http://isc.sans.org/diary.html?storyid=3778
http://isc.sans.org/diary.html?storyid=3784
Since then new variants and new domains have been reported daily. Average detection isn't too bad considering that their hashes and sizes may change every 30 minutes.
<h4>
merrychristmasdude.com - stripshow.exe
</h4>Hijackthis log.
O4 - HKCU\..\Run: [disnisa] C:\WINDOWS\disnisa.exe
Registry changes.
Grants itself access when using the XP firewall and modifies the settings related to the synchronization of Internet Time.
<h4>QUOTEHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List "C:\WINDOWS\disnisa.exe"
Type: REG_SZ
Data: C:\WINDOWS\disnisa.exe:*:Enabled:enable
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters "NtpServer"
Old type: REG_SZ
New type: REG_SZ
Old data: time.windows.com,0x1
New data: time.windows.com,time.nist.gov
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters "Type"
Old type: REG_SZ
New type: REG_SZ
Old data: NoSync
New data: NTP
uhavepostcard.com - happy2008.exe
</h4>Same changes as above, but this tier I did end up with a copy of the trojan in each folder on the HDD.
the bugger also changed my DNS servers.QUOTEc:\_install.exe
c:\Program Files\_install.exe
c:\Program Files\AutoIt3\_install.exe
Date: 12/25/2007 3:54 PM
Size: 133,633 bytes
c:\Program Files\AutoIt3\Aut2Exe\_install.exe
Date: 12/25/2007 3:54 PM
Size: 133,633 bytes
c:\Program Files\AutoIt3\Extras\Exe2Aut\_install.exe
Date: 12/25/2007 3:54 PM
Size: 133,633 bytes
c:\Program Files\AutoIt3\Extras\SQLite\_install.exe
Date: 12/25/2007 3:54 PM
Size: 133,633 bytes
etc ....
Those two versions don't have any rootkit components but if you leave them running for a while they are able to download additional malware on the computer.QUOTEO17 - HKLM\System\CCS\Services\Tcpip\..\{0EA144BD-B0FA-4739-9823-B30B93C67B52}: NameServer = 86.64.145.140
O17 - HKLM\System\CCS\Services\Tcpip\..\{65ADB1E0-9F61-4345-A07F-FB5A49913656}: NameServer = 86.64.145.140
O17 - HKLM\System\CCS\Services\Tcpip\..\{7F1821CA-77FA-4148-A4C4-BC3F2763587A}: NameServer = 86.64.145.140
O17 - HKLM\System\CS1\Services\Tcpip\..\{0EA144BD-B0FA-4739-9823-B30B93C67B52}: NameServer = 86.64.145.140
You may get an antivirus killer and beep.sys might be replaced on the computer. This version is particulary difficult to clean as beep.sys prevents the running of certain cleaning tools.
<h4>
happycards2008.com - happy-2008.exe
</h4>Rootkit Scan.
This version hides files and registry entries starting with "clean". The service and the sys file are partially random.QUOTEGMER 1.0.14.13998 - http://www.gmer.net
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT \??\C:\WINDOWS\system32\clean767c-5b3b.sys ZwEnumerateKey [0xF5B84920]
SSDT \??\C:\WINDOWS\system32\clean767c-5b3b.sys ZwEnumerateValueKey [0xF5B84A9E]
SSDT \??\C:\WINDOWS\system32\clean767c-5b3b.sys ZwQueryDirectoryFile [0xF5B845D6]
---- Devices - GMER 1.0.14 ----
AttachedDevice \Driver\Tcpip \Device\Ip
clean767c-5b3b.sys
AttachedDevice \Driver\Tcpip \Device\Tcp clean767c-5b3b.sys
AttachedDevice \Driver\Tcpip \Device\Udp clean767c-5b3b.sys
AttachedDevice \Driver\Tcpip \Device\RawIp clean767c-5b3b.sys
---- Services - GMER 1.0.14 ----
Service C:\WINDOWS\system32\clean767c-5b3b.sys (*** hidden *** ) [AUTO] clean767c-5b3b
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\cleanmgr.exe
Reg HKLM\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\cleanmgr.exe@0 0x00 0x00 0x28 0x0A ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\cleanmgr.exe@1 0x1E 0x09 0x9B 0xF1 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\cleanri.exe
Reg HKLM\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\cleanri.exe@0 0x00 0x00 0x28 0x0A ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\cleanri.exe@1 0xDA 0x95 0xCD 0xBB ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\clean767c-5b3b
Reg HKLM\SYSTEM\CurrentControlSet\Services\clean767c-5b3b@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\clean767c-5b3b@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\clean767c-5b3b@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\clean767c-5b3b@ImagePath \??\C:\WINDOWS\system32\clean767c-5b3b.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\clean767c-5b3b@DisplayName clean767c-5b3b
Reg HKLM\SYSTEM\CurrentControlSet\Services\clean767c-5b3b\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\clean767c-5b3b\Security@Security 0x01 0x00 0x14 0x80 ...
Reg HKLM\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\cleanmgr.exe
Reg HKLM\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\cleanmgr.exe@0 0x00 0x00 0x28 0x0A ...
Reg HKLM\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\cleanmgr.exe@1 0x1E 0x09 0x9B 0xF1 ...
Reg HKLM\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\cleanri.exe
Reg HKLM\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\cleanri.exe@0 0x00 0x00 0x28 0x0A ...
Reg HKLM\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\cleanri.exe@1 0xDA 0x95 0xCD 0xBB ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VcCleanUp.exe
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\VcCleanUp.exe@ C:\PROGRA~1\COMMON~1\SYMANT~1\LiveReg\VCCLEA~1.EXE
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\cleanuppath@ %SystemRoot%\system32\cleanmgr.exe /D %c
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Content Indexer Cleaner
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Content Indexer Cleaner@ {A9B48EAC-3ED8-11d2-8216-00C04FB687DA}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Content Indexer Cleaner@PropertyBag {24400D16-5754-11d2-8218-00C04FB687DA}
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Content Indexer Cleaner@FileList *.*
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Content Indexer Cleaner@Folder ?:\Catalog.wci
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Content Indexer Cleaner@Flags 321
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Content Indexer Cleaner@Priority 300
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Branding@QuietUninstallString Rundll32 IedkCS32.dll,BrandCleanInstallStubs
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cleanup.dll
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cleanup.dll@CheckAppHelp 1
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup@ ComCacheCleanup 1.0 Object
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup\CLSID
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup\CLSID@ {F7A4F1DA-96C3-4BCF-BEB3-1D9FFDE89EE9}
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup\CurVer
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup\CurVer@ NODEMGR.ComCacheCleanup.1
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup.1
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup.1@ ComCacheCleanup 1.0 Object
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup.1\CLSID
Reg HKLM\SOFTWARE\Classes\NODEMGR.ComCacheCleanup.1\CLSID@ {F7A4F1DA-96C3-4BCF-BEB3-1D9FFDE89EE9}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer@CleanShutdown 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz@Last used time 0x30 0xE4 0x7B 0xC4 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz@Days between clean up 60
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\CleanupWiz@NoRun 1
Reg HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache@@shell32.dll,-22026 Disk Cleanup
---- Files - GMER 1.0.14 ----
File C:\WINDOWS\system32\dllcache\cleanmgr.exe 64000 bytes
File C:\WINDOWS\system32\clean.config 24345 bytes
File C:\WINDOWS\system32\clean767c-5b3b.sys 129664 bytes
File C:\WINDOWS\system32\cleanmgr.exe 64000 bytes
---- EOF - GMER 1.0.14 ----
clean[random 4 letters / numbers]-[random 4 letters / numbers].
<h4>
newyearcards2008.com - happy-2008.exe
</h4>Rootkit Scan.
bldy[random 4 letters / numbers]-[random 4 letters / numbers]QUOTEGMER 1.0.14.13998 - http://www.gmer.net
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT \??\C:\WINDOWS\system32\bldy6d83-68c9.sys ZwEnumerateKey [0xF5B84920]
SSDT \??\C:\WINDOWS\system32\bldy6d83-68c9.sys ZwEnumerateValueKey [0xF5B84A9C]
SSDT \??\C:\WINDOWS\system32\bldy6d83-68c9.sys ZwQueryDirectoryFile [0xF5B845D8]
---- Devices - GMER 1.0.14 ----
AttachedDevice \Driver\Tcpip \Device\Ip bldy6d83-68c9.sys
AttachedDevice \Driver\Tcpip \Device\Tcp bldy6d83-68c9.sys
AttachedDevice \Driver\Tcpip \Device\Udp bldy6d83-68c9.sys
AttachedDevice \Driver\Tcpip \Device\RawIp bldy6d83-68c9.sys
---- Services - GMER 1.0.14 ----
Service C:\WINDOWS\system32\bldy6d83-68c9.sys (*** hidden *** ) [AUTO] bldy6d83-68c9 <-- ROOTKIT !!!
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\bldy6d83-68c9
Reg HKLM\SYSTEM\CurrentControlSet\Services\bldy6d83-68c9@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\bldy6d83-68c9@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\bldy6d83-68c9@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\bldy6d83-68c9@ImagePath \??\C:\WINDOWS\system32\bldy6d83-68c9.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\bldy6d83-68c9@DisplayName bldy6d83-68c9
Reg HKLM\SYSTEM\CurrentControlSet\Services\bldy6d83-68c9\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\bldy6d83-68c9\Security@Security 0x01 0x00 0x14 0x80 ...
---- Files - GMER 1.0.14 ----
File C:\WINDOWS\system32\bldy.config 37379 bytes
File C:\WINDOWS\system32\bldy6d83-68c9.sys 129664 bytes <-- ROOTKIT !!!
---- EOF - GMER 1.0.14 ----
<h4>
newyearwithlove.com - happynewyear2008.exe
</h4>Rootkit Scan.
ortyeras[random 4 letters / numbers]-[random 4 letters / numbers]QUOTEGMER 1.0.14.13998 - http://www.gmer.net
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT \??\C:\WINDOWS\system32\ortyeras4790-21bc.sys ZwEnumerateKey [0xF5BA7890]
SSDT \??\C:\WINDOWS\system32\ortyeras4790-21bc.sys ZwEnumerateValueKey [0xF5BA7A1C]
SSDT \??\C:\WINDOWS\system32\ortyeras4790-21bc.sys ZwQueryDirectoryFile [0xF5BA7578]
---- Devices - GMER 1.0.14 ----
AttachedDevice \Driver\Tcpip \Device\Ip ortyeras4790-21bc.sys
AttachedDevice \Driver\Tcpip \Device\Tcp ortyeras4790-21bc.sys
AttachedDevice \Driver\Tcpip \Device\Udp ortyeras4790-21bc.sys
AttachedDevice \Driver\Tcpip \Device\RawIp ortyeras4790-21bc.sys
Device \Driver\SYMTDI \Device\SymTDI ortyeras4790-21bc.sys
---- Services - GMER 1.0.14 ----
Service C:\WINDOWS\system32\ortyeras4790-21bc.sys (*** hidden *** ) [AUTO] ortyeras4790-21bc
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\ortyeras4790-21bc
Reg HKLM\SYSTEM\CurrentControlSet\Services\ortyeras4790-21bc@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ortyeras4790-21bc@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\ortyeras4790-21bc@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ortyeras4790-21bc@ImagePath \??\C:\WINDOWS\system32\ortyeras4790-21bc.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\ortyeras4790-21bc@DisplayName ortyeras4790-21bc
Reg HKLM\SYSTEM\CurrentControlSet\Services\ortyeras4790-21bc\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\ortyeras4790-21bc\Security@Security 0x01 0x00 0x14 0x80 ...
---- Files - GMER 1.0.14 ----
File C:\WINDOWS\system32\ortyeras.config 40563 bytes
File C:\WINDOWS\system32\ortyeras4790-21bc.sys 129536 bytes
---- EOF - GMER 1.0.14 ----
<h4>
familypostcards2008.com - happynewyear2008.exe / freshcards2008.com - happynewyear2008.exe
</h4>Rootkit Scan.
kalleny[random 4 letters / numbers]-[random 4 letters / numbers]QUOTEGMER 1.0.14.13998 - http://www.gmer.net
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.14 ----
SSDT \??\C:\WINDOWS\system32\kalleny30c8-4459.sys ZwEnumerateKey [0xF5B8586E]
SSDT \??\C:\WINDOWS\system32\kalleny30c8-4459.sys ZwEnumerateValueKey [0xF5B859F4]
SSDT \??\C:\WINDOWS\system32\kalleny30c8-4459.sys ZwQueryDirectoryFile [0xF5B85560]
---- Devices - GMER 1.0.14 ----
AttachedDevice \Driver\Tcpip \Device\Ip kalleny30c8-4459.sys
AttachedDevice \Driver\Tcpip \Device\Tcp kalleny30c8-4459.sys
AttachedDevice \Driver\Tcpip \Device\Udp kalleny30c8-4459.sys
AttachedDevice \Driver\Tcpip \Device\RawIp kalleny30c8-4459.sys
Device \Driver\SYMTDI \Device\SymTDI kalleny30c8-4459.sys
---- Services - GMER 1.0.14 ----
Service C:\WINDOWS\system32\kalleny30c8-4459.sys (*** hidden *** ) [AUTO] kalleny30c8-4459
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\kalleny30c8-4459
Reg HKLM\SYSTEM\CurrentControlSet\Services\kalleny30c8-4459@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kalleny30c8-4459@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\kalleny30c8-4459@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\kalleny30c8-4459@ImagePath \??\C:\WINDOWS\system32\kalleny30c8-4459.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\kalleny30c8-4459@DisplayName kalleny30c8-4459
Reg HKLM\SYSTEM\CurrentControlSet\Services\kalleny30c8-4459\Security
Reg HKLM\SYSTEM\CurrentControlSet\Services\kalleny30c8-4459\Security@Security 0x01 0x00 0x14 0x80 ...
---- Files - GMER 1.0.14 ----
File C:\WINDOWS\system32\kalleny.config 41250 bytes
File C:\WINDOWS\system32\kalleny30c8-4459.sys 131200 bytes
---- EOF - GMER 1.0.14 ----
<h4>
Notes
</h4>I left a couple of entries out of the gmer scan which are related to the firewall. If you have an eagle eye, you'll be able to spot the evolution for yourself.
In the 3 last versions, one can see that the rootkit "intercepts" the firewall filtering.
Clean PC.
Rootkit installed.QUOTE---- Devices - GMER 1.0.14 ----
AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
SymTDI is the Norton Internet Security filter, the driver has been replaced by the rootkit.QUOTE---- Devices - GMER 1.0.14 ----
AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip kalleny30c8-4459.sys
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp kalleny30c8-4459.sys
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp kalleny30c8-4459.sys
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Norton Internet Security Filter/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp kalleny30c8-4459.sys
Device \Driver\SYMTDI \Device\SymTDI kalleny30c8-4459.sys
Summary.
- Arrives normally as an email attachment (May arrive from drive-by downloads too).
- Searches for email addresses by enumerating files with the certain extensions. This is a typical behavior of mass-mailers and spam-bots.QUOTEADB - ASP - CFG - CGI - DBX - DHTM - EML - HTM - HTML - INI - JSP - MBX - MDX - MHT - MMF - MSG - NCH - NFO - ODS - OFT - PHP - PL - PP - SHT - SHTM - STM - TBB - TXT - UIN - WAB - WSH - XLS - XML
- Able to send out email message(s) with the built-in SMTP client engine.
- Has a build-in peer-to-peer client. The list of peers is encoded into %System%\[driver name].config
Sample:CODE[config]
[local]
uport=6902
[peers]
00003D6C8F338A3FDD3DF3648666F55C=185E494E272400
0100A634122F3553A046EC451061927C=29F8415B46AC00
02007E238D780D25FD5511285E2E596E=29F905AC789000
03001E62DC533E7AF6161729A953891B=29F932FE26E400
0400EB5EC13599373A3D544A2D6AF94F=29FA2158703000
etc ... - Kernel Mode driver. %System%\[driver name][random 4 letters / numbers]-[random 4 letters / numbers].sys
- Code is injected into the legitimate services.exe process in order to bypass firewalls.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Network activity.
disnisa.exe variant.
Request for internet access by the executable itself.
Rootkit variant.
Request for internet access by services.exe.
Once allowed or bypassed ... hell breaks loose. Welcome to the Storm botnet.
The bugger exhausted my DSL connection immediately, the disnisa variant simply blew out my internet connection due to the high amount of incoming and outgoing requests.
Now, consider yes or no if you really need that outbound UDP traffic above 1024. I personally deny all and make exceptions for legitimate cases based on a per application basis. If you can achieve & manage such a lockdown, you won't be communicating with the rest of your New (Year) friends even if infected.
Happy holidays to all and watch out when you open your greeting cards. Please don't end up stripped down to the bone.
