Quantcast
Channel: Information Security News
Viewing all articles
Browse latest Browse all 9687

Not All Malware Samples Are Complex, (Wed, Mar 8th)

$
0
0

Everyday we hear about new pieces of malware which implement new techniques to hide themselvesand defeat analysts. But they are still people whowrite simple code that just do the job. The samplethat Im reviewing todayhad a very short lifetime because it was quickly detected by most antivirus. Its purpose is to steal information from the infected computers like credentials. When the sample was submitted for the first time to VT, it reached a score of 11/59 which is not bad. Today, its score is 44/59[1].

Amongst actions like copying itself to C:\Users\%USER%\Temp\Skype\chrome.exe. Itchecks the victims computer location via hxxp://ip-score.com/checkip/ and collects information about the victim. Then padding:5px 10px"> C:\WINDOWS\system32\cmd.exe /c schtasks /create /tn MOCLXG /tr C:\DOCUME~1\Xavier\LOCALS~1\Temp\Skype\chrome.exe /sc minute /mo 1

The way itsteals information from the victim in interesting in this case. People are often lazy so why reinvent the wheel? There already exists tools to collect credentials from applications like browsers, email clients,

The networktraffic generated by the malware is very interesting. The C2 is hosted behind a dynamic DNS host: popstub.ddns.net[2]. The malware does not use the HTTP protocol but a simple TCP session via port TCP %%port:1340%%. The first things it does is to send information about the victim and the C2 return a PE file:
width:803px" />
We can see the location (country), date, IP address, logged user, OS, architecture and the resolution. I presume that the No strings indicate the presence of an antivirus and a firewall (which are both disabled in my sandbox).

The PE file is dropped on the file system, executed and the padding:5px 10px"> C:\WINDOWS\system32\cmd.exe /c Pl2.exe -f Pl2.txt width:802px" />

And, another tool is downloaded and executed using the same scenario:
width:802px" />
And, the last one:
width:802px" />
Everything is executed within a unique TCP session. This is quite simple and efficient if you dont implement correct egress filtering.
[1] color:#0000ee">https://www.virustotal.com/en/file/11347119bbae52855b3a303c71c36f1ff30810c63359bde41a81a70e5d9ae86c/analysis/
Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Viewing all articles
Browse latest Browse all 9687

Trending Articles