XyliBox: track 2 grabber

Tuesday, 28 May 2013

Dump Memory Grabber / BlackPOS (Win32/Pocardler.A)

Having a look on another POS malware named by AV guys BlackPOS:

MD5: cbd268e260bf40c25f1bff8b85e04e01
The original exe is packed with UPX and have a size of (292 Kb)
After unpacking the exe size is 754 Kb and the Time/Date Stamp: 512A2914 (24-02-2013 - 14:52:04)
First seen in VirusTotal... right now

This malware retrieve the path of %USERPROFILE%:

At this step we can trick it like ProjectHook to display a leet GUI:

Just take the jump:

Now if we don't take it, it copy the actual file to %USERPROFILE% with the name svhst.exe

execute the original exe with argument '/silentinstall'

I've choose to NOP the line to continue without infecting my vm, and what's he do next ?
The same crap but this time with argument ''/firewall"

Re-NOPed the line and... yeah, you guessed it, still WinExec with "Netsh firewall set opmode disable"

Netsh = network shell, this command will disable the Windows firewall.

Then he delete the file dum.exe (???)

He create after a registry entry: SOFTWARE\Microsoft\Windows\CurrentVersion\Run

RegSetValueExA with 'svchît' as name and %USERPROFILE%/svhst.exe as key.

RegCloseKey:

Now he will load a exe file from ressource:

And file 'dum.exe' is made (the exe file he tryed to delete earlier)

Write it:

And Close when everything is cool:

SetFileAttributesA:

Open it with SW_HIDE:

But what is it new file ?

Yo dawg i herd you like POS malware so we put a POS malware in yo POS malware so you can grab will u grab
MD5: 7f9cdc380eeed16eaab3e48d59f271aa

But if he ShellExecuteA mmon.exe, that mean it swiping time !

So, 'mmon.exe' generate us a file 'output.txt' with our track2. and this 'output.txt' is of course visible.

Meanwhile, BlackPos do a sleep of 400000 ms (6 minutes and 40 seconds) leaving the time for 'mmon.exe' to search track2:

After this sleep, it take output.txt of mmon and try to Create it to see if the file already exist:

Read the content:

Close it:

And create a new text file "03.05.25.txt":

Then he add the content of output.txt inside "03.05.25.txt" and set the file hidden:

Then he connect to FTP (what a good idea!)

.netai.net... maybe he grabbed not enough track2 to buy a decent hosting.

Compare if the domain is equal to localhost:

The he upload the TXT on reports folder and delete dum.exe and output.txt

Then i've stopped here, since i'm at the end of the procedure he surely loop the process of scanning with mmon.

If you want to see what's look like the panel for this sample:
• dns: 1 ›› ip: 31.170.161.116 - adresse: KROKODIL.NETAI.NET

Panel of another sample (d9cc74f36ff173343c6c7e9b4db228cd):
• dns: 1 ›› ip: 31.170.163.50 - adresse: SOBACHKA.COMZE.COM

Old panel of the coder (ree4):
• dns: 1 ›› ip: 109.234.159.254 - adresse: REE4.7CI.RU

The panel is primitive like the malware himself.

Conclusion: /facepalm

Friday, 25 January 2013

vSkimmer, Another POS malware

When i've view this post, content was already removed and member Banned.

vSkimmer - Virtual Skimmer

Functions:

- Track 2 grabber

- HTTP Loader (Download & Execute)

- Update bot itself

Working Modes:

- Online: If internet is reachable it will try to bypass firewalls and communicate to a the control panel.

- Offline: If internet is not reachable it wait for a specific pendrive/flashdrive plugged in and copy logs to it.

Server coded in PHP (can be modified on request to send logs to remote server, via smtp, etc.. )

Client coded in C++ no dependencies, 66kb, cryptable. (can be customized)

The malware check the presence of debugger:

Get PC details (OS,Computer name, GUID for identify you in the POS botnet, etc..)

Check if the file is executed from %APPDATA% if not add registry persistence, firewall rule, make a copy and execute the copy:

Detail of the registry persistence:

Firewall rule to allow the malware:

Create a mutex, thread and get host information:

Check for process:

Some are whitlisted: "System", smss.exe, csrss.exe, winlogon.exe, services.exe, lsass.exe, svchost.exe, spoolsv.exe, wscntfy.exe, alg.exe, mscorsvw.exe, ctfmon.exe, explorer.exe:

And when finally a process is found:

Read the process and search for pattern:

If nothing found:

Get infos, Base64 and call the gate via GET request:

Answer:

• dns: 1 ›› ip: 31.31.196.44 - adresse: WWW.POSTERMINALWORLD.LA

Parse the answer:

Answer is reduced to first 3 letters and compared with 'dlx' (Download & Execute) and 'upd' (Update) if one of these are found that mean the bad guys send us an order.

For example dlx:

Order is executed and a response is send to the server:

The part i love with pos malware:

Or just a simple ";1234567891234567=12345678912345678900?" in a txt but it's more gangsta to swipe a card.
So the algo detect the pattern, the track2 is encoded to base64