderX.

The most interesting part is the serialized object obviously.
Do you have any idea about the usage of the serialized object in the above code ?

Well, I will lead you to the right answer. Please just focus on the above AppletX code. If you pay attention to the above code, you can see the initialization of localObject, it is located just above the if test. But we can't see any sort of explicit initialization for LoaderX.instance. In fact the initialization lies in the deserialization routine... nice eh ?

Here is a visual recap:

Let's examine the custom class loader now.

Pages

Monday, August 2, 2010

Friday, May 14, 2010

Sunday, April 25, 2010

Wednesday, March 17, 2010

JAVA Exploit Kit Malware #1