Security-X
Forum Security-X => News => Discussion démarrée par: SX-News le novembre 14, 2012, 19:09:21
-
Backdoor.Nucleroot/Win32.Umbald.A (Umbra Loader)
Description : Almost FUD, detected by NOD32 and Kaspersky. (2/44)
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-q5ixBmXHjnI/UJ-v3lzGXkI/AAAAAAAAMGQ/nAVHidyOJYY/s1600/11-11-2012+15-01-38.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="112" src="http://4.bp.blogspot.com/-q5ixBmXHjnI/UJ-v3lzGXkI/AAAAAAAAMGQ/nAVHidyOJYY/s400/11-11-2012+15-01-38.jpg" width="400" />[/url]</div>
Crypted with a dirty DotNet crap
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-tBSTi85uUIA/UJ-wQwNh-zI/AAAAAAAAMGY/pv25Bt7WDPU/s1600/11-11-2012+15-03-20.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/-tBSTi85uUIA/UJ-wQwNh-zI/AAAAAAAAMGY/pv25Bt7WDPU/s1600/11-11-2012+15-03-20.jpg" />[/url]</div><div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-13eK5kdAiOU/UJ-wuz7qAOI/AAAAAAAAMGg/tk8Im12F_b0/s1600/11-11-2012+15-05-07.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/-13eK5kdAiOU/UJ-wuz7qAOI/AAAAAAAAMGg/tk8Im12F_b0/s1600/11-11-2012+15-05-07.jpg" />[/url]</div>
Once unpacked it's another story (33/44)
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-GAejhwflWCA/UJ_G0SFtuPI/AAAAAAAAMJw/XNdYIdgSuMI/s1600/11-11-2012+16-39-38.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="111" src="http://4.bp.blogspot.com/-GAejhwflWCA/UJ_G0SFtuPI/AAAAAAAAMJw/XNdYIdgSuMI/s400/11-11-2012+16-39-38.jpg" width="400" />[/url]</div>
Read the ressources DLL0/1/2 and CFG
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-Yg0v8KIkP6o/UJ-t_FwwQUI/AAAAAAAAMGA/RLLjDsAH-_I/s1600/11-11-2012+14-53-32.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="378" src="http://2.bp.blogspot.com/-Yg0v8KIkP6o/UJ-t_FwwQUI/AAAAAAAAMGA/RLLjDsAH-_I/s400/11-11-2012+14-53-32.jpg" width="400" />[/url]</div>
Get the config.
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-qXK38aK0yfM/UJ-vLPQBaWI/AAAAAAAAMGI/KDaMKvM2k8U/s1600/11-11-2012+14-57-45.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="115" src="http://2.bp.blogspot.com/-qXK38aK0yfM/UJ-vLPQBaWI/AAAAAAAAMGI/KDaMKvM2k8U/s400/11-11-2012+14-57-45.jpg" width="400" />[/url]</div>
Do some registry shit, parse the config url get the pc name...
<div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-l9Ob3h5P-2c/UJ-yhVkHUhI/AAAAAAAAMGo/dUlHGeyBXgY/s1600/11-11-2012+15-12-16.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="164" src="http://3.bp.blogspot.com/-l9Ob3h5P-2c/UJ-yhVkHUhI/AAAAAAAAMGo/dUlHGeyBXgY/s400/11-11-2012+15-12-16.jpg" width="400" />[/url]</div>
Call the gate.
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-Bl_WwuWOPVU/UJ-zYp89WpI/AAAAAAAAMGw/u6-rmo6KSBY/s1600/11-11-2012+15-16-57.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="328" src="http://1.bp.blogspot.com/-Bl_WwuWOPVU/UJ-zYp89WpI/AAAAAAAAMGw/u6-rmo6KSBY/s400/11-11-2012+15-16-57.jpg" width="400" />[/url]</div>
Furtivity fail:
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-xOTjXWq4r1o/UJ-zolxHfaI/AAAAAAAAMG4/vEgiqo3tc-Y/s1600/11-11-2012+15-17-54.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="100" src="http://1.bp.blogspot.com/-xOTjXWq4r1o/UJ-zolxHfaI/AAAAAAAAMG4/vEgiqo3tc-Y/s400/11-11-2012+15-17-54.jpg" width="400" />[/url]</div>
<div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-qX3vF_VqkP0/UJ-00FiL_wI/AAAAAAAAMHA/RHbyVbxnpl4/s1600/11-11-2012+15-23-03.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="100" src="http://3.bp.blogspot.com/-qX3vF_VqkP0/UJ-00FiL_wI/AAAAAAAAMHA/RHbyVbxnpl4/s400/11-11-2012+15-23-03.jpg" width="400" />[/url]</div>
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-k1TXKzq-R2s/UJ-6mDDPkVI/AAAAAAAAMIc/J7pAE33qX5Q/s1600/11-11-2012+15-47-15.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="166" src="http://2.bp.blogspot.com/-k1TXKzq-R2s/UJ-6mDDPkVI/AAAAAAAAMIc/J7pAE33qX5Q/s400/11-11-2012+15-47-15.jpg" width="400" />[/url]</div>
Wait order:
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-439EHt7c-s8/UJ-1dSF9TCI/AAAAAAAAMHI/IgUKQwxhDS4/s1600/11-11-2012+15-25-54.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="152" src="http://1.bp.blogspot.com/-439EHt7c-s8/UJ-1dSF9TCI/AAAAAAAAMHI/IgUKQwxhDS4/s400/11-11-2012+15-25-54.jpg" width="400" />[/url]</div>
Call the gate each 2 minute for order
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/--zCmrytqJZU/UJ-32PsclsI/AAAAAAAAMHU/3Vz205aZTEE/s1600/11-11-2012+15-35-36.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="70" src="http://1.bp.blogspot.com/--zCmrytqJZU/UJ-32PsclsI/AAAAAAAAMHU/3Vz205aZTEE/s400/11-11-2012+15-35-36.jpg" width="400" />[/url]</div>
Order:
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-IKXueZhxDJk/UJ-4rhov5wI/AAAAAAAAMIE/8zEjM_2k2qg/s1600/11-11-2012+15-39-32.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="70" src="http://2.bp.blogspot.com/-IKXueZhxDJk/UJ-4rhov5wI/AAAAAAAAMIE/8zEjM_2k2qg/s400/11-11-2012+15-39-32.jpg" width="400" />[/url]</div>
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-AAK400LKClw/UJ-643658xI/AAAAAAAAMIk/piJ6H3li0V0/s1600/11-11-2012+15-48-49.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="178" src="http://4.bp.blogspot.com/-AAK400LKClw/UJ-643658xI/AAAAAAAAMIk/piJ6H3li0V0/s400/11-11-2012+15-48-49.jpg" width="400" />[/url]</div>
Retrieve and execute:
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-mmf6SwwhhNo/UJ-43EGGPVI/AAAAAAAAMIM/w9SCmCANy0U/s1600/11-11-2012+15-40-26.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="73" src="http://1.bp.blogspot.com/-mmf6SwwhhNo/UJ-43EGGPVI/AAAAAAAAMIM/w9SCmCANy0U/s400/11-11-2012+15-40-26.jpg" width="400" />[/url]</div>
Return mode=3 to says order is done
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-x9wPpyusey4/UJ_DF927VZI/AAAAAAAAMJY/vrm0wCV2mfo/s1600/11-11-2012+16-23-18.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="171" src="http://2.bp.blogspot.com/-x9wPpyusey4/UJ_DF927VZI/AAAAAAAAMJY/vrm0wCV2mfo/s400/11-11-2012+16-23-18.jpg" width="400" />[/url]</div>
Task complete.
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-UWmTxmNQY6I/UJ-5yPZS9yI/AAAAAAAAMIU/uNSo3ur7rCQ/s1600/11-11-2012+15-44-13.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="75" src="http://4.bp.blogspot.com/-UWmTxmNQY6I/UJ-5yPZS9yI/AAAAAAAAMIU/uNSo3ur7rCQ/s400/11-11-2012+15-44-13.jpg" width="400" />[/url]</div>
Umbra thread:
<div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-ZI4WDlgbitY/UJhdH4_7l_I/AAAAAAAAL5g/a9aX0AaDI4I/s1600/06-11-2012+01-40-48.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="http://3.bp.blogspot.com/-ZI4WDlgbitY/UJhdH4_7l_I/AAAAAAAAL5g/a9aX0AaDI4I/s640/06-11-2012+01-40-48.jpg" width="368" />[/url]</div>
Login:
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-Mu2q5XtlYCU/UJhZGCoC_CI/AAAAAAAAL4g/yC7aWPPA9do/s1600/06-11-2012+01-25-29.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="250" src="http://4.bp.blogspot.com/-Mu2q5XtlYCU/UJhZGCoC_CI/AAAAAAAAL4g/yC7aWPPA9do/s400/06-11-2012+01-25-29.jpg" width="400" />[/url]</div>
Dashboard:
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-l9pkhd_DRnc/UJhZdaVSjQI/AAAAAAAAL4o/dFEm9DfnuLs/s1600/06-11-2012+01-27-09.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="250" src="http://4.bp.blogspot.com/-l9pkhd_DRnc/UJhZdaVSjQI/AAAAAAAAL4o/dFEm9DfnuLs/s400/06-11-2012+01-27-09.jpg" width="400" />[/url]</div>
Start:
<div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-UOdzhUtIpyo/UJha5UvunII/AAAAAAAAL5Y/9KCfeFP_Q2g/s1600/06-11-2012+01-33-06.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="http://3.bp.blogspot.com/-UOdzhUtIpyo/UJha5UvunII/AAAAAAAAL5Y/9KCfeFP_Q2g/s320/06-11-2012+01-33-06.jpg" width="273" />[/url]</div>
File upload:
<div class="separator" style="clear: both; text-align: center;"><a href="http://3.bp.blogspot.com/-I7aCFjINjEk/UJhZyIE7ajI/AAAAAAAAL4w/uAneWuisis0/s1600/06-11-2012+01-28-31.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="163" src="http://3.bp.blogspot.com/-I7aCFjINjEk/UJhZyIE7ajI/AAAAAAAAL4w/uAneWuisis0/s400/06-11-2012+01-28-31.jpg" width="400" />[/url]</div>
Install:
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-6uVmwsu7DUw/UJhZ8eZtyXI/AAAAAAAAL44/i77NmY9Fglk/s1600/06-11-2012+01-29-21.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="286" src="http://2.bp.blogspot.com/-6uVmwsu7DUw/UJhZ8eZtyXI/AAAAAAAAL44/i77NmY9Fglk/s400/06-11-2012+01-29-21.jpg" width="400" />[/url]</div>
Bots:
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-RbXnVglXjHM/UJhaKmzs3eI/AAAAAAAAL5A/8XMaATUXlxk/s1600/06-11-2012+01-30-15.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="286" src="http://2.bp.blogspot.com/-RbXnVglXjHM/UJhaKmzs3eI/AAAAAAAAL5A/8XMaATUXlxk/s400/06-11-2012+01-30-15.jpg" width="400" />[/url]</div>
Commands:
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-YIvDN3kayCQ/UJhaaaRbrXI/AAAAAAAAL5I/pRKSWQ0eA0w/s1600/06-11-2012+01-31-17.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="275" src="http://4.bp.blogspot.com/-YIvDN3kayCQ/UJhaaaRbrXI/AAAAAAAAL5I/pRKSWQ0eA0w/s400/06-11-2012+01-31-17.jpg" width="400" />[/url]</div>
Country statistics:
<div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-y6ZkkAC5k7Q/UJhapEte68I/AAAAAAAAL5Q/CGn5ByZJ8pc/s1600/06-11-2012+01-32-15.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/-y6ZkkAC5k7Q/UJhapEte68I/AAAAAAAAL5Q/CGn5ByZJ8pc/s1600/06-11-2012+01-32-15.jpg" />[/url]</div>
Cpanel:
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-GyD4UUdAbys/UJ_EVuJLZ2I/AAAAAAAAMJg/PduTADNIzWU/s1600/11-11-2012+16-28-56.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="http://2.bp.blogspot.com/-GyD4UUdAbys/UJ_EVuJLZ2I/AAAAAAAAMJg/PduTADNIzWU/s640/11-11-2012+16-28-56.jpg" width="418" />[/url]</div>
Botnet hosted on reliahost.net, they are know for hosting malwares, warez and porn.
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-XanoHf6ZQp0/UJ_FKw5I4dI/AAAAAAAAMJo/ZIEa6caOSVo/s1600/11-11-2012+16-32-22.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="246" src="http://1.bp.blogspot.com/-XanoHf6ZQp0/UJ_FKw5I4dI/AAAAAAAAMJo/ZIEa6caOSVo/s400/11-11-2012+16-32-22.jpg" width="400" />[/url]</div>
ReliaHost website:
<div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-DxUp1g4v4w8/UJ_IRIiZIdI/AAAAAAAAMJ4/lwxV-LWrGtE/s1600/11-11-2012+16-45-57.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="http://2.bp.blogspot.com/-DxUp1g4v4w8/UJ_IRIiZIdI/AAAAAAAAMJ4/lwxV-LWrGtE/s400/11-11-2012+16-45-57.jpg" width="316" />[/url]</div>
Unbra Loader builder:
<div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-e7e6YaNhGdg/UJhe4v1wnGI/AAAAAAAAL5w/dKNyvGImFlI/s1600/06-11-2012+01-50-32.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/-e7e6YaNhGdg/UJhe4v1wnGI/AAAAAAAAL5w/dKNyvGImFlI/s1600/06-11-2012+01-50-32.jpg" />[/url]</div><div class="separator" style="clear: both; text-align: center;"><a href="http://2.bp.blogspot.com/-KAqjs3RFXAw/UJhfAiGimHI/AAAAAAAAL54/V0FZnRTGVSA/s1600/06-11-2012+01-51-06.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://2.bp.blogspot.com/-KAqjs3RFXAw/UJhfAiGimHI/AAAAAAAAL54/V0FZnRTGVSA/s1600/06-11-2012+01-51-06.jpg" />[/url]</div><div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-TeEydIE-5oU/UJhfHoPL6wI/AAAAAAAAL6A/VFZVzVEVg6U/s1600/06-11-2012+01-51-33.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/-TeEydIE-5oU/UJhfHoPL6wI/AAAAAAAAL6A/VFZVzVEVg6U/s1600/06-11-2012+01-51-33.jpg" />[/url]</div><div class="separator" style="clear: both; text-align: center;"><a href="http://4.bp.blogspot.com/-JKRutBRhM5M/UJhfNBt8qlI/AAAAAAAAL6I/WKhwTRcd4t4/s1600/06-11-2012+01-51-56.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/-JKRutBRhM5M/UJhfNBt8qlI/AAAAAAAAL6I/WKhwTRcd4t4/s1600/06-11-2012+01-51-56.jpg" />[/url]</div><div class="separator" style="clear: both; text-align: center;"><a href="http://1.bp.blogspot.com/-owjGEGzKWIE/UJhfTg0IREI/AAAAAAAAL6Q/Zdn2sO1RX98/s1600/06-11-2012+01-52-23.jpg" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="http://1.bp.blogspot.com/-owjGEGzKWIE/UJhfTg0IREI/AAAAAAAAL6Q/Zdn2sO1RX98/s1600/06-11-2012+01-52-23.jpg" />[/url]</div>Builder MD5: 91eda4acfb9da021d4f7b91e780b12be<div class="blogger-post-footer"><img alt="" height="1" src="https://blogger.googleusercontent.com/tracker/5365964245877416061-8406605894922735408?l=www.xylibox.com" width="1" /></div>
Lien : http://www.xylibox.com/2012/11/backdoornuclerootwin32umbalda-umbra.html