|
Archive for the ‘Commodity Kit’ Category
Tuesday, December 9th, 2008
A somewhat behind the scenes Crimeware-as-a-service scheme opened up shop a few weeks ago in time for the holidays, but to a lack of “customers”.
Currently, the service is set up to host 30 customer sites, and since November, the group has taken on a measly seven. For this market, that is not much momentum. At 50 bucks a month for hosting, the group is taking on a petty 350 U.S. dollars for the service. The global recession seems to be hitting every market.
Posted in Commodity Kit, Malware Estimates, Vulnerability, ZBot | 1 Comment »
Tuesday, January 8th, 2008
Yesterday, we were further analyzing an executable that we recently haven’t been seeing all that much of, tmpms45.exe. The filename is familiar, as sometimes various executables with that name are delivered by malicious emails or malicious web pages. Most often, we see it as a part of a commodity exploit kit (i.e. Mpack), and the malicious web site operators simply forgot to change the filename in the kit’s scripts that they just purchased.
This time, however, a file delivered with that filename is receiving a lot of attention as the newest piece of malware writing directly to raw disk and the master boot record on WindowsXP systems. It may also go by several other names, like mat16.exe, mat17.exe, mat18.exe and so on. The code for the malicious dropper itself is getting attention partly because it is the first in the wild malware found to contain a slightly modifed version of the “BootRoot” code presented at Blackhat 2005 by eEye researchers.
This malicious dropper executable is being distributed from web sites via a set of exploits targeting a vulnerability patched in 2003, the common Microsoft MDAC (MS06-014) vulnerabilities that we see targeted on a daily basis, along with the somewhat more recent VML and XML CoreServices BoF.
Posted in Blackhat, Commodity Kit, Dropper, Exploit, Rootkit, Vulnerability | No Comments »
Tuesday, December 11th, 2007
Dave Aitel, founder of ImmunitySec, sometimes comments on Halvar Flake’s and Sabre security (oops, I mean zynamics) projects. They speak at a lot of the same conferences.
He just happened to be flying back from jfk when a few deep thoughts came to mind about evading the holy grail of automatic malware classification that he posted on DailyDave:
“Given that avoiding “behavioral signatures” is a matter of calling random NOP-like API calls (i.e. CreateFile + CloseHandle == 1 NOP), Halvar’s program classification techniques involve a structural differencing engine. This has advantages (see his talk for details) in that program structure closely reflects the semantic meaning of a program, as interpreted by a compiler.
So the obvious way, from what I can tell, to defeat a structural differencing algorithm would be to do a static or dynamic analysis of your target program, and for each CALL opcode, change the destination to a dispatcher function. This dispatcher function can then be built to do a O(1) table lookup to find the true destination of the call.”
I like the way Dave thinks. Unfortunately, other folks do too, and all sorts of evasive techniques are commercially available. That means the techniques are available to the bot herders, and it appears in our labs that the herders are distributing most of their bots packed with this stuff now.
Posted in Bot, Commodity Kit, Evasion technique, Penetration testing | No Comments »
|
|
|
|
