Hoy un compañero se dio cuenta que su PC estaba infectada, porque al insertar su Pendrive en otra PC con otra solución Anti-Virus, esta le detecto una amenaza en el dispositivo USB. Inmediatamente enviamos la muestra a Virus-Total y observamos que es detectada por la gran mayoría de los Anti-Virus.
Verificando que la solución A.V: se encuentra actualizada.
Este malware se trata de un IrcBot con un clásico Crypter, que chequea si esta siendo debugeado.
IsDebuggerPresent
(BP en ZwWriteVirtualMemory y obtenemos fácilmente el dump)
En el análisis dinámico vemos como se aculta en el directorio de Windows
Strings interesantes:
00402441 PUSH usb2_dum.0040B07C ASCII "[Update]:"
00402446 PUSH usb2_dum.0040B1D0 ASCII "%s mis param."
0040245B PUSH usb2_dum.0040B54C ASCII "CoupeSoldier"
00402480 PUSH usb2_dum.0040B50C ASCII "transfer thread"
00402485 PUSH usb2_dum.0040B07C ASCII "[Update]:"
004024E1 PUSH usb2_dum.0040B300 ASCII "%seraseme_%d%d%d%d%d.exe"
00402525 MOV EDI,usb2_dum.0040B07C ASCII "[Update]:"
00402543 PUSH usb2_dum.0040B2D8 ASCII "%s Downloading update from: %s to: %s."
004025AF PUSH usb2_dum.0040B2D8 ASCII "%s Downloading update from: %s to: %s."
004025C6 PUSH usb2_dum.0040B50C ASCII "transfer thread"
004025CC PUSH usb2_dum.0040B130 ASCII "%s Fail start %s, err: <%d>"
004025D5 PUSH usb2_dum.004092DC ASCII "supersyn"
004025F1 PUSH usb2_dum.0040B2CC ASCII "ddos thread"
004025F6 PUSH usb2_dum.0040B0A8 ASCII "[DDOS SYN]:"
004025FB PUSH usb2_dum.0040B114 ASCII "%s %s already running: <%d>"
0040413D PUSH usb2_dum.0040BAE8 ASCII "Software\Microsoft\Windows\CurrentVersion\Run\"
00404177 PUSH usb2_dum.0040B7E8 ASCII "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run\"
004038FE PUSH usb2_dum.0040B940 ASCII "Error"
00403946 PUSH usb2_dum.0040B948 ASCII "%s-"
004039D9 MOV EAX,usb2_dum.0040B978 ASCII "95-"
004039EC MOV EAX,usb2_dum.0040B974 ASCII "NT-"
004039FC MOV EAX,usb2_dum.0040B970 ASCII "98-"
00403A0C MOV EAX,usb2_dum.0040B96C ASCII "ME-"
00403A24 MOV EAX,usb2_dum.0040B968 ASCII "2K-"
00403A34 MOV EAX,usb2_dum.0040B964 ASCII "XP-"
00403A44 MOV EAX,usb2_dum.0040B95C ASCII "2K3-"
00403A5A MOV EAX,usb2_dum.0040B954 ASCII "VIS-"
00403A61 MOV EAX,usb2_dum.0040B94C ASCII "UNK-"
00402B46 PUSH usb2_dum.0040B04C ASCII "[Sh0cKS Soldiers]:"
00402B4B PUSH usb2_dum.0040B1C0 ASCII "%s Main thread."
00402D60 PUSH usb2_dum.0040B8AC ASCII "Ping Timeout? (%d-%d)%d/%d"
00401065 PUSH usb2_dum.0040B020 ASCII "%d %d"
0040125C PUSH usb2_dum.0040B028 ASCII "Wireshark"
004012C2 PUSH usb2_dum.0040B034 ASCII "tcpview"
00401328 PUSH usb2_dum.0040B03C ASCII "filemon"
0040138E PUSH usb2_dum.0040B044 ASCII "procmon"
004018A2 PUSH usb2_dum.0040B224 ASCII "open"
004019CB PUSH usb2_dum.0040B248 ASCII "Failed"
004019D0 PUSH usb2_dum.0040B22C ASCII "%s Failed to parse command."
00401A12 PUSH usb2_dum.00409230 ASCII "giris"
00401A23 PUSH usb2_dum.0040925C ASCII "remove"
00401A39 PUSH usb2_dum.00409240 ASCII "dw.indir"
00401A44 PUSH usb2_dum.0040B530 ASCII "Download"
00401A4D PUSH usb2_dum.0040931C ASCII "pstore"
00401A58 PUSH usb2_dum.0040B528 ASCII "PStore"
00401A73 PUSH usb2_dum.00409254 ASCII "update"
00401A80 PUSH usb2_dum.00409254 ASCII "update"
00401A8B PUSH usb2_dum.0040B520 ASCII "Update"
00401AB5 PUSH usb2_dum.00409230 ASCII "giris"
00401ACB PUSH usb2_dum.0040B04C ASCII "[Sh0cKS Soldiers]:"
00401AD0 PUSH usb2_dum.0040B160 ASCII "%s logged in."
00401AE8 PUSH usb2_dum.00409238 ASCII "gir"
00401B03 PUSH usb2_dum.0040B074 ASCII "[Irc]:"
00401B2A PUSH usb2_dum.0040923C ASCII "cik"
00401B4A PUSH usb2_dum.0040925C ASCII "remove"
00401B7A PUSH usb2_dum.0040B170 ASCII "[Remove]: Removed by: %s!%s@%s."
00401BAC PUSH usb2_dum.00409240 ASCII "dw.indir"
00401BE3 PUSH usb2_dum.0040B50C ASCII "transfer thread"
00401BE8 PUSH usb2_dum.0040B088 ASCII "[Dl]:"
00401BED PUSH usb2_dum.0040B114 ASCII "%s %s already running: <%d>"
00401C48 PUSH usb2_dum.0040B088 ASCII "[Dl]:"
00401C4D PUSH usb2_dum.0040B4EC ASCII "%s Downloading URL: %s to: %s."
00401CC1 PUSH usb2_dum.0040B088 ASCII "[Dl]:"
00401CC6 PUSH usb2_dum.0040B4EC ASCII "%s Downloading URL: %s to: %s."
00401CE0 PUSH usb2_dum.0040B50C ASCII "transfer thread"
00401CE5 PUSH usb2_dum.0040B088 ASCII "[Dl]:"
00401CF8 PUSH usb2_dum.0040B088 ASCII "[Dl]:"
00401CFD PUSH usb2_dum.0040B1D0 ASCII "%s mis param."
00401D09 PUSH usb2_dum.0040924C ASCII "dw.dur"
00401D1F PUSH usb2_dum.0040B088 ASCII "[Dl]:"
00401D2B PUSH usb2_dum.00409314 ASCII "socks4"
00401D50 PUSH usb2_dum.0040B4DC ASCII "Socks4 Server"
00401D55 PUSH usb2_dum.0040B09C ASCII "[Sock4]:"
00401D5A PUSH usb2_dum.0040B114 ASCII "%s %s already running: <%d>"
00401DB2 MOV ESI,usb2_dum.0040B09C ASCII "[Sock4]:"
00401DBD PUSH usb2_dum.0040B4C0 ASCII "%s Server running on: %s:%i"
00401E1F PUSH usb2_dum.0040B4C0 ASCII "%s Server running on: %s:%i"
00401E36 PUSH usb2_dum.0040B4B0 ASCII "Socks4 thread"
00401E3C PUSH usb2_dum.0040B130 ASCII "%s Fail start %s, err: <%d>"
00401E49 PUSH usb2_dum.004092CC ASCII "rarinject"
00401E61 PUSH usb2_dum.0040B494 ASCII "WinRAR Injection Activated"
00401E86 PUSH usb2_dum.0040926C ASCII "msn.msgemail"
00401ED8 PUSH usb2_dum.0040B488 ASCII "MSN Threads"
00401F2B PUSH usb2_dum.0040B0B4 ASCII "[IM]:"
00401F30 PUSH usb2_dum.0040B454 ASCII "%s Thread Activated: Sending Message With Email."
00401F3C PUSH usb2_dum.00409264 ASCII "msn.msg"
00401F8E PUSH usb2_dum.0040B488 ASCII "MSN Threads"
00401FE1 PUSH usb2_dum.0040B0B4 ASCII "[IM]:"
00401FE6 PUSH usb2_dum.0040B42C ASCII "%s Thread Activated: Sending Message."
00401FFB PUSH usb2_dum.0040927C ASCII "msn.stop"
00402011 PUSH usb2_dum.0040B0B4 ASCII "[IM]:"
0040201D PUSH usb2_dum.00409288 ASCII "msn.sendzip"
00402069 PUSH usb2_dum.0040B488 ASCII "MSN Threads"
004020BC PUSH usb2_dum.0040B0B4 ASCII "[IM]:"
004020C1 PUSH usb2_dum.0040B3FC ASCII "%s Thread Activated: Sending Message & Zipfile."
004020D1 PUSH usb2_dum.00409294 ASCII "msn.stopzip"
004020E5 PUSH usb2_dum.0040B0B4 ASCII "[IM]:"
004020ED PUSH usb2_dum.0040B3E8 ASCII "%s Thread Disabled."
00402107 PUSH usb2_dum.004092B8 ASCII "aim.msg"
00402140 PUSH usb2_dum.0040B3DC ASCII "AIM Threads"
0040218F PUSH usb2_dum.0040B0BC ASCII "[Aim]:"
00402194 PUSH usb2_dum.0040B42C ASCII "%s Thread Activated: Sending Message."
004021A0 PUSH usb2_dum.004092C0 ASCII "aim.stop"
004021BA PUSH usb2_dum.0040B0BC ASCII "[Aim]:"
004021C6 PUSH usb2_dum.004092A0 ASCII "triton.msg"
004021FF PUSH usb2_dum.0040B3D0 ASCII "TIM Threads"
0040224E PUSH usb2_dum.0040B0C4 ASCII "[Triton]:"
0040225A PUSH usb2_dum.004092AC ASCII "triton.stop"
00402274 PUSH usb2_dum.0040B0C4 ASCII "[Triton]:"
00402279 PUSH usb2_dum.0040B3E8 ASCII "%s Thread Disabled."
Comunicación con el c&c IRC
Recomendación: Extremar las medidas cuando conectamos nuestros soportes removibles (pendrives, memorias sd, teléfonos celulares, etc) en una PC que no es del todo confiable, Instalar una solución anti-virus + otra solución anti troyanos como malwarebytes y realizar escaneos regulares.
Muestra: https://www.dropbox.com/s/gd016xolomenf5p/IRCBOT-02-09-13.zip?m
Es todo por el momento....
@Dkavalanche 2013
1 comentario:
Por ese motivo puse una política de prohibir ejecución de archivos en dispositivos removibles.
Publicar un comentario