OSX malware and exploit collection (~100 files) + links and resources for OSX malware analysis

'Tis the season.

Here is a nice collection of ~100 Mac OS malware and Word document exploits carrying MacOS payload (all are CVE-2009-0563) along with links for OSX malware analysis.

Please send your favorite tools for OSX if they are not listed.

CVE-2009-0563

CVE-2009-0563
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."

Links

Some OSX malware analysis tools and links 

• http://computer-forensics.sans.org/community/papers/gcfa/mac-os-malware-analysis_2286
• http://en.wikibooks.org/wiki/Reverse_Engineering/Mac_OS_X
• http://contagiodump.blogspot.com/2012/12/osxdockstera-and-win32trojanagentaxmo.html

Tools

• Activity Monitor (Max OSX Utilities folder)
• MacMemoryze (support for Mountain Lion) free, 
• Volatility (partial support for Mountain lion) free
• fseventer (graphical event representation) - works on Mountain lion 
• Wireshark
• IDA pro
• OSXpmem (kernel extension)
• http://osxbook.com/ OSX internals
• 2009 Mac OS X Malware Analysis Author: Joel Yonts
• Apple OS X ABI Mach-O File Format Reference  
• FileXray $79 but looks like it is worth it if you do OSX forensics
• ...let us know what you use

Malware in the provided package - links to research and news articles

• OSX_AoboKeylogger http://aobo.cc/
• OSX_BackTrack-A
• OSX_Boonana http://contagiodump.blogspot.com/2010/11/nov-14-javaboonana-facebook-trojan.html
• OSX_ChatZum http://www.thesafemac.com/chatzum-discovered-in-another-installer/
• OSX_Clapzok http://www.intego.com/mac-security-blog/clapzok-a-multi-platform-virus/ 
• OSX_Crisis http://www.intego.com/mac-security-blog/new-apple-mac-trojan-called-osxcrisis-discovered-by-intego-virus-team/
• OSX_Dockster_Backdoor http://contagiodump.blogspot.com/2012/12/osxdockstera-and-win32trojanagentaxmo.html
• OSX_FkCodec http://www.thesafemac.com/osxfkcodec-a-in-action/
• OSX_Flashback http://www.symantec.com/security_response/writeup.jsp?docid=2012-041001-0020-99
• OSX_Fucobha_IceFog http://www.securelist.com/en/blog/208214064/The_Icefog_APT_A_Tale_of_Cloak_and_Three_Daggers
• OSX_GetShell http://www.symantec.com/security_response/writeup.jsp?docid=2013-020412-3611-99
• OSX_Hacktool_Hoylecann
• OSX_HellRaiser http://macscan.securemac.com/hellraiser-aka-osxhellrtsd/
• OSX_HellRTS http://macscan.securemac.com/hellraiser-aka-osxhellrtsd/
• OSX_Hovdy_Backdoor http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/OSX~Hovdy-A.aspx
• OSX_Inqtana http://www.symantec.com/security_response/writeup.jsp?docid=2006-021715-3051-99&tabid=2
• OSX_Iservice http://www.symantec.com/connect/blogs/osxiservice-it-s-not-going-iwork-you
• OSX_Jahlav http://macscan.securemac.com/osxjahlav-c-dnschanger-trojan-horse/
• OSX_Kitmos http://blog.sbarbeau.fr/2013/05/osx-kitmos-analysis.html
• OSX_Lamadai http://www.welivesecurity.com/2012/03/28/osxlamadai-a-the-mac-payload/
• OSX_Leverage_A_Backdoor http://www.alienvault.com/open-threat-exchange/blog/osx-leveragea-analysis
• OSX_LocalRoot https://www.trustedsec.com/august-2013/osx-10-8-4-local-root-privilege-escalation-exploit/
• OSX_Macarena_A http://www.securelist.com/en/analysis/204791948/Mac_OS_X#macarena
• OSX_MacDefender http://www.intego.com/mac-security-blog/macdefender-rogue-anti-malware-program-attacks-macs-via-seo-poisoning/
• OSX_MacKontrol http://www.securelist.com/en/blog/208193616/New_MacOS_X_backdoor_variant_used_in_APT_attacks
• OSX_Macsweeper http://en.securitylab.ru/viruses/311798.php
• OSX_Miner_DevilRobber http://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/OSX~Miner-D/detailed-analysis.aspx
• OSX_Olyx_Backdoor http://contagiodump.blogspot.com/2011/07/jul-25-mac-olyx-gh0st-backdoor-in-rar.html
• OSX_OpinionSpy http://www.f-secure.com/sw-desc/spyware_osx_opinionspy.shtml
• OSX_PSides
• OSX_Genieo http://www.thesafemac.com/malicious-genieo-installers-persist/
• OSX_PUP_PerfectKeylog http://www.blazingtools.com/mac_keylogger.html
• OSX_Renepo / Pintsized http://www.intego.com/mac-security-blog/pint-sized-backdoor-for-os-x-discovered/
• OSX_Revir http://contagiodump.blogspot.com/2012/11/group-photoszip-osxrevir-osximuler.html
• OSX_Safari
• OSX_SniperSpy http://www.sniperspymac.com/download.html
• OSX_Wirenet http://www.webroot.com/blog/2012/09/14/wirenet-the-password-stealing-trojan-lands-on-linux-and-os-x/
• OSX_Yontoo http://www.macrumors.com/2013/03/21/new-yontoo-adware-trojan-targets-major-browsers-on-os-x/
• OSXWeapoX http://www.virusradar.com/OSX_Rootkit.Weapox.A/description
• ------------------------------------
• CVE-2009-0563 Word exploit

• MacControl payload  http://www.securelist.com/en/blog/208193616/New_MacOS_X_backdoor_variant_used_in_APT_attacks
• OSX.SabPub payload http://www.securelist.com/en/blog/208193470/New_Version_of_OSX_SabPub_Confirmed_Mac_APT_attacks
• OSX/Dockster.A payload  http://www.intego.com/mac-security-blog/new-targeted-attack-on-tibetan-activists-using-os-x-discovered/
• OSX_Docklight payload  http://contagioexchange.blogspot.com/2012/05/019-speechdoc-macosxms09-027a-word.html and http://blogs.technet.com/b/mmpc/archive/2012/04/30/an-interesting-case-of-mac-osx-malware.aspx

DeepEnd Research: List of malware pcaps, samples, and indicators for the Library of Malware Traffic Patterns

The library of malware traffic patterns have been popular. We found it very useful as well ourselves and we encourage you to send your contributions. I know at some point the spreadsheet will become unwieldy but I personally find it the most easy way (easy sort, search etc)

Currently, most of the samples described have the corresponding samples and pcaps available for download (email Mila @contagio for the password)

such as you see in the links below

http://bit.ly/crimesamples | http://bit.ly/crimepcaps

http://bit.ly/aptsamples | http://bit.ly/aptpcaps

>>>> VIEW OR DOWNLOAD "MALWARE TRAFFIC PATTERNS"   <<<<

Email us at mila [a t ] Deependresearch.org or adimino [a t] deependresearch.org

The current list of malware described (as of Aug. 9, 2013)

Defcon 21 Archives Speaker Materials

Hope it is not a copyright violation and won't cause too much hate. I know Defcon will post better and complete data soon but many / most attendees did not receive the presentation CDs to their great sadness because there were not enough CDs available for all. Many authors and attendees published Defcon and Blackhat presentations online as well -you can track them via Twitter

You can download it here for now. Check Defcon website often, they will post it soon. The list of files of the speaker materials is below. The zip file also includes short stories. Please note that some presentations submitted for the DVD were somewhat / significantly different from what was presented. But better this than nothing, right?


SPEAKER MATERIALS - LIST OF PRESENTATIONS

REPRINT of http://contagiodump.blogspot.com/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html Sandbox MIMIng. CVE-2012-0158 in MHTML samples and analysis Unpublished May 27, 2024

Wikipedia

Update - Sept 4, 2013
I added more descriptions and changed NjRat / Backdoor.LV to Vidgrab - in the traffic communications are similar to NjRat/Backdoor;lv but it does not use base64 and sends initial request starting with ...3 (0x01 0x00 0x00 0x00 0x33) followed by null bytes  - it does not start with  lv|

I am still looking for names for a few other backdoors below, so if you recognize them, please let me know. 

Recently, my custom sandbox has been trying to open some Word attachments in a browser because the filetype fingerprint service detected them as MIME HTML files. Browsers are usually the default applications for such types and they did contain the CVE-2012-0158 exploit. A quick Google lookup yielded a May 2013 report from the Chinese company Antiy  "The Latest APT Attack by Exploiting CVE-2012-0158 Vulnerability", which described this new exploit vector.
Antiy noted that these MHTML files evade antivirus and indeed only half of vendors represented on Virustotal detect. However, many companies rely on their automated tools, inline and standalone sandboxes not just Antivirus to determine if the file is malicious.

I checked how these files (file without any extension) were processed by other commercial and open source mailboxes. 3 out of 5 well known commercial and open source mail scan and web sandbox vendors returned no output or informed me that that filetype was not supported. While writing this post, I noticed that Malwaretracker also mentioned the rise in this vector usage in his post on Friday, so I am sure the sandbox vendors are fixing the issue as we speak.

I checked 25 MHTML CVE-2012-0158 files and compared their targets (at least those I could obtain) and payload. The analysis showed a good variety of trojans and predominantly human rights (Tibet, Uyghur) activists. I will post a month worth of these files.

DeepEnd Research: Under this rock... Vulnerable Wordpress/Joomla sites... Overview of the RFI botnet malware arsenal

Exploits directed at Wordpress and/or Joomla content management systems(CMS) have been increasing at a dramatic rate over the past year. Internet blogs and forums are flooded with posts about hacked CMS installations. Popular jargon refers to the attackers as "hackers", but it is generally understood that these mass compromises are being performed via automated scanners and tools. However, we believe that there is not enough coverage of the actual malware involved.

One such infection scheme is essentially the following:

A downloader trojan  (Mutopy  - Win32) (20a6ebf61243b760dd65f897236b6ad3 Virustotal) instructs the infected host to download:
1) Remote File Injector "Symmi" (Win32) 7958f73daf4b84e3b00e008258ea2e7a Virustotal 
2) SDbot (Win32) - aaee52bfb589f6534c4b51e3b144dc08 Virustotal 
3) PHP scripts for injecting into compromised Wordpress sites. Among them a PHP spambot (victimized site owners often get alerted about copious amount of meds and spam porn emanating from their sites). This is also the source of varied links for spam using thousands of various links redirecting to the same sites (e.g. weightloss, work at home scams, or porn sites)

Read more at DeepEnd Research>>>

Download files (see below)

DeepEnd Research - Library of Malware Traffic Patterns

Update May 6, 2013 We added ability to download corresponding samples and pcaps (when available)

Traffic analysis has been the primary method of malware identification and thousands of IDS signatures developed are the daily proof. Signatures definitely help but ability to visually recognize  malware traffic patterns and see the trends when they change has been always an important skill for anyone tasked with network defense. The number of malware analysis blogs and papers is overwhelming and it is difficult to keep track of malware features if you don't have access to a well designed and constantly updated malware database. This started as "personal notes" spreadsheet with GET and   POST requests for different malware families with information from open sources. We decided others might find it useful too.

>>  read more on DeepEnd Research

CVE-2013-0640 samples listing

This is a detailed MD5 listing of CVE-2013-0640 pdf files that were posted earlier. I got a few requests for samples that were already posted as a pack in this post ( 16,800 clean and 11,960 malicious files for signature testing and research.)  Now you can see them  in all their glory below.
I can post listings for other malware from that large post if there is need and interest.

PDF
MALWARE PDF NEW -170 FILES MALWARE PDF PRE_04-2011_10982_files

• Vinsula. CVE-2013-0640 – Further Investigation into an Adobe PDF Zero-day Malware Attack
• Kaspersky: The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A Micro Backdoor  

CVE-2013-0804 Novell GroupWise 2012 Multiple Untrusted Pointer Dereferences Exploitation by Brian Mariani & Frédéric Bourla

This is another excellent publication by Brian Mariani & Frédéric Bourla (High Tech Bridge) describing their discovery and research of  CVE-2013-0804 Novell GroupWise 2012 Multiple Untrusted Pointer Dereferences Exploitation

CVE-2013-0804
The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.

You can download it from here: High Tech Bridge Novell GroupWise 2012 Multiple Untrusted Pointer Dereferences Exploitation by Brian Mariani & Frédéric Bourla 

16,800 clean and 11,960 malicious files for signature testing and research.

Signature and security product testing often requires large numbers of sorted malicious and clean files to eliminate false positives and negatives. They are not always easy to find, but here are some that I have.

Clean documents are collected from various open sources. All the copyright rights belong the the authors of each document and file. You must not use the documents for their content but only as samples of particular file types.

DarkSeoul - Jokra - MBR wiper samples

If all you needed for happiness is to destroy a few virtual machines, here are the samples for today's headline maker.
The malware overwrites master boot record (MBR) as described here:
* Trojan.Jokra - Symantec
* DarkSeoul: SophosLabs identifies malware used in South Korean internet attack
* South Korean Banks, Media Companies Targeted by Destructive Malware - McAfee
* South Korean Banks and Broadcasting Organizations Suffer Major Damage from Cyber Attack - Symantec.

Mandiant APT1 samples categorized by malware families

Update: May 19, 2018
APT 1 resources
Threat Actor aliases:
Comment Crew, Comment Panda, PLA Unit 61398, TG-8223, APT 1,           BrownFox,Group 3,GIF89a, ShadyRAT, Shanghai Group, Byzantine Candor

http://apt.threattracking.com

• 2010_11_Fireeye_VinSelf - A new backdoor in town! « VinSelf - A new backdoor in town! _ FireEye Inc.pdf
• 2010_12_Guardian_WikiLeaks cables reveal fears over Chinese cyber warfare _ US news _ The Guardian.pdf
• 2011_08_Ira Winkler_ Shady Rat Case Shows Vendors As Big a Problem As APT Itself _ CIO.pdf
• 2011_08_Kaspersky's Thoughts on Operation Shady Rat _ Nota Bene_ Eugene Kaspersky's Official Blog.pdf
• 2011_10_SANS_detailed-analysis-advanced-persistent-threat-malware-33814.pdf
• 2011_Mcafee-operation-shady-rat1.pdf
• 2012_06_Bloomberg_Hackers Linked to China’s Army Seen From EU to D.C. - Bloomberg.pdf
• 2013_02_NYTimes_China’s Army Is Seen as Tied to Hacking Against U.S.pdf
• 2013_03_Fireeye_TABMSGSQL and 44 WEBC2-YAHOO_The Dingo and the Baby « The Dingo and the Baby _ FireEye Inc.pdf
• 2013_05_Fireeye_APT1 Three Months Later.pdf
• 2013_05_Mandiant-APT1_Exposing One of China’s Cyber Espionage Units.pdf
• 2014_05_Fireeye_The PLA and the 8_00am-5_00pm Work Day_ FireEye Confirms DOJ's Findings on APT1 Intrusion Activity « The PLA and the 8_00am-5_00pm Work Day_ FireEye Confirms DOJ's Findings on APT1 Intrusion Activity _ FireEye Inc.pdf
• 2014_06_Crowdstrike_Hat-tribution to PLA Unit 61486 ».pdf
• 2014_12_Vinself now with steganography - Airbus CyberSecurity.pdf
• 2016_BANGAT_malware-signatures_bangat.yara at master · citizenlab_malware-signatures.pdf
• GIF89a_Vinselfdecoder_malwaretracker.com_ Command and Control Decoder - Vinself Trojan.pdf
• PLA Unit 61398 _ Council on Foreign Relations Interactives.pdf

These are the samples described in the Mandiant Report APT1, in the Indicators of Compromise (IOCs). Each file is named according to the malware family, so you can run your own detection and signature tools to see how your naming convention corresponds to the one used by Mandiant.

You can use these binaries to develop signatures, compare to your samples, or study the behavior and evolution of APT1.
I added Contagio samples in several families as well.
The list of binaries and their names, as well as malware families descriptions are provided below for your convenience.

Linux/CentOS SSHd Spam Exploit — libkeyutils.so.1.9 - sample

Someone shared a sample of the Linux rootkit affecting servers running CloudLinux, CentOS & cPanel.

Here are the links:

• Feb 20-18 - Webhostingtalk SSHD Rootkit Rolling around
• Feb 18, 2013  0day Linux/CentOS SSHd Spam Exploit — libkeyutils.so.1.9 http://blog.solidshellsecurity.com/
• Feb 8, 2013 SSHD Spam Rootkit /lib64/libkeyutils.so.1.9

Jan 2013 Shylock (skype version) sample

In January 2013,  Iurii Khvyl and Peter Kruse from CSIS posted analysis of Shylock variant capable of spreading through Skype.

You can read their research here Shylock calling Skype. The sample is below

Jan 2013 - Linux SSHDoor - sample

Just a few accumulated samples here found and shared by others. This one is for Linux SSHDoor malware, which can steal your SSH passwords. ESET covered that in detail in Linux/SSHDoor.A Backdoored SSH daemon that steals passwords ( 24 JAN 2013)

The related Linux.Chapro.A sample was posted earlier this year as well

Manipulating Memory for Fun and Profit by Frédéric Bourla - High-Tech Bridge

I am sure you remember excellent reverse engineering presentations by High-Tech Bridge experts I posted earlier.  High-Tech Bridge presented  at the ISACA event in Luxembourg and you can download their detailed and very interesting presentation:  “Manipulating Memory for Fun and Profit".
The presentation includes detailed memory forensics process using Volatility

by Frédéric BOURLA
Chief Security Specialist
Head of Ethical Hacking & Computer Forensics Departments
High-Tech Bridge SA


Table of Contents
0x00 - About me
0x01 - About this conference
0x02 - Memory introduction
0x03 - Memory manipulation from an offensive angle
0x04 - Memory manipulation from a defensive angle
0x05 - Conclusion


Download the full presentation in PDF 

The text of the presentation (for Google search and to get an idea about the contents:)

Trojan 'Nap" aka Kelihos/Hlux status update by DeepEnd Research and samples

FireEye posted details about the sleep function found in Kelihos/Hlux (An encounter with Trojan Nap), which is interesting, and indeed is present in some of the samples we saw. The trojan, of course, has many more features, and most of them were documented in previous publications online. This post is a quick update on the state of Kelihos/Hlux botnet, along with  the list of known fast flux domains (1500+) associated with with Kelihos distribution or Command&Control. (current > 2012).  The current and most active name servers are pointing to the ns[1-6].boomsco.com, ns[1-6].larstor.com, and ns[1-6].zempakiv.ru which are also fast flux domains. The double fast flux nature of the botnet makes it very difficult to take down, and sinkholing is a temporary measure. Despite the two large attempts to take it down (Sep.2011 and Mar. 2012), the botnet is definitely on the rise again.

Please read the rest of our post here http://www.deependresearch.org/2013/02/trojan-nap-aka-kelihoshlux-feb-2013.html. 

You can download the associated binaries (97 files) and pcap below.

Dec 2012 Batchwiper Samples

Update: Jan 18, 2013 - Here is a nice analysis BatchWiper  Analysis by Emanuele De Lucia
The next time the virus will wake up is Jan 21, 2013. Time to grab it, read and play.

Several people asked for Batchwiper, so here are the samples.
From Maher - Iranian CERT:

Latest investigation have been done by Maher center in cyber space identified a new targeted data wiping malware. Primitive analysis revealed that this malware wipes files on different drives in various predefined times. Despite its simplicity in design, the malware is efficient and can wipe disk partitions and user profile directories without being recognized by anti-virus software. However, it is not considered to be widely distributed. This targeted attack is simple in design and it is not any similarity to the other sophisticated targeted attacks. The identified components of this threat are listed in the following table:

Name	MD5
GrooveMonitor.exe [dropper]	f3dd76477e16e26571f8c64a7fd4a97b
juboot.exe	fa0b300e671f73b3b0f7f415ccbe9d41
jucheck.exe	c4cd216112cbc5b8c046934843c579f6
SLEEP.EXE	ea7ed6b50a9f7b31caeea372a327bd37
WmiPrv.exe	b7117b5d8281acd56648c9d08fadf630

ZeroAccess / Sirefef Rootkit - 5 fresh samples

Stocking stuffers.
ZeroAccess rootkit is far from new and exciting but but this is a fresh lot with still active C2 servers.
Although the dropper is detected by at least half of AV engines, post infection detection is another story. I tried Kaspersky TDSS Killer, Avast Rootkit utility and RootRepeal without any success. I used Gmer and LordPE to carve out the hidden file from the memory. You can use Redline or Volatility too.
You can download 5 files below together with pcaps from one of the files and the file dumped from memory. It appears that free videos and apps names are used as the lure in this case.

* * * Merry Christmas and Happy New Year! * * *

More presents to come, pa rum pum pum pum
    rum pum pum pum, rum pum pum pum

Dec 2012 Linux.Chapro - trojan Apache iframer

Here is another notable development of 2012 - Linux malware (see Wirenet trojan posted earlier too)
Research: ESET Malicious Apache module used for content injection: Linux/Chapro.A
All the samples are below. I did not test it thus no pcaps this time.
------Linux/Chapro.A  e022de72cce8129bd5ac8a0675996318
------Injected iframe    111e3e0bf96b6ebda0aeffdb444bcf8d
------Java exploit         2bd88b0f267e5aa5ec00d1452a63d9dc
------Zeus binary         3840a6506d9d5c2443687d1cf07e25d0

Dec. 2012 Trojan.Stabuniq samples - financial infostealer trojan

Holiday presents.
Research: Symantec. Trojan.Stabuniq Found on Financial Institution Servers
More research: Stabuniq in-Depth  by Emanuele De Lucia

Here is a another minor news maker of 2012.
It is very well detected by most AV but if you want to play or make IDS or yara signatures, the pcap and the sample is below.

Dec 2012 Dexter - POS Infostealer samples and information

End of the year presents. Point of Sale (POS) infostealer, aka Dexter.
I got 3 more "tester-type" samples and added them below - in addition to the well known 4 samples mentioned by Seculert.
You can read more about it here:
Seculert Dexter - Draining blood out of Point of Sales 
TrendMicro Infostealer Dexter Targets Checkout Systems
Verizon: Dexter: More of the same, or hidden links?
Volatility labs Unpacking Dexter POS "Memory Dump Parsing" Malware
Trustwave labs: The Dexter Malware: Getting Your Hands Dirty
Symantec Infostealer.Dexter

Aug 2012 - Hikit APT rootkit sample

End of the year presents:

This is a sample of Hikit rootkit 
Aug 2012
Related News and Analysis:
The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 1) - Mandiant

Aug 2012 W32.Crisis and OSX.Crisis - JAR file Samples - APT

End of the year presents:
Malicious Java file containing W32.Crisis and OSX.Crisis
Related News and Analysis:
Aug 2012
Crisis for Windows Sneaks onto Virtual Machines - Symantec
New Apple Mac Trojan Called OSX/Crisis Discovered - Intego

Nov 2012 Worm Vobfus Samples

End of the year presents:
This is a sample of W32.Vobfus / Worm_Vobfus

Related News and Analysis:
Nov 2012  
Trend Micro What’s the Fuss with WORM_VOBFUS?

Nov 2012 - Backdoor.W32.Makadocs Sample

End of the year presents:
These is a sample of W32.Makadocs
Related News and Analysis:
November 2012
Malware Targeting Windows 8 Uses Google Docs | Symantec
Backdoor.Makadocs | Symantec

Aug 2012 Backdoor.Wirenet - OSX and Linux

End of the year presents:
Backdoor.Wirenet.1
Related News and Analysis:
August 2012
The first Trojan in history to steal Linux and Mac OS X passwords  Dr.Web

Nov 2012 - W32.Narilam Sample

End of the year presents:
This is a sample of W32.Narilam 

Related News and Analysis:
Nov 2012 (malware is much older but re-surfaced in Nov 2012)
W32.Narilam – Business Database Sabotage
W32.Narilam | Symantec

Oct 2012 - Skype Dorkbot / W32.Phopifas samples

End of the year presents:
These are 4 samples of Skype Dorkbot / W32.Phopifas
Related News and Analysis:
October 2012
Infection Spreads Profile Pic Messages to Skype Users -GFI
W32.Phopifas | Symantec

OSX/Dockster.A and Win32/Trojan.Agent.AXMO Samples, pcaps, OSX malware analysis tools

Img.baronet4tibet. Tibetan furniture
 featuring a leopard and a lion

Better late than never. Here are the samples of the recent twin newsmakers OSX/Dockster.A and Win32/Trojan.Agent.AXMO.  The malware was already described and hashes published but I thought I would add traffic captures and samples themselves.

 I ran these samples on Thursday, November 29  (OSX) and Friday, November 30 (Agent.AXMO) when the C&C servers were still online. Intego mentioned the address itsec.eicp.net was not registered and it was possibly a test but it is a dynamic DNS address and it was down by the weekend.Credit for the sample goes to an anonymous Santa. 

I have to admit that my knowledge of  OSX malware leaves much to be desired. When we deal with Windows malware, range of choices for capturing, logging, recording, and analyzing is similar to this. I cannot name more than a few for MAC OSX - Wireshark, native Apple syslogs, IDA, Macmemoryze from Mandiant, and a few more below. If you have some good recent papers and tools lists for OSX malware analysis please share.

Read more here
http://www.f-secure.com/weblog/archives/00002466.html

Common Exploit Kits 2012 Poster (based on Exploit pack table Update 18, Nov 12, 2012)

Update November 14, 2012
1. We forgot to mention that in the best tradition of the Antivirus industry, all posters come with one (1) year of free updates. Email us when a new version of the poster comes out ( use same email address or reply to the original message) and we will send you the file (same size you ordered, in JPG format). We cannot reprint Zazzle posters but you can use your own printing, or upload and order your own from Zazzle.

2. We added two more sizes for smaller wall spaces and budgets (asking for $15 and $10 to be donated to charity )

Hurricane Sandy, Jersey Shore
Src. Twitter Oct 28,2012
 author unknown

This update to the exploit pack table comes in the form of a poster (Exploit pack table update 18 is coming soon too).
The poster includes most common exploit packs of 2012. The poster will be updated and new issues posted in the future.







Poster sizes: 

If you wish to order a larger poster print,  (up to 60"x40" or 152cm x 101cm), follow this link to Zazzle.com 
Zazzle cancelled orders due to logos in fish images, despite the fact that their use falls under "Nominative Fair use" policy  (Read: "Lawful use of another's trademark") and we make zero money on it. Here is an example of PC magazine using it lawfully to compare browsers  - they also publish and sell their magazine is stores.
We filed a complaint with Zazzle. But even if they don't cancel,  Zazzle is also very overpriced so you are likely to find cheaper ways to print it. so we do not recommend using it anymore.

If Zazzle cancelled your order, email us and we will send you the full file for free. 

 Staten Island Hurricane Sandy Relief (Staten Island Project Hospitality).

See Staten Island hurricane aftermath photos here:

Time.com   NY Times

• If you wish to use your own printing services and/or need multiple copies, you can request the poster file (see sizes below)  in exchange for donation to the Hurricane Relief  or a charity of your choice. Email us (admin at deependresearch.org) a receipt of a donation made in the past month (you can partially hide/obscure your personal info, if needed) and we will send you the file.
• 8900 x 6000 px = up to 40" x 60"      (101 x 150 cm) = $25  Donate here or charity of your choice
• 5340 x 3600 px = up to 24" x 35.6"   (~ 61 x 91 cm) = $15 Donate here or charity of your choice
• 3578 x 2415 px = up to 16" x 24"      (~ 40 x 60 cm) = $10 Donate here or charity of your choice
• 1720 x 1200 px = up to 11"x14"        (~ 20 x 30 cm) = Free Download

CVE-2012-5076 Java sample from "Cool" exploit pack

Here is quick post for a CVE-2012-5076 sample (from Cool pack, as described by Kafeine here Cool EK : "Hello my friend..." CVE-2012-5076 )

Group Photos.zip OSX/Revir | OSX/iMuler samples March 2012-November 2012

Sophos posted information about a variant of iMuler OSX trojan targeting Tibet activists (New variant of Mac Trojan discovered, targeting Tibet )  and posted the MD5 2d84bfbae1f1b7ab0fc1ca9dd372d35e (FileAgent 37.3 KB) of the trojan  . This post is for the actual dropper, which is a full 1.9 MB package (Group photo.zip MD5: 9e34256ded3a2ead43f7a51b9f197937)

 I don't have a Mac OS VM handy tonight to provide more details about the traffic or behavior so I will just describe the package and post the previous version of the same trojan that was targeting fans of Russian topless models.

CVE-2012-1535 Adobe Flash Player Integer Overflow Vulnerability Analysis by Brian Mariani & Frédéric Bourla

Brian Mariani and Frédéric Bourla from High-Tech Bridge SA – www.htbridge.com sent their excellent deep analysis of  CVE-2012-1535 vulnerability in Adobe Flash Player. The Word documents with Flash that exploited that vulnerability appeared in August but did not become as popular as RTF CVE-2012-0158, which remains to be the most widely used exploit for targeted email attachments. 

The reason for it is that integer overflows are difficult to exploit in general and CVE-2012-1535 is less reliable than other exploits prevalent today. This does not mean it is not in use and I will post several recent samples with this exploit in the next article.
The full analysis is posted below, plus you can download it in PDF format.

Blackhole 2 exploit kit (partial pack) and ZeroAccess (user-mode memory resident version)

 This post is an addtion to the DeepEnd Research post Blackhole & Cridex: Season 2 Episode 1: Intuit Spam & SSL traffic analysis by Andre DiMino about the Blackhole 2 exploit pack and Cridex trojan alliance.

Here is for download a partial Blackhole 2 exploit pack. This pack has been shared with me a few times over the past couple of weeks as researchers discovered an blackhole server with open directories. While it is missing a few crucial files, it is still provides insight into the pack components, exploits, and structure.

The list of files in the pack are listed below. 16 files are zero in size (not on purpose, that's all I have) and are there just for your information. The zero size files are listed in the separate list below (in addition to being in the main list). The files and data directories contain the exploits ( cve-2012-1723, cve-2012-0507, cve-2010-1885, cve-2012-4681, cve-2010-0188) and the payload (ZeroAccess  among other malware, which is memory resident rootkit (thus no 'dropped', created files for ZeroAccess in the package, only the original dropper and all kinds of files genereated by the clickfraud component. Use Volatility or Redline/Memorize for analysis)
This captcha component of this pack was reviewed by
Behind the Captcha or Inside Blackhole Exploit Kit 2.0 - Exploit Kit Administration Panel (Malware Don't Need Coffee).

 Malware Must Die analysts have been tracking Blackhole 2 as well

CVE-2012-4969 Internet explorer 0day samples

The Internet Explorer 0day aka now CVE-2012-4969, have been used in a "small number of targeted attacks". The new Internet Explorer Zero day technical details came out (eromang.zataz.com), the Metasploit module is out now too and the number will increase exponentially as soon as exploit pack authors add it to their arsenal, which will happen very soon. This seems to be repeating the story of Java CVE-2012-4681. See CVE-2012-4681 samples Original (APT) and Blackhole 2.0 (crime)

There are a few mitigation workarounds you can use for now, the best is to upgrade your browser, however
Read more at http://technet.microsoft.com/en-us/security/advisory/2757760

CVE-2012-4681 samples Original (APT) and Blackhole 2.0 (crime)

Here are two samples of Java CVE-2012-4681 exploit - one from the original targeted attack described in our post on August 30, 2012 and the other from today's spam redirecting to Blackhole 2.0 exploit kit and using CVE-2012-4681 adapted from the Metasploit framework.
The Blackhole 2.0 ad is translated and posted at malware.dontneedcoffee.com along with a very good analysis.
The spam campaigns are probably different but the one I encountered was using the subject "ADP Invoice Reminder" with ADP_Online_Invoice_DoNotReply@adp.com address sent from what it looks like a spam botnet. The body of the email looks very convincing  - see the legitimate ADP email below in comparison to the fake one. The links are legitimate compromised websites redirecting to the Blackhole exploit server. The payload is Zeus (Gameover P2P version not Citadel). Many websites already cleaned and giving error 404 and some are still active. I posted approximately 50 headers below for those who deal with spam filters as well as pcap and other information.

Contagio file downloads are not available indefinitely (thanks to Mediafire and LeakID ideas about copyright)

Update5: 
Mediafire notified me the other day that they had confirmation from LeakID that the notices they submitted  were done in error. They restored all the file access.
I want to thank all who helped me with the posts and updates Paul Robert from SophosLabs, Soulskill- Slashdot, Dan Kaplan from SC Magazine for their articles, everyone who made posts on Twitter  and the Mediafire team for the über fast response to the posts and resolution. I guess LeakID do not speak to victims directly, never heard from them.