Log in

View Full Version : Unknown packed file prob Zbot variant

d0ne
July 12th, 2010, 06:56
Hi,

I had the fun getting access to an somewhat unknown packed exe.
The AV's recognize it as Zbot, but none of the identifications match on the target system.

I tried to unpack it to get to the core, but failed more or less miserable :/

There's first the simple UPX decryption:

Code:


004477C0 > $  60            pushad

004477C1   .  BE 00904200   mov esi,ehaca.00429000

004477C6   .  8DBE 0080FDFF lea edi,dword ptr ds:[esi+FFFD8000]


just set a breakpoint at:

Code:


0044793D   .  61            popad

0044793E   .  8D4424 80     lea eax,dword ptr ss:[esp-80]

00447942   >  6A 00         push 0

00447944   .  39C4          cmp esp,eax

00447946   .^ 75 FA         jnz short ehaca.00447942

00447948   .  83EC 80       sub esp,-80

0044794B   .- E9 BF98FBFF   jmp ehaca.0040120F

\


after 0044794B you're at OEP.

a bit later after another VirtualAlloc and Loadlibrary call

you'll end up in a crypto routine

Code:


77A86567    FFD6            call esi

77A86569    68 FC65A877     push CRYPT32.77A865FC                    ; ASCII "CryptSignHashW"

77A8656E    FF35 3063B077   push dword ptr ds:[77B06330]

77A86574    A3 3463B077     mov dword ptr ds:[77B06334],eax

77A86579    FFD6            call esi

77A8657B    68 E465A877     push CRYPT32.77A865E4                    ; ASCII "CryptVerifySignatureW"

77A86580    FF35 3063B077   push dword ptr ds:[77B06330]

77A86586    A3 3863B077     mov dword ptr ds:[77B06338],eax

77A8658B    FFD6            call esi

77A8658D    68 D065A877     push CRYPT32.77A865D0                    ; ASCII "CryptSetProviderW"

77A86592    FF35 3063B077   push dword ptr ds:[77B06330]

77A86598    A3 3C63B077     mov dword ptr ds:[77B0633C],eax

77A8659D    FFD6            call esi

77A8659F    68 BC65A877     push CRYPT32.77A865BC                    ; ASCII "CryptEnumProvidersW"

77A865A4    FF35 3063B077   push dword ptr ds:[77B06330]


In this function it will load additional DLL's like MSASN1 etc,

There the weirdness starts (at least for me). there's something loop happening with virtualloc and LoadLibrary calls, but that's where I failed as the process seems to terminate itself all the time and I didn't figured out yet what is making it to terminate.

If someone has the time to take a look and possibly extract the last stage binary, that would be awesome, I'm trying since days to get this done

UPDATE:
I forgot to add the joebox output as well.
2313
MALWARE/BIOHAZARD

Remark:
I have the feeling this exe is broken or possibly cleaned by an AV, maybe that explains why it doesn't really do much, not sure yet 100% tough.


Best regards
d0ne

pw:infected
2312
MALWARE/BIOHAZARD
Silkut
July 12th, 2010, 10:40
I edited your post to comply with the malware forum rules.
Looks interesting though
d0ne
July 12th, 2010, 10:59
@ Silkut : Thank you very much and I'm sorry to have missed that. After so much asm and ollydbg my manners seem to lack consistency
d0ne
July 13th, 2010, 08:41
a small update here.

if you run it as:
Code:


malware.exe -i


it generates a messagebox with following information in it:

Code:


V: 02000502

C: 004021B0

PS: 000001E6


looks to me like addresses and offsets but can't see the relations yet.
d0ne
July 14th, 2010, 07:42
some updates for now.
I found that it supports multiple command line switches.
but don't know what they're for yet.

Code:


[ Command line Options ]

UPX0:00407195 call    dsff_4011D0                   ; getcommandline

UPX0:0040719B push    eax

UPX0:0040719C call    dsff_401268

UPX0:004071A2 test    eax, eax

UPX0:004071A4 jz      short loc_4071F3

UPX0:004071A6 xor     edx, edx

UPX0:004071A8 cmp     [ebp-4], edx

UPX0:004071AB jle     short loc_4071E1

UPX0:004071AD

UPX0:004071AD loc_4071AD:                             ; CODE XREF: UPX0:004071DFj

UPX0:004071AD mov     ecx, [eax+edx*4]

UPX0:004071B0 test    ecx, ecx

UPX0:004071B2 jz      short loc_4071DB

UPX0:004071B4 cmp     word ptr [ecx], '-'

UPX0:004071B8 jnz     short loc_4071DB

UPX0:004071BA movzx   ecx, word ptr [ecx+2]

UPX0:004071BE cmp     ecx, 'f'

UPX0:004071C1 jz      short loc_4071D7

UPX0:004071C3 cmp     ecx, 'i'

UPX0:004071C6 jz      short loc_4071D3

UPX0:004071C8 cmp     ecx, 'n'

UPX0:004071CB jnz     short loc_4071DB

UPX0:004071CD mov     byte ptr [ebp-8], 0

UPX0:004071D1 jmp     short loc_4071DB
d0ne
July 15th, 2010, 11:47
ok we can close this thread. it's a corrupted zeus bot version 3 update.

If someone already reversed a zeus bot version 3 please can you pm me.