Japan Cyber Cops Cuff Evil Cat

May 25th, 2012 by Rob Henriquez

This sounds like the plot for the next James Bond movie: a cyber villain, a coded message and the police running after a computer malware. Except this took place in Japan, in real world.

Japanese news corporation received promises of big scoops and several quizzes in e-mails. The police took over and had to acknowledge that it mis-treated a few suspects in an e-mails threat case concerning different venues, a few of which are frequented by the Imperial Family.

After going to a mountain top, the cyber coppers finally captured a cat bearing a drive with a copy of (apparently) the iesys.exe virus. Dubbed the "remote control virus", it allows - as it is the case for many malwares - an attacker to seize control of a machine and use it as a proxy to send network traffic, for instance threatening e-mails, surfing illegal websites or performing DDoS attacks.

In the process, it seems the Japanese police coerced some suspects into confessing the e-mail threats. This led to an embarrassing snafu and the police presenting apologies to four different people. After the incidents and the apologies, the police agreed that it has to better its cyber crime procedures.

Link to the press releases: here and in the Register.

"You received a voice mail" leads to malware

I have a few colleagues who got an e-mail with a page saying "You received a voice mail", followed by a link pretending to be a wave file.

The first link leads to a page with a table of three items on different servers, called js.js. These are basic redirectors. Out of the three, only two works and return the exact same javascript code, a redirection to a PHP page on a website.

That second URL returns an obfuscated massive Javascript: the author took some time to correctly do the work: a few tautologies such as "if(document.body) {}" and others add some weight, certains function names are split in different string variables, pieced together and eval'd into other variable to be used as functions. And that's only the decoding portion.

A massive i tag contains a 112 attributes, all identified by integers. In the HTML code, they are not in order, but the code re-order everything and builds a large string, which is passed to a second function whose role is to:

• if the first character of the current pair of character is "=", go to the next pair;
• decode the value as a base-23 integer, convert into a character and add it to the decoded string.   

The result is another javascript script which is evaluated. Its exact role is not yet known, but here are a few notes:

• it detects the OS and browser;
• it searches for a number of Adobe, MS DOMXML and others plugins and gets the versions;
• there is a mention of a PDF file in the code;
• two URLs are mentioned, one was taken down already and was used to download a file called "update_flash_player.exe", confirming that it may be trying to exploit some flash vulnerabilities, the other one was still live at the moment of the analysis and was used to serve an executable (Info on VirusTotal). Yesterday at around 6PM EST, the detection rate was 4/44.

Once that object executed, it contacted a forum, then attempted a download from three different sites, which returned the same executable. My only guess at this time is the author planned for some redundancy should some of the sites be taken down. The additional download was also submitted to VirusTotal (info). As of yesterday, around the same time, the detection rate was 6/44.

When executed, these additional did nothing during the analysis period. They may be dormant or waiting for some condition to be met.

The analysis continues!

Royal mail in the a...

Another day, another malware. Detection ratio for this one is 1/42 @ 8/15/2012 7:06 EST.

Information about it on Virus Total

And another one: booking.com

In the same fashion, I got an e-mail today allegedly from booking.com to give me some information about a reservation I have done. Or so is it written.

Again, a zip file is attached, that contains an executable. Here are the md5 hash values:

46ea3e441be4ba82fa2d059a5ca45f23  Booking-Com-Reservation.exe
e877998eef741bc7ed688584ed7595b6  Booking-Reservation-Details-NUM930833336.zip

It uses the same host (yerurr.com).

Interestingly enough, there is either a timer or a wait for the next reboot: after a reboot and having waited for a while, there was some activity to a site in Germany (www.floodwave.de) to get /services/images/servicesa.exe (md5sum: 8d39f983e08f68ca4ccb3a92f5e4a7ac). This file is not recognized as malware by any antivirus (VirusTotal Report)

When rebooted one more time, the machine followed the same cycle: request to Google, resolution of yerurr.com, POST /was/tnk.php. I stopped there, but I suspect that the machine would probably do something after a time, which I will try this week-end.

And another strain - DHL Express

Another one, again posing to be from a delivery company.

I got an e-mail, with a zip attachement (DHL_Express_Shipment_POST_ORDER_ID92VMUANA.zip, md5 hash: b8d96b95875bc31d9f5448e5d06837cc  ). When decompressed, an executable is present (DHL_Express_Shipment_POST_ORDER_ID.exe, md5 hash: cc6e8193c7475ef34f79ab82ec6f90fc)

As of 02/14/2012, only 3 out of 43 AVs correctly detect the file as infected (VirusTotal report). Once decompressed, that number falls to 2/43 (VirusTotal report).

Funnily, my first attempt to run the executable into my 2008 virtual machine (64 bits) failed - DEP intercepted it and prevented the execution.

As for the previous two strains, this one first makes a request to Google.com (GET / HTTP/1.1). It then resolves yerurr.com and does a POST /was/tnk.php with a very long body. In my case, the activity stopped there.

Deutschen Post Strain 1 - Some information

Nothing to mention, really. I ran the first strain in the same condition ... and got the same outcome. It seems that the two are variants of the same piece of code.

They both try to access Google.com, then resolve "kemolderin.com" and to do a POST request to "/wap/udp.php".

For more information: see my previous post

Deutschen Post Strain 2 - Some information

Since this morning, as I am home sick, I have decided to give Strain 2 from my previous post a try.

I installed a Windows 2008 Standard in a virtual environment to run the malware.

It started by doing a DNS request for "kemolderin.com" (resolution 66.199.231.30 on 02/07/2012 at 2:09 EST). It then connected to that IP on port TCP/80 and did a "POST /wap/udp.php" with a very long string of data.

The answer from the server was "HTTP/1.1 302 Found" , with a few extra data (c0 83 a4 1c 1d 5f 72 ab).

The fun thing is I tried to browse to the same page, but I was greeted with a "Suspended Domain".

At this time, that's it folks. I will monitor the machine next time I reboot it, and I will try with a windows XP as soon as I have one.

Fedex, DHL, Deutschen Post and you've got ... a virus

Among the many things I truly love about my Google Mail is its ability to detect viruses in what people try to send me. But first things first.

I used to operate my own mail server for nearly a decade. Along the road came the installation of an antis-spam daemon (spamassassin team: you rock!), an attempt at installing an anti-virus/anti-malware using ClamAV, and various other tweaks and tunes to make it (a) work correctly and (b) avoid something that approaches 90% of undesirable content.

Also, as I am more and more often traveling, I installed a webmail application on my server, so I could process my mail without having to establish a POPS/IMAPS connection to my server. This came with the loss of a few features, but all in all, it was working OK.

Then one day, I tried Google Mail. The interface is sleek and easy to use, I have all my features back and things. And Google gets my e-mail on my "own" address.

So recently, I have started getting more and more "Message left on server: ...." as it contains a potential virus or suspicious attachment. And more and more, I have been intrigued about these.

They all purport to come from DHL, FedEx or Deutschen Post. They all have a ZIP attachment, and they all enjoin you to take an immediate action: execute the piece in the attachment. The title are visibly generated at random for the last part, all the zip have an executable. The latter has a title that is non random: in all the recent zip files I received, the exec file name is "Deutschen_Post_oder_DHL-ID.exe".

In these, I have identified two different strains.

The first one has a MD5 hash value of "3162d052c388c5310a5f1a9f429c670c" and a size of 135168 bytes. As of 02/07/2012 10:58am EST, only 14 scanners out of 42 detect the executable file as malware (Report on VirusTotal.com), less than 40%.

The second strain has a MD5 hash value of "c497c6d0b69cb2e03236af82cc651193" and a size of 114688 bytes.  As of 02/07/2012 11:05am EST, only 10 scanners out of 43 detect the executable file as malware (Report on VirusTotal.com), less than 30%.

As (a) the names are consistent except for a random part in the zip file, (b) the archive content is exactly the same within a strain and (c) that I got these from various IPs, I lean toward an automated type of distribution, possibly a worm or a bot type.

I still need to do some homework and play with these to see whether they point to the same "owner".