2011年2月25日星期五
SpyEye, the infostealing trojan leader
Everyone is talking about the SpyEye Trojan, the info stealer malware that gained all the attention after the author of ZeuS left the underground market and sold ZeuS sources to the SpyEye team. We already wrote about SpyEye last year, when we focused on the threat claiming that it could potentially become one of the top password stealing threats. Now that the SpyEye authors have access to all of ZeuS source code, SpyEye is becoming the main kit available for sale in the underground with even more efficient coding with some additional ZeuS based technologies.
Let's have a closer look at the new variants of SpyEye.
The SpyEye dropper comes in a UPX packed executable. After unpacking the first layer, we are lucky as we could already get to the SpyEye code. Actually, we have some samples which make use of highly-obfuscated decryption code, used for a second stage decryption loop. This second stage decryption loop make uses of its own routine able to get function addresses by parsing library export tables. The function is using name hashes instead of plain-text names. The hash is calculated by an ROL/XOR loop.
After the second decryption loop was completed, we are up to the real SpyEye executable code. The Trojan is divided in a few parts: the main executable
itself is just a stub, it acts like a pre-loader. It then contains 5 resource files and an embedded executable - which is the real SpyEye code. The resource files are named C1, C2, C3, SC1, SC2.
C1 contains the basic settings of the Trojan, like the name of the folder that the Trojan needs to create along with the name of the two files that will be stored inside the folder and the mutex used to check if theinfection is already running in the system. The folder will have the hidden flag attribute set as well. C2 contains the real configuration file, called config.bin - we'll better explain it later in the blog post. C3 contains the config.bin password in plain text.
SC1 is instead a module that will be injected by the pre-loader inside explorer.exe process. This module is responsible of creating the folder and storing the Trojan dropper inside it, then it launches again the dropper from the new location and deletes the original dropper. SC2 is a module used by SpyEye pre-loader to get system information like the Windows build number, username account, Windows folder and a number of other data points.
SC1 module is injected inside the host process explorer.exe and does its job as showed above. The dropper now reloads from the right location and extracts the C3 resource file, reads the config.bin password and stores it as a local variable by calling SetEnvironmentVariableA API. This will help the Trojan in sharing the password between this pre-loader and the actual SpyEye code. Finally, the execution is passed to the embedded executable code.
Inside the real SpyEye code, the Trojan first check if the config.bin file has been already stored inside the hidden folder along with the dropper executable. If not, the config file is extracted from the C2 resource and is stored inside the folder. Then, the configuration file is decrypted by the Trojan. The encryption algorithm is not really complicated, and it's just a XOR-based loop starting from the end of the file till the beginning. Every byte is XOR'd with 0xC4 key and the result is being subtracted by the value of the byte that is located at the previous location. After the decryption, the config.bin file is just a password-protected zip archive. As mentioned above, the password is the string located inside the C3 resource.
Stored inside the configuration zip package are configuration files along with specifically chosen plugins. There could be some plugins able to make the infected PC act as a socks5 server, or credit card grabbers. There are other interesting information like the servers that are contacted by the Trojan and the HTML code that is being injected inside some specific HTML pages. This is already a feature implemented in ZeuS and has been copied out by the SpyEye authors.
After the configuration file has been decrypted and parsed, the embedded executable code injects all its code inside the explorer.exe process, and the pre-loader process terminates. The code is now active in memory and it is ready to be injected in every other running process except services.exe, smss.exe, csrss.exe and system processes.
In the targeted processes, the Trojan hooks following APIs:
CryptEncrypt, LdrLoadDll, NtEnumerateValueKey, NtQueryDirectoryFile, NtResumeThread, NtVdmControl, TranslateMessage, HttpAddRequestHeadersA, HttpOpenRequestA, HttpQueryInfoA, HttpSendRequestA, HttpSendRequestW, InternetCloseHandle, InternetQueryDataAvailable, InternetQueryOptionA,
InternetReadFile, InternetReadFileExA, InternetWriteFile.
Some newer variants of SpyEye implement a hooking engine protected by a number of watchdog threads, able to immediately restore all the Trojan hooks if they are being overwritten or deleted by security software.
The Trojan make uses of user mode rootkit techniques to hide both its registry key located inside HKEY_CURRENT_USER\SOFTWARE\Microsoft\Current Version\Run and the folder containing the Trojan executable along with the config.bin file. The folder is usually located on the root directory of the drive where the operating system is located.
Due to the way the Trojan is designed, it is perfectly able to steal sensitive data from every PC, no matter if it runs with administrative privileges or limited user account. Moreover, after the ZeuS authors resigned, SpyEye is soon to become the leading infostealing Trojan in the underground.
The increasing number of SpyEye infections we are detecting and cleaning on infected PCs tells us that SpyEye is very widespread and you should really pay attention to your computer security, even if using a limited account. Protect your web surfing experience with Prevx and SafeOnline.
Microsoft Patch Day: is that all?
Yesterday Microsoft released 17 security bulletins, finally fixing the last 0day flaw exploited by Stuxnet malware which had been left open up until now. In all, 7 out of 38 flaws fixed by Microsoft were already disclosed publicly and they allowed both remote code execution and elevation of privilege.
Microsoft patched some of their software which was vulnerable to the flaw disclosed in last August, relative to the insecure DLL loading exploit. We talked about this vulnerability in a specific blog post in August, where we already said this shouldn't be considered as a vulnerability of the operating system itself, but a coding error by the software developers.
Finally, Microsoft patched the long discussed and well known Windows Task Scheduler exploit used by Stuxnet malware to gain administrative privileges. With this update, all the 0day exploits used by Stuxnet have been definitely fixed.
The task scheduler exploit was known since September and a working proof of concept exploit had been released publicly in November, allowing malware writers to use it in their malware code, evading by limited account and UAC restrictions.
In a Microsoft blog post written on 9th December 2010, Mike Reavey from Microsoft Security Response Center wrote that the 0day exploit affecting the Windows Task Scheduler had not been used anywhere else aside by the Stuxnet malware. Contrary to this we have had reports of the infamous TDL4 rootkit exploiting the same flaw since first days of December 2010. We have covered this topic in a previous blog post. Anyway, now the exploit has been fixed and TDL4 will need to other ways to elevate its privileges when dropped on the victims PC.
With this massive security update Microsoft patched a lot of flaws that could be exploited by malware. Is that all? Actually not. This massive update still leaves open a security flaw that allows privilege escalation, the one we talked about in a blog post written here, relative to the win32k.sys stack overflow flaw.
This is bad, and it becomes even more dangerous due to the fact that the exploit code for this vulnerability has been already disclosed publicly. In fact we should expect malware starting to use it for malicious purpose very soon. Now that the Windows Task Scheduler flaw has been successfully closed, this other exploit will probably be in the spotlight for a while until Microsoft releases a patch for it.
Looking at malware like TDL4 rootkit, its development trend suggests that their authors will use this exploit very soon, giving again the rootkit the ability to automatically elevate its privileges and infect both x86 and x64 versions of Microsoft Windows operating system, again.
Prevx customers are already protected by this Windows 0day exploit, so are the users of Prevx free version. So, while waiting for the Microsoft patch, why don't you just give Prevx a try and stay protected from this exploit?
2011年2月24日星期四
TDL4 exploits Windows Task Scheduler flaw
Next tuesday will be the Microsoft patch day and Microsoft is going to release 17 updates which will address 40 flaws, fixing among all two critical vulnerabilites that allow remote code execution and four elevation of privileges vulnerabilities.
One of the elevation of privileges flaws which is going to be addressed is the one related to the last 0day exploit left still opened and used by the Stuxnet malware. The flaw has been already publically disclosed and relative proof of concept exploit has been released online in November, opening the door for malicious activities. This flaw is officially known to Microsoft since September.
It has become so trivial to exploit this flaw that the authors of the TDL rootkit started using it to avoid limited account and UAC-protected account limitations. As our readers may remember, we already talked about TDL rootkit many times here in our blog as the most advanced rootkit in the wild at the moment, and after this last update we can assume their authors are still pretty active in developing the malware.
The biggest obstacle that TDL rootkit could run into was running in a limited account or in a UAC-protected account because it didn't have the needed privileges to load its own kernel mode driver or to overwrite the MBR. In fact, the rootkit was previously able to infect Windows operating system only after the user had given administrative privileges to it (we are assuming that the user is logged in a limited account or in an account protected by UAC).
Now, by using the Windows Task Scheduler exploit the rootkit is fully able to infect the system without any visual warning that could alert the user. We have found the rootkit being dropped by exploit kits on compromised websites as well as usual vectors like cracks and warez websites.
After the dropper is executed, it tries at the beginning to load its own driver by using the old well-known AddPrintProvidor trick to avoid detection by some of classic HIPS software. If it gets back an ERROR_ACCESS_DENIED status, then the dropper assumes it has been run in a limited account and sets up all the needed stuff to exploit the Windows Task Scheduler CVE-2010-3888 vulnerability. TaskEng.exe, the Windows Task Manager Engine, will then execute the dropper again with SYSTEM privileges.
Beside that, there isn't any major change to the rootkit code itself. The TDL4 kernel mode component has been updated to version 0.03 earlier last month. This update added the filtering by the rootkit of the ATA Pass Through commands, which was one of the last available ways to bypass rootkit filtering engine in user mode - SCSI Pass Through commands were filtered by the rootkit since version 3.273 of previous TDL3 release.
Still the rootkit is able to hit x64 versions of Windows operating systems by overwriting the MBR with its own loader. As we already wrote in a previous blog post, the rootkit patches the MBR and restart the system to immediately get the control of the system startup routine. It then patches the Boot Configuration Data to disable Windows Driver Code Signing check.
To do that it sets up its own Int13h handler and intercepts the reading of the BCD data looking for the BcdLibraryBoolean_EmsEnabled element; when found it is swapped to BcdOSLoaderBoolean_WinPEMode. Windows is then booted in WinPE mode, thus the driver signing check is disabled. The rootkit is free to load its own kernel mode driver. Then the rootkit Int13h handler intercepts the /MININT string and swaps it to IN/MINT, so that Windows does not recognize the bootup parameter and resumes the normal Windows startup.
The rootkit loads at very early stage of the bootup process a fake copy of kdcom.dll which exports a patched copy of the APIs used by the Windows internal debugger - KdD0Transition, KdD3Transition, KdDebuggerInitialize0, KdDebuggerInitialize1, KdReceivePacket, KdRestore, KdSave, KdSendPacket. This prevents the operating system from starting up if it's set in debug mode.
We strongly encourage all users to run Windows Update on Tuesday and fix once and for all this vulnerability already known for three months.
spyware search and destroy security tool virus removal adware spyware
Malware in the cloud
We have seen many examples in the past: the use of Twitter as a communication channel for a botnet, using Amazon EC2 for hosting C&Cs or abusing advertising channels for distributing malware. Today we will see, through a sample, how malware maximizes its revenues using this kind of services with a minimum impact on victim�s computer.
Our sample belongs to Trojan-Dropper.Win32.Drooptroop family, which has more than 7000 variants. The sample is detected by Kaspersky Internet Security as Trojan-Dropper.Win32.Drooptroop.jpa, and its peak of activity corresponds to 6th of December, mostly based in the US.
It is being distributed through an email message with a link to a Rapidshare file:
hxxp://rapidshare.com/files/4XXXXXXX0/gift.exe
Taking advantage of the Christmas campaign, the name of the binary is gift.exe. As suspicious as it is, however, most filters fail in detecting this as malicious for two reasons: the binary is not in the body message and the domain of the URL is legitimate. We have detected more than 1000 infections were technique was used for distributing the sample.
This is not the only use of external infrastructure done by the sample. Once the computer is infected,Drooptroop.jpa injects code into spoolsv.exe and intercepts browser�s network functions, resulting in hijacking user�s requests.
Doing this, Drooptroop performs click fraud redirecting legitimate requests:
| GET /click.php?c=eNXXXXXSA HTTP/1.1 Host: 64.111.xxx.xxx User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: text/html,applicationxhtml+xml,applicationxml;q=0.9,*/*;q=0.8 Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: hxxp://wwwxxx.com/go/beXXXX4 |
This remuneration programs are abused on a regular basis by malware. Apart from that, this malware redirects the user to rogue AV sites:
It is interesting how everything is shown in the browser. All is javascript highly obfuscated simulating explorer, so further binaries are downloaded to the computer at the scaring phase.
At this point, you probably want to run Kaspersky Internet Security to clean your system.
Summing it up, the distribution was using a remote file sharing service, the malware used click fraud to monetize and the rogue AV was all happening in the browser. However this malware still needed to infect your computer, so don�t forget to protect yourself.
fix errors free free fix computer errors fix errors on my computer
FakeSysdef: We can defragment that for you wholesale! / Diary of a scamware
Initially it was "System Defragmenter", then "Scan Disk" and now it's called "Check Disk". While the name will most certainly change again, the main goal of Trojan:Win32/FakeSysdef will surely remain the same: to trick you into buying a piece of software that does nothing except scare you with fake warnings, critical "errors" and other "problems".
As the name suggests, this malware imitates a hard disk defragmenter. It will pretend to scan your computer for problems such as: it "checks" if your hard disk is working correctly, "defragments" it, and even checks the health status of your RAM and GPU (Graphic Processor Unit). Of course, once you start checking for problems using this 'program' it is going to ?find? a bucketful of them:
- Bad sectors
- RAM fragmentation
- Registry errors
- Very high CPU/GPU temperature
- RAM failures
Image 1 ? ?System Defragmenter? iteration of FakeSysdef
Apparently all those problems can be resolved by just running the "defragmentation" function on your hard drive; unfortunately that component is not "enabled" and to enable it you need to buy the full version of the product. You kind of expected that right?
If you choose not to buy the product, it will just stay in your status bar and will remind you every few minutes that your computer has problems that should be fixed.
Even though this malware is relatively new (only appeared 2 months ago) it has already passed through various iterations.We encountered the first sample on the 6th of October 2010; it came disguised as a fake Windows update which required the user to enter his user name and password in order to apply the security patches. The author even went to the point of translating the fake update messages in French, German, Spanish, and Italian in an attempt to appear as authentic as possible when running on a computer not running an English version of Windows. Once given the information, it installed the fake defragmenter program and errors started pouring in.
At this point the installer malware came in an unprotected form: no actions were taken in order to evade antivirus detections, no code obfuscation applied to make analysis more difficult. This makes us think it was a trial run, made just to test the waters to see how it handled once in the wild.
Image 2 - "Windows Update" installer for FakeSysdef
We spotted a new variant on the 10th of October 2010; it had the same icon as Windows Update but no Windows Update message was shown. The malicious code was installed silently and ran in the background until the user tried launching an application at which point a "system error" occurred. The approach evolved at this point:
Image 3 - "System Error!" message displayed by FakeSysdef
- Authors decided to be less obvious: since an advanced user would get suspicious if a new application started scanning for problems all of a sudden, now the malware changed so that it waits for user interaction.
- The Defragmenter is hidden under multiple layers generated by 2 executable protectors/packers ("Stealth PE" and a custom packer encountered in other malware) to make detection and analysis more difficult. Fortunately we easily bypass this technique in our products.
- The malware now deletes its original binary showing the intent of the authors to hide their tracks.
On the 27th of October we saw another version. It was distributed standalone and used stolen file information and the icon from the file utilman.exe, which is present in Windows XP. This seems to be a major update where they tried to improve the resistance to analysis tools and AV products:
- The file won't run in a virtualised environment; and
- The file is protected with a custom-made packer only which employs anti-emulation code to stop AV products from analysing the file.
On the 15th November a minor update was released. The software used the name "Scan Disk" probably due to the attention it slowly started getting. Again they invested heavily in code to fight AV detection. They reverted to the original defragmenter icon and to the original behaviour of showing the interface scanning for errors.
Image 4 - "Scan Disk" iteration of FakeSysdef
On 21 November a new version was released. The current move was to switch the name to "Check Disk", which has a familiar sound to the pronunciation of a legitimate Windows tool named ?chkdsk.exe? (?chkdsk.exe? is used to legitimately identify and correct various problems of the hard drives). This was a move clearly directed at fooling inexperienced users. The code was also updated to evade antivirus detection. Fortunately our products, such as Microsoft Security Essentials, can detect all these versions.
Image 5 - "Check Disk" iteration of FakeSysdef
We are sure we'll be seeing more changes from Trojan:Win32/Fakesysdef in the future, changes that we will closely monitor and detect to protect our users.
Below are example SHA1 hashes for the malware discussed in this blog:
cadacb248411c287822b2b09d6fff301a0f294a8
5a69f5fa043d2f5141226d10cb67d6d2a2d59f4a
d7195878d15c0e294101c5385b402b75885216f8
While writing this blog, a new version of the malware was encountered, ?Win HDD? with the following SHA1:
1905DE84FBA23A9152317A7F7C0BE7D1B3F07D70
Daniel Radu & Marian Radu
MMPC Dublin
free malware scan spyware adware malware remover anti spyware free