Malware Analysis

cyberc0re

1. Malware.Unknown.exe

File hash & VT Analysis

• (VT - Virustotal)

command:
sha256sum.exe Malware.Unknown.exe.malz

92730427321a1c4ccfc0d0580834daef98121efa9bb8963da332bfd6cf1fda8a <Malware.Unknown.exe.malz>

command:
md5sum.exe Malware.Unknown.exe.malz

1d8562c0adcaee734d63f7baaca02f7c
<Malware.Unknown.exe.malz>

---

Basics Static Analysis

• String and Floss Output

#Floss Malware.Unknown.exe.malz

FLOSS static Unicode strings
jjjj
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "%s"
http://ssl-6582datamanager.helpdeskbros.local/favicon.ico
C:\Users\Public\Documents\CR433101.dat.exe
Mozilla/5.0
http://huskyhacks.dev
ping 1.1.1.1 -n 1 -w 3000 > Nul & C:\Users\Public\Documents\CR433101.dat.exe
open

Note: Most of the important Strings were found at the end.

---

IAT & PEView

Windows API calls:

• DowloadFromURL
• InternetOpenURLA
• ShellExec

---

Basic Dynamic Analysis

• Host and Network Indicators

Host	Network
1. Delete Files.	1. Calls out to a Domain.
2. Install Persistence.	2. Downloads a file.

---

Network Signature

• Wireshark has been used to find the Network Signatures

Host Indicator

• If inetsim was not running, the Malware is designed to self delete once it is detonated as it wouldn't be able to fetch request from the DNS. So, once I terminated inetsim in my Remnux terminal the Malware deleted itself, when I tried to detonate again.

cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Cyberc0re\Desktop\Malware.Unknown.exe"

• Program execution flow
  If URL exists
  -> Download favicon.ico
  -> Run favicon.ico
  If URL doesn't exists
  -> Delete from disk
  -> Do not run

Name: Dropper.DownloadFromURL.exe

---

2. RAT.Unknown.exe.malz (Dynamic Analysis)

• String/Floss Output:

@SSL support is not available. Cannot connect over SSL. Compile with -d:ssl to enable.
@https
@No uri scheme supplied.
InternetOpenW
InternetOpenUrlW
@wininet
@wininet
MultiByteToWideChar
@kernel32
@kernel32
MessageBoxW
@user32
@user32
@[+] what command can I run for you
@[+] online
@NO SOUP FOR YOU
@\mscordll.exe
@Nim httpclient/1.0.6
@/msdcorelib.exe
@AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
@intrt explr
@http://serv1.ec2-102-95-13-2-ubuntu.local

Initial Detonation

---

Wireshark observation after detonation.

Dechaining/ Decoupling: The data can be transmitted first and can be written into the disk with some other name.

• #Potential File Download -> msdcorelib.exe

Host Base Indicators

• Persistence Binary File:
  

• TCP Socket in Listening State:
  

• Command Injecting Capabilities:
  

Note: This is a "Bind shell script", a Trojan that can be remotely connected.

#Re-evaluated Name: "RAT.commandshell.exe"