Follow up for Gataka /Tatanga Submission

Microsoft missed the point of all the files I submitted them. I knew that all of them were malware, I just wanted them to get the signatures in their definitions to protect others. Out of the last batch of 6 files I sent, 5 of them were samples of the malware as it resides on the system after it was dropped. The last file, which they firmly placed the words "not malware" next to, IS THE ACTUAL EXECUTABLE THAT CREATED ALL OF THE OTHER FILES I SENT THEM!!!! So the genius that looked at the files either didn't read the instructions and the cautions that I sent them and proceeded to barrel forward VirTool:Win32/Obfuscator.ZC is what they come up with... bully for them. Here is their reply with their results for the files I sent them: Gataka.zip [Container]  +---2807784521.exe.vir [Not Malware] <========= THIS IS THE DROPPER!!!!  +---AdVantage.exe.vir [VirTool:Win32/Obfuscator.ZC]  +---AdVantage.exe.vir [VirTool:Win32/Obfuscator.ZC]  +---googletalk.exe.vir [VirTool:Win32/Obfuscator.ZC]  +---googletalk.exe.vir [VirTool:Win32/Obfuscator.ZC]  +---Skype.exe.vir [VirTool:Win32/Obfuscator.ZC] So I have replied back to them trying to, once again, explain that the file they say isn't malware is actually the cause of the whole thing. Another update if I ever hear back. P.s. they even had the nerve to tell me that their detection for this was published on June 21. Funny... I submitted these files on July 2 and they didn't detect them. Just one more piece of proof that the bad guys are ahead. Hell, there's likely better money in it.

Gataka / Tatanga Malware MITB Banking Trojan

Recently I have received reports from people of their online banking sessions being hijacked and asking for additional verification of their identity.  When they contacted their bank, the bank reported that this is not their doing, and they need to have their machine scanned for malware.

Malware scans came back clean, but their were some odd exe files in places they shouldn't have been, so I investigated further.

There are 3 file names that you may see regularly.

·         Googletalk.exe

·         Skype.exe

·         AdVantage.exe

The malware has the following capabilities:

• ·         It opens a back door on the machine to allow an outside attacker to control the computer remotely
• ·         It has the ability to inject code into web pages, mostly banking and financial pages to steal user login information
• ·         It communicates via port 443 (SSL) with a Command & Control server on a pretty constant basis using the same XOR/ROT encryption as the encrypted dropper.

It may also be able to spread via network shares (meaning that it may be a network worm that spreads directly from one computer to the other automatically).

I have submitted samples of the malware, the dropper, and pcaps (packet captures) of network activity coming from an infected machine to McAfee, Microsoft, ESET, and  MalwareBytes  to ensure that this is caught by other AV firms.  All files are submitted to VirusTotal as well, so any AV firm that is a partner of theirs is also receiving the samples.

This is a new, polymorphic (meaning it changes from one machine to the other) piece of malware that has been very difficult to detect, and the name of the files aren’t something that would cause any undue attention.

The names this malware goes by are: Win32.Tatanga and Win32.Gataka.  An article on an older variant of the same family is here: http://securityblog.s21sec.com/2011/02/tatanga-new-banking-trojan-with-mitb.html.

The files are located in one of 3 locations:

C:\documents and settings\<username>\application data\Google Talk

C:\documents and settings\<username>\application data\Skype\Phone

C:\documents and settings\<username>\application data\Advantage

It survives reboot through a registry key:

HKey_Current_User\Software\Microsoft\Windows\CurrentVersion\Run

It also creates another file in:

C:\documents and settings\<username>\application data\Microsoft\

With a random, usually 4 letter folder name and a random rile name with no file extension.

It is installed on the system by a dropper that is saved in:

C:\documents and settings\<username>\Start Menu\Programs\Startup

Which is deleted after the dropper executes and installs the injector.  The dropper is saved in an encrypted form in the C:\documents and settings\<username>\application data\Microsoft\ directory in the random folder with random file name.  As of the time of this writing, it appears to be encrypted using a XOR key with a ROT element.

The injector, Googletalk.exe, AdVantage.exe, or Skype.exe, does not remain running on that machine, but instead injects its code into the explorer.exe process.  When new processes are created, it injects its code into the new one as well.  This means that if you look at task manager and don’t see it, it doesn’t mean that the machine is clean.  If the files are on the drive, and the registry keys are there, then the machine is compromised.

If you run from a CMD prompt, NETSTAT –NAO and hit enter, you may see a connection on port 443 to an external IP address.  That is most likely the connection to the C&C server, especially if it is the PID for explorer.exe that is referenced.

New Ransomware Part 2

After spending a good bit of time getting the file unpacked (was packed using ASPACK encryption), I have gotten to a point where I can get a better idea of what it does.  The results, so far are not that encouraging for the possibility of recovering the .crypt files to a usable form.  Depending on if you have removed it or not, there may be some help.

First, this is what it looks like on the screen:

The process that is running is called: "SetSysLog32.exe"

Look in the registry for the key:

HKU\S-1-5-21-1659004503-1563985344-839522115-500\Software\Microsoft\Windows\CurrentVersion\Run\SetSysLog32: ""C:\Documents and Settings\Administrator\Application Data\SetSysLog32.exe""

If that is there, then this is most likely what you have.

If you look under the key:


HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\bdgid: "1lL2V9I3dqW0?y"
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\id: "933"

Then you will notice that the entry under "id," (in this case it is "933") then you will find that this matches the number displayed at the top of the warning splash screen on boot-up.

The other entry, under "bgdid" may be the password needed to decrypt the encrypted files.

It would appear that the numbers that come back are being generated by the server located at the IP address that the malware sends the string "new" to right after unpacking and just as it initializes.  Unfortunately to this time, I have been unable to test that theory, as the only encrypted files that I have from a live machine had the ID number 313 at the top.

It does appear to be AES encryption, as the file has references to AesLib.dcu and EftGlobal.dcu inside of it once unpacked.  I also found those files in the temp directory of the originally infected machine.

More to come once I get the reports back from my sandbox and a few more runs though my lab.

New Ransomware

Just a quick post which will be updated as I work on this. It appears here is a new variant of ransomware being dropped which looks like it may be using an AES encryption routine on .doc, .jpg, .pdf files.

Assuming it is hitting others as well. Here is the link to the Anubis report when I submitted the exe file and the 2 files I found in the dropper directory. Anubis Report

 If anyone has any insight, please feel free to contact me through this blog site.

Warning to Wordpress Users

Reposted from The Sophos Naked Security Blog.

Troj/PHPShll-B: Malware injects itself into WordPress installations

On Friday, a colleague in our IT department asked about a Mal/Badsrc-C malware detection that had been found by Sophos products on one of their friends' websites.

When I initially downloaded the website it looked clean. However, the automated systems inside SophosLabs were detecting the webpage as being infected with Mal/Badsrc-C.

So, I investigated a little more deeply - repeating the download after setting the User-Agent in my browser to pretend to be Internet Explorer.

This time I saw:

>>> Virus 'Mal/Badsrc-C' found in file index.html

Continue reading at The Sophos Naked Security Blog

Anatomy of a Wordpress Hack at the Loudmouthman Blog

The Low Hanging Fruit

Once again the "hackers" as they call themselves have come across some low-hanging fruit and have exploited it to inject iFrame into a low-traffic site.

I came across this one when investigating a root-cause for a malware infection on one of the machines I administer.  Luckily the site had just been hit a couple days ago, and with the low traffic they have, it shouldn't infect many people.

I have informed the business owners and the site designer, but as of 3 hours later, the site is still online and the index.html file still has the iFrame code perched at the bottom of it. *update: the html files have been updated, but apparently by the bad guys*

It's a PDF exploit that takes advantage of CVE-2010-1885, which is a help and support center whitelist vulnerability.  Another fine reminder that if you don't keep your software up to date, you become low-hanging fruit as well.

Hopefully more to come as I tear this thing apart a bit.