Hi,

This is a paper splitted into two episodes, the first two can be readed here

First
http://evilcodecave.blogspot.com/2009/11/dnascan-malware-analysis-from-browser.html
Second
http://evilcodecave.blogspot.com/2009/11/dnascan-malware-analysis-from-browser_15.html

Here the Third Part.

In this blog post we will investigate deeply the effective functionalities of DNAScan,
that can be seen as a set of Threads that accomplish different networking functionalities like:

* Server Functionalities
* Client Functionalities
* Malicious File Exchange
* Generic Backdoor

Let's start from the beginning of network functionalities setup, initially from the main thread is called WSAStartup used to initiate the Winsock DLL, successively is called a classical socket() and immediately after WSAIoctl




The WSAIoctl function controls the mode of a socket, works like DeviceIoControl so we have a suite of IO Control Codes, in our case the Control Code is 4004747F that corresponds to SIO_GET_INTERFACE_LIST

Returns a list of configured IP interfaces and their parameters as an array of INTERFACE_INFO structures. After setting socket options and binding we have another WSAIoctl this time with code 98000001 in this way the socket normal working parameters are modified, indeed 98000001 corresponds to SIO_RVALL that enables a socket to receive all IP packets on the network, to use this application need to be in RAW mode using IP protocol and bound to a specific local adapter. Finished this the first thread is created:



after opening this thread the first socket is closed. Now the next important function called is SHGetFolderPath witch sets as folders \user\cookies, finally execution jumps to a secondary thread that contains a recvfrom



by watching the buffer out (second parameter) we can see what arrives to DNAScan



this recvfrom is repeated until certain conditions that depends from watch application receives,
under certain conditions sento from server reacts. After setting this is builded another thread that makes use of a classical server architecture

* Socket
* Listen
* Accept

Next networking operation is the Pipe building


This creates a named pipe \\.\pipe\ie_down_pipe and successively Enables a named pipe server process to wait for a client process to connect to an instance of a named pipe.

At this point is assembled the following string


as you can see there are a couple of interesting strings like

* ftp_pass=%s
* imap_pass=%s
* sniffer_pop3_%s
* sniffer_icq_%s

this api enumerates the Internet cache, to see what comes out just watch the second parameter


this piece of code scans Url Cache to find the previously seen IP address and if discovered, removes it with DeleteUrlCacheEntry.


Creates a blocking type stream object from a URL and downloads the data from the Internet. When the data is downloaded the client application or control can read it by using the IStream::Read method.

By analysing the URL we can extract the following informations:


When you step URLOpenBlockingStreamA be aware that this function presents thread and fiber functionalities to speed up and make an easier analysis approach just detach for one step the New Thread Break Event. If incidentally you have this Event enabled, surf between threads with Execute till Return and Run Actual Thread.

_Next Thread_

Here the malicious application scans into C:\Documents and Settings\evilcry\Cookies\ cookie by cookie


Successively by using ad usual CreateToolhelp32Snapshot and Process32First/Process32Next and WriteProcessMemory DNAScan injects some pieces of code in various system processes. This is essentially not useful for our analysis scopes actually.



Inside the call


The CreateStreamOnHGlobalfunction creates a stream object that uses an HGLOBAL memory handle to store the stream contents. This object is the OLE-provided implementation of the IStream interface.



Protected Storage (Pstore) is available for use in Windows Server 2003, Windows XP, and Windows 2000. It is only available for read-only operations in Windows Server 2008 and Windows Vista. Pstore uses an older implementation of data protection.

outside the call



The GetHGlobalFromStream function retrieves the global memory handle to a stream that was created through a call to the CreateStreamOnHGlobal function. The second parameter is an out global memory handle





Now if we focus inside the address pointed by EAX we can see a truly interesting thing


as you can see the malicious application extracs URLs + User and Passwords. Now the malicious application surely will try to send the stolen credentials to a malicious server.



Inside -> CALL 00406567



Initializes an application's use of the WinINet functions, the return value must be != NULL


Opens an File Transfer Protocol (FTP) or HTTP session for a given site.


Send a POST request to /cgi-bin/pstore.cgi



Adds one or more HTTP request headers to the HTTP request handle, the second parameter is a Pointer
to a string variable containing the headers to append to the request, so let's check it.



Finally with wspintfA is builded the following string



where we can see the kind of request name="upload_file" and the filename 37
0012FD74 3125111.17

finally is called



Sends the specified request to the HTTP server, the second parameter of this function is the header itself.

At this point HTTP transactions are finished all handle closed and begins a new thread, that deals with
CryptoApi.



The CertOpenSystemStore function is a simplified function that opens the most common system certificate store, MY means that a certificate store that holds certificates with associated private keys.


The PFXExportCertStoreEx function exports the certificates and, if available, their associated private keys from
the referenced certificate store.

In this way DNAScan obtains sensitive informations, like the Private Keys.

The second parameter is a pointer to CRYPT_DATA_BLOB structure, that contains the PFX packet with the exported certificates and key. The Third parameter is string password used to encrypt and verify the PFX packet.



The PFXExportCertStoreEx function exports the certificates and, if available, their associated private
keys from the referenced certificate store.

Now certificates are correctly stolen, and need to be sent to the malicious server. Indeed after some line of code we can see the following



Stolen certificates are sent to /cgi-bin/cert.cgi as previously seen for User/Password Credentials.

Essentially application upload each sensitive information to a precise location, here a quick list

* /cgi-bin/options.cgi
* /cgi-bin/forms.cgi
* /cgi-bin/cert.cgi
* /cgi-bin/pstore.cgi
* /cgi-bin/ss.cgi
* /cgi-bin/keylog.cgi
* /cgi-bin/file.cgi
* /cgi-bin/mail.cgi
* /cgi-bin/cmd.cgi
* /cgi-bin/forms.cgi

from the name of these cgi we can suddenly understand what is stolen

* Files
* Mails
* Passwords
* Certificates
* Misc.

If we attemp a direct browser access to the malicious server, we will obtain a classical 404 Error, but
let's try to send direct queries like

as you can see options.cgi is reatched and correctly downloaded we can prosecute with a more deep inspection by using Nmap.

The scanning options used are tipical of an Intense Scan

But we can obtain more informations with a Slow Intense Scan like

nmap -PE -PA21,23,80,3389 -A -v -T4 91.213.94.130

here what emerges
Open Ports:

* 22
* 25 (filtered)
* 80 (lighttpd 1.4.19)
* 111 (rpcbind)
* 5222 (Jabber instant messaging server)
* 5269 (Jabber instant messaging server)
* 389 (ms-term-serv)

Operating System: OpenWrt 7.09 (Linux 2.6.22)

Regards,
Giuseppe 'Evilcry' Bonfa