VirTool:Win32/VBInject.gen!FA

VirTool:Win32/VBInject.gen!FA is a generic detection for malicious files that are obfuscated using particular techniques to protect them from detection or analysis.

Threat behavior

VirTool:Win32/VBInject.gen!FA is a generic detection for malicious files that are obfuscated using particular techniques to protect them from detection or analysis.

 

A malicious file is generally encrypted/and or compressed and stored inside another program, which decodes the malicious file and loads it. The malicious program may be injected into a clean process or loaded in a new process of its own. Unlike a “dropper”, the malicious executable is never written to disk as a separate file.

 

Malicious programs detected as VirTool:Win32/VBInject.gen!FA can have virtually any purpose, as this technique is utilized by many different malware families in the wild in order to protect them from detection or analysis.

---

Symptoms

VirTool:Win32/VBInject.gen!FA is a generic detection for certain forms of obfuscated malware. The loader is written in Visual Basic and the malicious code is stored encrypted. The original file behaves as a loader for the encrypted malicious code, thus the code could have virtually any purpose.

 

There are no common symptoms associated with this threat. Alert notifications from installed antivirus software may be the only symptom(s).

Sample:

MD5 182d0c0af03bcc4eb67c38d69c0db12e

SHA-1 aaf94609f4ba30853a84094d97df0c2f45290c64

SHA-256 6373d56448f7fd57ae432dbb01b3f89c8c57330251139e68a755a0648e60af18

ssdeep 1536:sQuA9sdF0XR0Yaflj4LQ2Vp73Lxxkq8Bn:NuAydF6R5a9j4LQAL1Sb

Size 63.9 KB (65444 bytes)

Type Win32 EXE

Magic PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID Win32 Executable (generic) (52.9%) Generic Win/DOS Executable (23.5%) DOS Executable Generic (23.4%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

 PE header basic information:

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2009-11-23 16:40:50

Link date 5:40 PM 11/23/2009

Entry Point 0x000019AC

Number of sections 3

 PE sections:

Name Virtual address Virtual size Raw size Entropy MD5

.aaaa  4096 23864 24576 4.94 b70b35bb9706019ec5ad7aa0fbfd1005

.bbbb  28672 1992 0 0.00 d41d8cd98f00b204e9800998ecf8427e

.cccc  32768 2980 4096 4.14 fc2be698dfc2e1aaed9c330b183bea18

 Number of PE resources by type:

RT_ICON 1

RT_VERSION 1

RT_GROUP_ICON 1

 Number of PE resources by language:

NEUTRAL 2

SPANISH MODERN 1

Dancho Danchev's Blog - Mind Streams of Information Security Knowledge: Facebook Spreading, Amazon AWS/Cloudflare/Google Docs Hosted Campaign, Serves P2P-Worm.Win32.Palevo

A currently circulating across Facebook, multi-layered monetization tactics utilizing, Turkish users targeting, malicious campaign, is attempting to trick users into thinking that they need to install a fake Adobe Flash Player, displayed on a fake YouTube Video page, ultimately serving P2P-Worm.Win32.Palevo on the hosts of the socially engineered (international) users.

Let's dissect the campaign, expose its infrastructure in terms of shortened URLs, redirectors, affiliate network IDs, landing pages, pseudo-random Facebook content generation phone back URLs, legitimate infrastructure hosted content, and provide MD5s for the served malicious content.

Sample redirection chain: hxxp://m3mi.com/10469 ->

Dancho Danchev's Blog - Mind Streams of Information Security Knowledge: Facebook Spreading, Amazon AWS/Cloudflare/Google Docs Hosted Campaign, Serves P2P-Worm.Win32.Palevo

Analysis and cleaning way of Trojan-Dropper-ZB

samples size ‘689908’ and ShortCRC ‘3008032050’.
All these samples are random based on behavior (drops same set of payloads).

File doesn’t seem to use any specific packer but strings are encrypted and it uses overlay
data.


All these files have same MD5 for it sections. So the MD5 differs only based on overlay
data. Usually malware use the overlay data for randomization.



If you strip the ExtraDat overlay data from all these files their MD5 was found to be
same. Based on these I confirm these files are random.


Below you can see the different sections available in all these files. Here .text section
contains the code characteristics so possibly I will hash the entire .text section since it is
common for all these files.








It seems to be plain file. I was able to see all the Code and APIs used by the file. May be
the data are encrypted.






On execution, this file allocates space and writes all the information (payloads it is going
to drop) in the buffer.


Creates a file S7JdZrvW.exe in the %userprofile% folder.




Writes the data from the buffer to the newly created file S7JdZrvW.exe (SillyFDC file)



Sets file time and file attributes to the file S7JdZrvW.exe.



Likewise it drops the following files:
"C:\\Documents and Settings\\---------------\\tell.exe" – TDSS file
"C:\\Documents and Settings\\---------------\\telm.exe" – Trojan-Hiloti file


Then it executes all the dropped files one by one.



0012F984 0041DE00 |CommandLine = "tell.exe"
0012F984 0041DDB0 |CommandLine = "telm.exe"

At last the installer self deletes itself calling cmd /c del



All the above mentioned code is identified in the .text section of the file. Since we
already know this section is common for all the samples I am hashing it entirely.


Scan log:
11/11/2011 12:55:47 PM: Removal process completed. Elapsed time 00:00:18
11/11/2011 12:55:29 PM: Quarantining All Traces: trojan-dropper-zb
11/11/2011 12:55:29 PM: Removal process initiated
11/11/2011 12:52:19 PM: Traces Found: 21

Rootkit.Sirefef.Gen

Rootkit.Sirefef.Gen (Sophos Troj/ZAccess-L, Troj/ZAccess-I, HPmal/ZAccess-A Avira RKIT/ZeroAccess.A)

Symptoms
The presence of unwanted popups on the infected machine; background traffic to and from command-and-control centers handled by attackers.

ZeroAccess/Sirefef is a sophisticated kernel-mode rootkit that gets installed when a ZeroAccess dropper gets executed. Initially, the dropper checks to see whether it is running on a 32- or a 64-bit machine by querrying the ZWQueryInformationProcess api. If it runs on a system that has UAC enabled, the malware manipulates the system to make a legit application look as if it requires escalation. This is achieved by loading a clean copy of the FlashPlayer installer that is dropped to a temporary directory. The Windows Firewall is turned off and the malware will try to disable a series of security sub-systems such as WinDefend (Windows Defender service), wscsvc (Windows Security Center service), WinHttpAutoProxySvc (Proxy Auto Discovery service). If the dropper runs on a 32-bit operating system, ZeroAccess installs a kernel-mode rootkit. If it runs on a 64-bit machine, it executes its code directly from the memory.

what wikipedia says about-

"A rootkit is a stealthy type of software, typically malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer. The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool). The term "rootkit" has negative connotations through its association with malware."

Exploit.CVE-2013-5065.A

Exploit.CVE-2013-5065.A

Symptoms
Adobe Reader crashes when trying to open a PDF document.

Vulnerability in Microsoft Windows Kernel Could Allow Elevation of Privilege
Published: Wednesday, November 27, 2013

Version: 1.0

General Information
Executive Summary
Microsoft is investigating new reports of a vulnerability in a kernel component of Windows XP and Windows Server 2003. We are aware of limited, targeted attacks that attempt to exploit this vulnerability.

Our investigation of this vulnerability has verified that it does not affect customers who are using operating systems newer than Windows XP and Windows Server 2003.

The vulnerability is an elevation of privilege vulnerability. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.

Microsoft is actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers. For information about protections released by MAPP partners, see MAPP Partners with Updated Protections.

Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Mitigating Factors:

An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability. The vulnerability could not be exploited remotely or by anonymous users
Recommendation. Please see the Suggested Actions section of this advisory for more information.

https://technet.microsoft.com/en-us/security/advisory/2914486

Duqu malware- VT result

SHA256: 84116fffa72a50d4c5f63f284c589dfd7afa0a2954fb6408a440dd673b88aa91
File name: VirusShare_0a566b1616c8afeef214372b1a0580c7

AVG Generic5_c.EVH 20140101
Ad-Aware Trojan.Duqu.D 20140101
Agnitum Trojan.Duqu.Gen!dat 20140101
AhnLab-V3 Win-Trojan/Duqu 20140101
AntiVir TR/Duqu.B.1 20140101
Avast Other:Malware-gen [Trj] 20140101
BitDefender Trojan.Duqu.D 20140101
Bkav MW.Clod951.Trojan.591b 20140101
CAT-QuickHeal Trojan.Duqu.A 20140101
ClamAV Trojan.Duqu-2 20140101
Commtouch Duqu 20140101
Comodo TrojWare.Win32.Duqu.A 20140101
Emsisoft Trojan.Duqu.D (B) 20140101
F-Prot Duqu 20140101
Fortinet W32/Duqu.A!tr 20140101
GData Trojan.Duqu.D 20140101
Ikarus Trojan.Rel.Duqu 20140101
K7AntiVirus Trojan ( 002fa1251 ) 20131231
K7GW Trojan ( 002fa1251 ) 20131231
Kaspersky Trojan.Win32.Duqu.pnf 20140101
McAfee PWS-Duqu!dat 20140101
McAfee-GW-Edition PWS-Duqu!dat 20140101
MicroWorld-eScan Trojan.Duqu.D 20140101
Panda Generic Malware 20140101
Sophos Troj/DuquCn-B 20140101
TotalDefense Win32/Duqu.N 20131231
TrendMicro TROJ_DUQU.ENC 20140101
TrendMicro-HouseCall TROJ_DUQU.ENC 20140101
VIPRE Trojan.Win32.Duqu.a (v) 20140101
ViRobot Trojan.Win32.S.Duqu.192512 20140101

This is an old report.

FREE ONLINE SECURITY SCAN TOOLS

FREE ONLINE SECURITY SCAN TOOLS F.Suspicious Files

* VIRUSTOTAL: http://www.virustotal.com/  - yeah! Total Recall ...

* Jotti's Malware Scan: http://virusscan.jotti.org/en  - I like ladybugs ...

* VirScan: http://www.virscan.org/  - submit and scan your file ...

* VirusChief: http://www.viruschief.com/  - offers a free service for online virus scan ...

* WEPAWET: http://wepawet.iseclab.org/  - Analysis Subject: File ...  

* Anubis: http://anubis.iseclab.org/  - very long ...  

* Kaspersky File Scanner: http://www.kaspersky.com/scanforvirus  - submit, if you discover a suspicious file on your infernal machine ...

* GetSystemInfo GSI PARSER: http://www.getsysteminfo.com/index.php?hl=en  - What's your problem? ... optional ...

* NoVirusThanks: http://scanner.novirusthanks.org/  - Multi-Engine Antivirus Scanner ... If you have a suspicious fileShocked...

* ThreatExpert: http://www.threatexpert.com/filescan.aspx  - Free Online File Scanner - if you have a suspicious file ...Embarrassed

* FILTERBIT: http://www.filterbit.com/  - OPSWAT Metascan Demo - By Uploading a file you hereby agree to ...

* COMODO Instant Malware Analysis: http://camas.comodo.com/cgi-bin/submit  - Automated Analysis System!..Clap

* Dr.Web online scanners: http://vms.drweb.com/online/?lng=en  - scan file ...

* JoeBox submit: http://www.joebox.org/submit.php  - a secure Sandbox Application for Windows to analyse the Behaviour of Malware!

* avast! Online Scanner: http://onlinescan.avast.com/  - Each time you may check only one file ...

* clamav COSS: http://www.gietl.com/test-clamav/  - ClamAV Online Specimen Scanner, test-clamav, from gietl.com ...

* FortiGuard - Online Virus Scanner & Submission: http://www.fortiguard.com/antivirus/virus_scanner.html  - File Name ..

* EUREKA!: http://eureka.cyber-ta.org/  - Eureka Malware Analysis Page ... upload packed executable ...

Aaaa ... the best computer tests here ... that's all!Sleepy

"""""""""""""""""""""""""""""""""""""""""""""""""""

* Web Test Tools: http://www.softwareqatest.com/qatweb1.html  - This is THE link.

Ref: http://forum.sysinternals.com/free-Online-security-scan-tools-fsuspicious-files_topic22046.html

Privacy Implications of the Internet of Things

Introduction

The term “Internet of Things” refers to the use of the Internet for monitoring, tracking, controlling, and interconnecting everyday objects. For example, home appliances can be connected to the Internet to facilitate household activities. In this context, it is worth mentioning that refrigerators that allow the users to access the Internet are already commercially available.

According to ABI Research, a technology market intelligence company, there are more than 10 billion wirelessly connected devices in the market today. The company expects that the number of these devices will reach 30 billion by 2020; 60% of these 30 billion devices will be node or sensor type devices. The other 40% will include hub devices, such as smartphones, tablets, and laptops. A recent report by Intelligence Unit of the Economist, based on a survey of 779 senior business leaders from 19 different industries around the world, stated that 75% of businesses are already exploring the field of the Internet of Things.

click here to see the rest of the story: