Saturday, December 6, 2014

Moar Steamed Phish

I got another Steam phishing message from our same friend. See my last blog post HERE for more details.

Anyhow, the first thing I noticed is account changed their name from Rainstone to [unassigned] and the message is a bit different this time:

Same well done Steam profiles as before:


And the same vector to steal credentials via the Add Friend which requires you to "Sign In":


Before we jump to the malware -- let's check out this domain (steamcommununilty.com) real quick. If you remember from the last blog, this domain was in the list of domains registered with the jimmy_young@mail.ru e-mail address. I checked to see if he has added any more domains, but there is still the list of 21 domains from the last time we checked:
1.  csgo-lounqe.com
2.  lsteamcommunity.com
3.  steamcommunlirty.com <-- This was used in the last blog post
4.  steamcommunrilty.com
5.  steamcommunrlity.com
6.  steamcommunuilty.com
7.  steamcommunulty.com
8.  steamcommununilty.com <-- This is the new one
9.  steamcommunylty.com
10.  steamcommurnlity.com
11.  steamcommynility.com
12.  steamcommynilty.com
13.  steamcomrniunity.com
14.  steamcomynility.com
15.  steamcomynlity.com
16.  steamcornmiunity.com
17.  steammcommunility.com
18.  steamommunlity.com
19.  steamscommunility.com
20.  steamscommunilty.com
21.  steamscommunlity.com

'Ol Ivan is keeping plenty busy! Now let's get back to the malware which is the reason for this new post.

The first thing I noticed was they used a new icon in the download prompt:

So they went from the really good looking logo to one that looks more like ass. Oh well.

Here are the file details:
File:     SteamGuard.exe
Size:     229376
MD5:      D18C0C6E73DB25C8D29EF7DF0EE71AB1
Compiled: Sat, Dec 6 2014, 10:10:22  - 32 Bit .NET EXE
Version:  4.4.9.4

PEiD: Microsoft Visual C# / Basic .NET
DNiD: SmartAssembly v6.X -> RedGate

Redgate's SmartAssembly is .NET obfuscate: http://www.red-gate.com/products/dotnet-development/smartassembly/

Lastly, lets check the compiled date:
TimeDateStamp: 0x5482D60E (Sat Dec 06 05:10:22 2014)
Pretty new!

They are still hosting this malware using their Google Docs account. You can download a copy yourself at (defanged):
h00ps://doc-00-00-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/ojhnvu9ri857rdn0pnab5sg5nc8goshf/1417896000000/16555159379224722330/*/0B1uigRk0KLRZc21rOUpRMFBKNms?e=download 

If time passes and it disappears and you would like a copy, please tweet at me @JC_SoCal and I will get you a copy.

Nothing on VirusTotal for that hash as I write this (I'll upload it once I'm done).

Using Marc Ochsenmeier's tool PEStudio I check the exe file. The version info is COMPLETELY different than the previous malware they were hosting:


Since its .NET and obfuscated, I used de4dot to de-obfuscate the SmartAssembly.  Now I can read the .NET code in ilspy easily. and with that ... I am out of time. The rest of the analysis will have to continue later.

Monday, December 1, 2014

Steam Phish and Broken Malware

When I have free time, I like to try and add to this blog. I also like to play some online games. Lucky for me, I get to do both. Most of my games are on Steam, and to be honest it makes my life easier when I want to play with friends. It would appear that Steam makes malware distribution easier as well! Take for instance this phishing message I received through the Steam chat system:


To the average young player this looks fairly legit. A few things caught my eye, and I'll admit, the first of them was how they insisted I could use any browser. Who would care? Then I noticed the malformed domain: steamcommunlirty.com ... nice. The page actually had a well done Steam user profile:


When you tried to click Add Friend, it brought you to a login page which is pretty normal, especially for me. Most users are only logged into the Steam application and not the actual website.


So they are obviously harvesting usernames and passwords. Which should be enough for offloading expensive in game items like gun-skins for Counter Strike ... BUT WAIT! There's more!


This is a somewhat familiar message box, where Steam will actually require a code sent to your e-mail address on file in order to continue the login. However, it has been changed from requiring a code, to downloading SteamGuard.exe. How thoughtful.

Before we jump into the malware, lets take a look at the registrar information on this domain:

Domain name: steamcommunlirty.com
Domain idn name: steamcommunlirty.com
Status: clientTransferProhibited
Registry Domain ID:
Registrar WHOIS Server: whois.reg.ru
Registrar URL: https://www.reg.com/
Registrar URL: https://www.reg.ru/
Registrar URL: https://www.reg.ua/
Updated Date: 2014-11-29
Creation Date: 2014-11-29T12:24:10Z
Registrar Registration Expiration Date: 2015-11-29
Registrar: Domain names registrar REG.RU LLC
Registrar IANA ID: 1606
Registrar Abuse Contact Email: 
Registrar Abuse Contact Phone: +7.4955801111
Registry Registrant ID:
Registrant Name: Ivan Ivanov
Registrant Organization: Private Person
Registrant Street: Koshil 23
Registrant City: Horts
Registrant State/Province: Tehas
Registrant Postal Code: 123170
Registrant Country: RU
Registrant Phone: +38021312312
Registrant Phone Ext:
Registrant Fax: 
Registrant Fax Ext:
Registrant Email: jimmy_young@mail.ru
Registry Admin ID:
Admin Name: Ivan Ivanov
Admin Organization: Private Person
Admin Street: Koshil 23
Admin City: Horts
Admin State/Province: Tehas
Admin Postal Code: 123170
Admin Country: RU
Admin Phone: +38021312312
Admin Phone Ext:
Admin Fax: 
Admin Fax Ext:
Admin Email: jimmy_young@mail.ru
Registry Tech ID:
Tech Name: Ivan Ivanov
Tech Organization: Private Person
Tech Street: Koshil 23
Tech City: Horts
Tech State/Province: Tehas
Tech Postal Code: 123170
Tech Country: RU
Tech Phone: +38021312312
Tech Phone Ext:
Tech Fax: 
Tech Fax Ext:
Tech Email: jimmy_young@mail.ru
Name Server: ns1.sellexpo.net 
Name Server: ns2.sellexpo.net 
DNSSEC: Unsigned

According to DomainTools.com, this domain is registered to Mr. Ivan Ivanov in Russia. Ivan Ivanov is the US equivlent of John Smith, so I'll venture a guess that this is a fake name. Also according to whoismind.com, our friend Ivanov has a few other domains:
1.  csgo-lounqe.com
2.  lsteamcommunity.com
3.  steamcommunlirty.com << Here's ours!
4.  steamcommunrilty.com
5.  steamcommunrlity.com
6.  steamcommunuilty.com
7.  steamcommunulty.com
8.  steamcommununilty.com
9.  steamcommunylty.com
10.  steamcommurnlity.com
11.  steamcommynility.com
12.  steamcommynilty.com
13.  steamcomrniunity.com
14.  steamcomynility.com
15.  steamcomynlity.com
16.  steamcornmiunity.com
17.  steammcommunility.com
18.  steamommunlity.com
19.  steamscommunility.com
20.  steamscommunilty.com
21.  steamscommunlity.com

These all appear recently registered within the last month (November). This should be a pretty active campaign.

Okay, back to the malware!
File:     SteamGuard.exe
Size:     285184
MD5:      3D6FDC70E43D258FA30AC4687F4306CA
Compiled: Sun, Nov 30 2014, 13:47:44  - 32 Bit .NET EXE
Version:  1.0.0.0

Wow! Look at that compile time! That's some fresh malware.

Too bad it's busted and doesn't execute and I am out of time for messing with this. I tried to de-compile it as well and it is all in Chinese and I really don't have time for this. =(


At least they were festive when naming the resource in English.

If you want a copy, you can download it from the attackers link (defanged):
h00ps://doc-14-9k-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/qptklkqnpglih278lheo7v6gjqlqjnf6/1417500000000/12170790477719556769/*/0B4fsHdBQBTPWRlplaE5HWEJYWDA?e=download 

UPDATE #1

Well, that didn't take long. Rainstorm is back with another friend that needs to talk to me:

Looks like the same old same old with this cat, but wait. THERE'S MORE!!!!!! Another new domain that we didn't have in our original list ... let's check it out:

This time, they go by Maks Georgevich, with the email kreponenkorich@mail.ru. Feeding this back into whoismind shows that they only have one domain registered (steamcommiuinty.com). 

I know what your thinking -- maybe they fixed the malware? Let's check.

The website looks similar, but a new profile:

And the same shenanigans -- add a friend, log in, steal credentials and download our malware. Let's skip to the malware.

File:     SteamGuard.exe
Size:     285184
MD5:      3D6FDC70E43D258FA30AC4687F4306CA
Compiled: Sun, Nov 30 2014, 13:47:44  - 32 Bit .NET EXE
Version:  1.0.0.0

BOOOOOO! It's the same busted ass malware. Since they are harvesting credentials, if I get bored over the weekend I'll write a script to give them credentials ... =)


Saturday, April 12, 2014

Never enough time ... and an API for Fog

My goal is to blog at LEAST once a month. I missed March and I'm sorry to anyone that tries to get anything useful out of this blog. There is never enough time! I'll try harder.

Anyhow, COMPLETELY unrelated at the moment to security and on the topic of system administration, I am a huge fan of the FOG Project which is a free computer cloning solution. Think of Norton Ghost. However, I personally like this much better!

There is one issue (which is the reason for this blog post) that I have with FOG. They only have a web UI interface. This makes it a pain for automating tasks. So, I started making my first Python API for public consumption. I announced it on the FOG forum here: http://fogproject.org/forum/threads/python-api-for-fog-pyfog.10312/

and the python code is here: https://github.com/JC-SoCal/pyFog

Even though there is not a lot of functionality, I'm doing my best to keep this API professional and clean so that I can continue developing it and it benefits the FOG user community. This is my little way of giving back to their awesome project.

Thanks for reading,
April blog post, check in the box!

Monday, February 10, 2014

The Adobe password breach crossword ...

I thought I would mention here that I revisited the adobe password breach and wrote a blog which was posted at 6Labs. The blog discusses how you can recover the password from the adobe breach data and then if the user was employing password reuse you could access their accounts like email, facebook or possibly even corproate accoutns.  Check it out:

Revisiting the Adobe Password Breach & the Risk to Your Network