Saturday, December 6, 2014

Moar Steamed Phish

I got another Steam phishing message from our same friend. See my last blog post HERE for more details.

Anyhow, the first thing I noticed is account changed their name from Rainstone to [unassigned] and the message is a bit different this time:

Same well done Steam profiles as before:


And the same vector to steal credentials via the Add Friend which requires you to "Sign In":


Before we jump to the malware -- let's check out this domain (steamcommununilty.com) real quick. If you remember from the last blog, this domain was in the list of domains registered with the jimmy_young@mail.ru e-mail address. I checked to see if he has added any more domains, but there is still the list of 21 domains from the last time we checked:
1.  csgo-lounqe.com
2.  lsteamcommunity.com
3.  steamcommunlirty.com <-- This was used in the last blog post
4.  steamcommunrilty.com
5.  steamcommunrlity.com
6.  steamcommunuilty.com
7.  steamcommunulty.com
8.  steamcommununilty.com <-- This is the new one
9.  steamcommunylty.com
10.  steamcommurnlity.com
11.  steamcommynility.com
12.  steamcommynilty.com
13.  steamcomrniunity.com
14.  steamcomynility.com
15.  steamcomynlity.com
16.  steamcornmiunity.com
17.  steammcommunility.com
18.  steamommunlity.com
19.  steamscommunility.com
20.  steamscommunilty.com
21.  steamscommunlity.com

'Ol Ivan is keeping plenty busy! Now let's get back to the malware which is the reason for this new post.

The first thing I noticed was they used a new icon in the download prompt:

So they went from the really good looking logo to one that looks more like ass. Oh well.

Here are the file details:
File:     SteamGuard.exe
Size:     229376
MD5:      D18C0C6E73DB25C8D29EF7DF0EE71AB1
Compiled: Sat, Dec 6 2014, 10:10:22  - 32 Bit .NET EXE
Version:  4.4.9.4

PEiD: Microsoft Visual C# / Basic .NET
DNiD: SmartAssembly v6.X -> RedGate

Redgate's SmartAssembly is .NET obfuscate: http://www.red-gate.com/products/dotnet-development/smartassembly/

Lastly, lets check the compiled date:
TimeDateStamp: 0x5482D60E (Sat Dec 06 05:10:22 2014)
Pretty new!

They are still hosting this malware using their Google Docs account. You can download a copy yourself at (defanged):
h00ps://doc-00-00-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ojhnvu9ri857rdn0pnab5sg5nc8goshf/1417896000000/16555159379224722330/*/0B1uigRk0KLRZc21rOUpRMFBKNms?e=download 

If time passes and it disappears and you would like a copy, please tweet at me @JC_SoCal and I will get you a copy.

Nothing on VirusTotal for that hash as I write this (I'll upload it once I'm done).

Using Marc Ochsenmeier's tool PEStudio I check the exe file. The version info is COMPLETELY different than the previous malware they were hosting:


Since its .NET and obfuscated, I used de4dot to de-obfuscate the SmartAssembly.  Now I can read the .NET code in ilspy easily. and with that ... I am out of time. The rest of the analysis will have to continue later.

Monday, December 1, 2014

Steam Phish and Broken Malware

When I have free time, I like to try and add to this blog. I also like to play some online games. Lucky for me, I get to do both. Most of my games are on Steam, and to be honest it makes my life easier when I want to play with friends. It would appear that Steam makes malware distribution easier as well! Take for instance this phishing message I received through the Steam chat system:


To the average young player this looks fairly legit. A few things caught my eye, and I'll admit, the first of them was how they insisted I could use any browser. Who would care? Then I noticed the malformed domain: steamcommunlirty.com ... nice. The page actually had a well done Steam user profile:


When you tried to click Add Friend, it brought you to a login page which is pretty normal, especially for me. Most users are only logged into the Steam application and not the actual website.


So they are obviously harvesting usernames and passwords. Which should be enough for offloading expensive in game items like gun-skins for Counter Strike ... BUT WAIT! There's more!


This is a somewhat familiar message box, where Steam will actually require a code sent to your e-mail address on file in order to continue the login. However, it has been changed from requiring a code, to downloading SteamGuard.exe. How thoughtful.

Before we jump into the malware, lets take a look at the registrar information on this domain:

Domain name: steamcommunlirty.com
Domain idn name: steamcommunlirty.com
Status: clientTransferProhibited
Registry Domain ID:
Registrar WHOIS Server: whois.reg.ru
Registrar URL: https://www.reg.com/
Registrar URL: https://www.reg.ru/
Registrar URL: https://www.reg.ua/
Updated Date: 2014-11-29
Creation Date: 2014-11-29T12:24:10Z
Registrar Registration Expiration Date: 2015-11-29
Registrar: Domain names registrar REG.RU LLC
Registrar IANA ID: 1606
Registrar Abuse Contact Email: 
Registrar Abuse Contact Phone: +7.4955801111
Registry Registrant ID:
Registrant Name: Ivan Ivanov
Registrant Organization: Private Person
Registrant Street: Koshil 23
Registrant City: Horts
Registrant State/Province: Tehas
Registrant Postal Code: 123170
Registrant Country: RU
Registrant Phone: +38021312312
Registrant Phone Ext:
Registrant Fax: 
Registrant Fax Ext:
Registrant Email: jimmy_young@mail.ru
Registry Admin ID:
Admin Name: Ivan Ivanov
Admin Organization: Private Person
Admin Street: Koshil 23
Admin City: Horts
Admin State/Province: Tehas
Admin Postal Code: 123170
Admin Country: RU
Admin Phone: +38021312312
Admin Phone Ext:
Admin Fax: 
Admin Fax Ext:
Admin Email: jimmy_young@mail.ru
Registry Tech ID:
Tech Name: Ivan Ivanov
Tech Organization: Private Person
Tech Street: Koshil 23
Tech City: Horts
Tech State/Province: Tehas
Tech Postal Code: 123170
Tech Country: RU
Tech Phone: +38021312312
Tech Phone Ext:
Tech Fax: 
Tech Fax Ext:
Tech Email: jimmy_young@mail.ru
Name Server: ns1.sellexpo.net 
Name Server: ns2.sellexpo.net 
DNSSEC: Unsigned

According to DomainTools.com, this domain is registered to Mr. Ivan Ivanov in Russia. Ivan Ivanov is the US equivlent of John Smith, so I'll venture a guess that this is a fake name. Also according to whoismind.com, our friend Ivanov has a few other domains:
1.  csgo-lounqe.com
2.  lsteamcommunity.com
3.  steamcommunlirty.com << Here's ours!
4.  steamcommunrilty.com
5.  steamcommunrlity.com
6.  steamcommunuilty.com
7.  steamcommunulty.com
8.  steamcommununilty.com
9.  steamcommunylty.com
10.  steamcommurnlity.com
11.  steamcommynility.com
12.  steamcommynilty.com
13.  steamcomrniunity.com
14.  steamcomynility.com
15.  steamcomynlity.com
16.  steamcornmiunity.com
17.  steammcommunility.com
18.  steamommunlity.com
19.  steamscommunility.com
20.  steamscommunilty.com
21.  steamscommunlity.com

These all appear recently registered within the last month (November). This should be a pretty active campaign.

Okay, back to the malware!
File:     SteamGuard.exe
Size:     285184
MD5:      3D6FDC70E43D258FA30AC4687F4306CA
Compiled: Sun, Nov 30 2014, 13:47:44  - 32 Bit .NET EXE
Version:  1.0.0.0

Wow! Look at that compile time! That's some fresh malware.

Too bad it's busted and doesn't execute and I am out of time for messing with this. I tried to de-compile it as well and it is all in Chinese and I really don't have time for this. =(


At least they were festive when naming the resource in English.

If you want a copy, you can download it from the attackers link (defanged):
h00ps://doc-14-9k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/qptklkqnpglih278lheo7v6gjqlqjnf6/1417500000000/12170790477719556769/*/0B4fsHdBQBTPWRlplaE5HWEJYWDA?e=download 

UPDATE #1

Well, that didn't take long. Rainstorm is back with another friend that needs to talk to me:

Looks like the same old same old with this cat, but wait. THERE'S MORE!!!!!! Another new domain that we didn't have in our original list ... let's check it out:

This time, they go by Maks Georgevich, with the email kreponenkorich@mail.ru. Feeding this back into whoismind shows that they only have one domain registered (steamcommiuinty.com). 

I know what your thinking -- maybe they fixed the malware? Let's check.

The website looks similar, but a new profile:

And the same shenanigans -- add a friend, log in, steal credentials and download our malware. Let's skip to the malware.

File:     SteamGuard.exe
Size:     285184
MD5:      3D6FDC70E43D258FA30AC4687F4306CA
Compiled: Sun, Nov 30 2014, 13:47:44  - 32 Bit .NET EXE
Version:  1.0.0.0

BOOOOOO! It's the same busted ass malware. Since they are harvesting credentials, if I get bored over the weekend I'll write a script to give them credentials ... =)


Saturday, April 12, 2014

Never enough time ... and an API for Fog

My goal is to blog at LEAST once a month. I missed March and I'm sorry to anyone that tries to get anything useful out of this blog. There is never enough time! I'll try harder.

Anyhow, COMPLETELY unrelated at the moment to security and on the topic of system administration, I am a huge fan of the FOG Project which is a free computer cloning solution. Think of Norton Ghost. However, I personally like this much better!

There is one issue (which is the reason for this blog post) that I have with FOG. They only have a web UI interface. This makes it a pain for automating tasks. So, I started making my first Python API for public consumption. I announced it on the FOG forum here: http://fogproject.org/forum/threads/python-api-for-fog-pyfog.10312/

and the python code is here: https://github.com/JC-SoCal/pyFog

Even though there is not a lot of functionality, I'm doing my best to keep this API professional and clean so that I can continue developing it and it benefits the FOG user community. This is my little way of giving back to their awesome project.

Thanks for reading,
April blog post, check in the box!

Monday, February 10, 2014

The Adobe password breach crossword ...

I thought I would mention here that I revisited the adobe password breach and wrote a blog which was posted at 6Labs. The blog discusses how you can recover the password from the adobe breach data and then if the user was employing password reuse you could access their accounts like email, facebook or possibly even corproate accoutns.  Check it out:

Revisiting the Adobe Password Breach & the Risk to Your Network

Monday, November 18, 2013

ASLR Woes for Malware Analysts using Windows 7

For those of us that have made the move from XP to 7 for their malware analysis, you may have noticed that when trying to use IDA Pro and Olly or another debugger that the virtual addresses are not matching. This is because Windows 7 ships with Address space layout randomization (ASLR) enabled.

We can use Microsoft's Enhanced Mitigation Experience Toolkit to easily toggle ASLR on and off with a reboot. This way you don't have to make any manual registry settings and you can also control DEP, SEHOP and Certificate Trust if you need to.

You can download EMET 4.1 here: http://www.microsoft.com/en-us/download/details.aspx?id=41138


To disable ASLR:

Simply select the drop down next so ASLR and choose disable. You will need to reboot after that.

Sunday, November 3, 2013

Snazzy Windows Context Menu for Malware Analysis

One thing I like to do is save time. I am sure a lot of other people do as well. Malware Analysis is no exception to the rule. With that being said, I have found having my go-to programs in a handy context menu saves a bit of tedious clicking. Below is a screen shot of the menu I made that shows all my tools.


It was a little tricky tweaking the registry to do this, but I feel like I have it down well enough to explain it. So here goes:

Step 0: Warning

Backup your registry, take a snapshot of your VM, or do what ever it is you do in case you break your box doing this. Tweaking the Registry is always dangerous. Also, some words need to be exact. Windows uses conventions over configurations to know what's what in the registry. So don't be lazy or it won't work.

Step 0.5:

Open up the windows registry editor: regedit.exe

Step 1:

To create the cascading Malware Analysis menu navigate to the following key:
[HKEY_CLASSES_ROOT\*\shell\]

Right click on shell and select:
New > Key

For this tutorial we will name it DemoMenu

Right click and select:
New > String Value

Name the new value MUIVerb (this must be exact) and set the value to whatever you want the cascade menu to say, this will be:
Cascade Menu

Warning: Do not edit or modify the one titled (Default)

Right click on DemoMenu and make another String Value. Name this one SubCommands (this must be exact). This is not where we name them, but it is how the menu calls them. Keep the names short and descriptive with no spaces. Use a semicolon to delimit the items. If you would like a divider line put a | (pipe) character in there. Here is a sample for the demo:
DemoNotepad;|;DemoWordPad

If you did it correctly -- yours should look like this:


Step 2:

Step 2 will need to be repeated for each item you put in SubCommands.

Browse to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\

This is where we will create the command for each item.

Right click on shell and select:
New > Key

Name the key the exact same as the first item in our SubCommands data. For this example it is DemoNotepad

Edit the data in the (Default) value. Put whatever you want this command to be called in your menu. For this tutorial we'll just call it Notepad

Right click on the key we made (DemoNotepad) and select:
New > Key

Name this key:
command (this needs to be exact)

Double click on the (Default) value in the command key.

Enter the path of the program we want. For the notepad example we use: "C:\windows\system32\notepad.exe" "%1"
(Mind the quotes and spaces)

We also added a %1 at the end of the command. This is essentially argument 1 but what this will do is reference the file path we are right clicking on so the program knows we want to open that file.

Pro-Tip: If the path to your program contains spaces such as C:\Program Files\blahblah make sure to put the path in double quotes "  ". Since we don't have any clue what we may right click on and if that path has spaces, we put %1 in quotes.

If you did it correctly -- yours should look like this:

Showing the data for DemoNotepad

Showing the data for command


Step 3:

Repeat Step 2 for each item in SubCommands.

I added another for DemoWordpad. Here is a screen shot below:



Step 4: Profit

Now you have an awesome context menu you can save time with:


To save myself time, I turned my context menu registry tweaks into a .reg script. Here is the link to it on github: https://github.com/JC-SoCal/RegistryFun/blob/master/MalwareAnalysisContextMenu.reg

Please feel free to send me questions/comments/concerns or suggestions on here or on twitter @JC_SoCal

Source: http://msdn.microsoft.com/en-us/library/windows/desktop/hh127467(v=vs.85).aspx

Enjoy!

Saturday, October 12, 2013

[Video] Reverse Engineering a 9 year old CrackMe

TL;DR Version: I have always wanted to make a YouTube video to give back to the community demoing something useful, so I recorded myself reversing a 9 year old CrackMe and posted it. Enjoy.


I have learned countless things from YouTube. Including everything from building potato guns to how a nuclear reactor works. So this is my way to give back to the community and try and teach something. 

The CrackMe I reversed is the LaFarge CrackMe #2. I chose this one for two reasons: It had high ratings and it was marked easy. Since I would have to narrate this, I didn't want to have a difficult time with this project.