Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Modified Malware for the IE Expoit - SANS Internet Storm Center SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Modified Malware for the IE Expoit
Its always interesting around the ISC and you'll never know what you'll be handed on any given day.  Its even more interesting when there is an unpatched IE vulnerability and an exploit available for it.  That is where we find ourselves now.  There are several sites that have been compromised and now contain the exploit code.  These sites all run the exploit code and get a file called ca.exe which in turn gets a file called calc.exe and installs it.  It is calc.exe that we want to focus on briefly.

This malware installs a dll that is used as a Browser Helper Object (BHO) and also runscopies itself to directory you see below as nm32.exe and runs as a process.  The malware creates the following on install:


It also creates one called sub.txt when you surf the internet and records everything that it can about where you surf and do and any information it can get from the  Let's look at what is in the files.  The information I'm about to show is from my VM box, so it won't get you anywhere:>)

File: ipcfg636

Windows 2000 IP Configuration
    Host Name . . . . . . . . . . . . : vmwindows2k
    Primary DNS Suffix  . . . . . . . :
    Node Type . . . . . . . . . . . . : Broadcast
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:
    Connection-specific DNS Suffix  . :
    Description . . . . . . . . . . . : AMD PCNET Family PCI Ethernet Adapter
    Physical Address. . . . . . . . . : 00-0C-29-16-36-AB
    DHCP Enabled. . . . . . . . . . . : No
    IP Address. . . . . . . . . . . . :
    Subnet Mask . . . . . . . . . . . :
    Default Gateway . . . . . . . . . :
    DNS Servers . . . . . . . . . . . :

File:  start636

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP                LISTENING
  TCP                LISTENING
  TCP               LISTENING
  TCP               LISTENING
  UDP            *:*                   
  UDP            *:*                   
  UDP           *:*                   
  UDP    *:*                   
  UDP    *:*                   
  UDP    *:*                   

File:  tmp636

    Protected Storage settings / PWL:
        IdentitiesPass    ::::?:ϻb[
    HASH values:
Administrator:500:AF6E956C6F6836C4F3F9505A2D0958A7:0B14980C258F0D7178186CE65030A4A6:Built-in account for administering the computer/domain::
Guest:501:********************************:********************************:Built-in account for guest access to the computer/domain::
Total 0 entries
    Network settings:

File:  view636

Server Name            Remark

The command completed successfully.

File:  Sub.txt


The malware FTP's all the information out to a location.  It also has email capability.  The location given by McAfee in their writeup found here was as follows:  "The trojan attempts to upload harvested information to an FTP server ("  However, when I downloaded the malware and looked at it that was not the location I found in the strings.  I found:

0040F530   ASCII "",0
0040F630   ASCII "21",0

So its seems that the malware has been swapped for a new version with the FTP server portion being changed.  I have not observed it attempting to FTP yet, still waiting with a sniffer running.  The strings also contained the username and password for the new site.  The file on the new IP  is now encrypted and the file wasn't before on the first FTP site.  So the individual seems to realize that folks are on to them.  I'm pretty sure that the malware has just been changed since its easier to modify the malware and where it FTPs to than to go back to all the hacked sites.

Anyway, please keep your eyes and ears open for any new sites exploiting this vulnerability!  As always, be careful its a jungle out there!

Lorna J. Hutcheson


165 Posts
ISC Handler
Mar 26th 2006

Sign Up for Free or Log In to start participating in the conversation!