Feb 22 2010

Zeus may be old, but he isn’t afraid of change

Category: Malware,Password Stealing,Practical,Trojan — Parker @ 7:47 pm

I should really lay my cards on the table at the start of this item. I do not know that this is Zeus, it is currently a working assumption, noting a number of similarities between this new virus and other Zeus samples I have seen.

So first off, what is the same?

  • It changes the registry item HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit Inserting a dynamically changing executable, into the key data, to ensure its presence at each boot of the system. In my most recent infection instance, it changes the value data to C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\msicjg32.exe
  • It loads the executable and hides it from view, using rootkit techniques.
  • It conducts HTML injection attacks
  • It is capable of MitB / MitM attacks
  • It targets Banking credentials and more than likely other login details, such Paypal & Facebook.

What is new?

  • The virus no longer uses the static executable name sdra64.exe. Instead it chooses a pseudo random name at install. I have seen msrwez32.exe | msjrtr32.exe | msicjg32.exe, so it would appear a format msXXXX32.exe is used.
  • There is no creation of a c:\windows\system32\lowsec folder. So stolen data and configuration detail is stored somewhere other than usual. This would appear to come from a jpg that can be seen coming in if using packet capture. The file is normally at the C&C domain within a location of /images/arrowred.jpg If have not been able to obtain this file or indeed find anything that could even attempt to decrypt it, but I informed that config details are held within it.
  • As with all viruses, these processes grab config detail from Command & Control servers. To the best of my ability I believe these sites to be http;//216.119.129.14 and http;//209.172.59.132. With luck these will be offline soon. I have now seen that these files have a list of possible C&Cs and move around as quickly as they are taken offline. Those who need to know of them do, and I do not propose to begin retaining a list here.

Antivirus detection rates, as follows;

Product – Version – Update – Virus Alias
a-squared 4.5.0.50 2010.02.22 Worm.Win32.Pushbot!IK
AhnLab-V3 5.0.0.2 2010.02.22 -
AntiVir 8.2.1.172 2010.02.22 TR/Spy.ZBot.afdw
Antiy-AVL 2.0.3.7 2010.02.22 -
Authentium 5.2.0.5 2010.02.22 -
Avast 4.8.1351.0 2010.02.22 Win32:EggDrop-CG
AVG 9.0.0.730 2010.02.22 -
BitDefender 7.2 2010.02.22 Trojan.Generic.3193268
CAT-QuickHeal 10.00 2010.02.22 -
ClamAV 0.96.0.0-git 2010.02.22 Trojan.EggDrop-121
Comodo 4026 2010.02.22 TrojWare.Win32.Spy.Zbot.afdw
DrWeb 5.0.1.12222 2010.02.22 Trojan.DownLoad.35735
eSafe 7.0.17.0 2010.02.22 Win32.EggDrop
eTrust-Vet 35.2.7318 2010.02.22 -
F-Prot 4.5.1.85 2010.02.22 -
F-Secure 9.0.15370.0 2010.02.22 Trojan.Generic.3193268
Fortinet 4.0.14.0 2010.02.21 -
GData 19 2010.02.22 Trojan.Generic.3193268
Ikarus T3.1.1.80.0 2010.02.22 Worm.Win32.Pushbot
Jiangmin 13.0.900 2010.02.22 -
K7AntiVirus 7.10.980 2010.02.22 -
Kaspersky 7.0.0.125 2010.02.22 Trojan-Spy.Win32.Zbot.afdw
McAfee 5900 2010.02.22 -
McAfee+Artemis 5900 2010.02.22 Artemis!1B0138229529
McAfee-GW-Edition 6.8.5 2010.02.22 Heuristic.LooksLike.Trojan.Agent.B
Microsoft 1.5406 2010.02.22 -
NOD32 4888 2010.02.22 probably a variant of Win32/Injector.AXM
Norman 6.04.08 2010.02.22 -
nProtect 2009.1.8.0 2010.02.22 -
Panda 10.0.2.2 2010.02.22 Trj/CI.A
PCTools 7.0.3.5 2010.02.22 -
Prevx 3.0 2010.02.22 High Risk Cloaked Malware
Rising 22.34.01.03 2010.02.11 -
Sophos 4.50.0 2010.02.22 Mal/Resdro-A
Sunbelt 5692 2010.02.22 Trojan.Win32.Generic!BT
Symantec 20091.2.0.41 2010.02.22 Suspicious.Insight
TheHacker 6.5.1.6.205 2010.02.22 -
TrendMicro 9.120.0.1004 2010.02.22 -
VBA32 3.12.12.2 2010.02.22 -
ViRobot 2010.2.22.2196 2010.02.22 -

Removal

I am not yet confident in the exact way in which this malware functions, so I am not confident that the below is an absolute removal process. It does however appear to resolve the issue, so is better than nothing. As soon as I learn more, I will be sure to update.

  • Open regedit (normally via Start > Run) and drill down into the HKLM\Software\Microsoft\Windows NT\Current Version\Winlogon\Userinit string and note its value data.
  • You will need to kill a thread, loaded into memory, which retains the malicious presence within the Winlogon key, simply deleting the malicious value data is not enough.
  • Download and run the ProcessExplorer application from the TechNet website.
  • Access View and ensure that Lower Pane view is enabled.
  • On the top menu bar, select Find Handle or DLL. Within search type and search for the executable found within the Userinit data value. (msXXXX32.exe)
  • This should find and select executable within your Lower Pane. In the top pane, locate and double click on Winlogon.
  • From the new Window select the threads tab (this will sometimes produce an error, which can just be clicked past).
  • Once the threads have displayed, sort by CSwitch Data. There will be one thread which shows as constantly active (retains a numeric value).
  • Once this thread is identified, highlight it and select Kill from the bottom right.
  • Exit ProcessExplorer, reopen regedit and drill down onto the Winlogon\Userinit key. Delete the malicious value, from the userinit key data.
  • Restart the PC.
  • This should have stopped the virus loading at boot, allowing you to locate the executable within C:\windows\system32\. This should be purged from the system.

Tags: , ,

Jan 24 2010

Backtrack 4 & SSLStrip-0.7 at last!

Category: Password Stealing,Practical — Parker @ 9:56 pm

OK,

So I have been wanting to document this for a while, but have failed to do so. Luckily time and the recent BackTrack4 final release have conspired with me today, so I have been able to do it at last. So, sitting comfortably? Here comes the science bit.

Before you do this, I suggest you have the following installed; SSLStrip and Python. Make sure you also have a Linux distribution (such as BackTrack) and hardware combo that supports ARP injection. Once all of that is in place, you can conduct what is a very simple attack. (For reference I use an Acer Aspire One Z250 and Backtrack 4)

  • First enable port forwarding with the following command into a terminal window  echo “1″ > /proc/sys/net/ipv4/ip_forward
  • Then define what traffic you wish to capture (always port 80, I would think) and which port you will forward this traffic to. The values in bold should be replaced with the relevant ports iptables -t nat -A PREROUTING -p tcp –destination-port 80 -j REDIRECT –to-port <listenPort>


  • You must now use that clever man’s python script to start stripping out the SSL, matching the listenPort with that above  python sslstrip.py -l <listenPort>

Having set your machine to pick up, forward and inspect all the traffic from your target machine, we now need to do is ensure that all the traffic from your target machine is routed through your hardware.  We do this with a Man In The Middle attack, placing yourself between the target machine and the network router.
We achieve this with a simple ARP attack, which continues to ‘inform’ the target machine that you are the router, with which it wishes to speak.

  • Within a new terminal window (to keep it clean, if nothing else), enter the following, (values in bold should be replaced with relevant values) arpspoof -i <interface> -t <targetIP> <gatewayIP>


Now all you need do is wait, all the target machine’s traffic will route though your machine and their browsing will probably seem slow, but any sites which they visit, who implement poor SSL encryption will be easy prey. The data that is captured will be placed into a .log file and available by opening a new terminal and entering more sslstrip.log (ensuring you are in the SSLStrip directory)

You’ll note that such popular sites as www.facebook.com / www.twitter.com and the “newly secure” www.gmail.com are all easy pickings!

Details captured by SSLStrip

I thank you!