Malware Named Pipe How To Control Cookies

Mila over contagiodump and Trusteer reported a new type of malware called Shylock.

They were mum on the details aside from some threat report which was very sparse on information.

So well look into it together to combine traditional Reverse Engineering for the goal of finding artifacts to verify infection in Volatility.

One is a copy of itself in a random path as well as a.bat file that is ran from cmd.exe with the c to change attributes on the dropped files then erase them after malicious code is injected into explorer.exe.

The dropper spawns this command shell to process the.bat file.

The bat file is pasted below.:repeat if not exist C:reshylock4FDA5E7E8E682870E993F97AD26BA6B2 goto exit attrib -R -S -H C:reshylock4FDA5E7E8E682870E993F97AD26BA6B2 erase C:reshylock4FDA5E7E8E682870E993F97AD26BA6B2 goto repeat:exit attrib -R -S -H C:Documents and Settingsvmuser1Application DataAdobeFlash PlayerD.tmp.bat erase C:Documents and Settingsvmuser1Application DataAdobeFlash PlayerD.tmp.bat.

After that it terminates itself and removes the dropper off the disk leaving all control up to the recently injected code into explorer.exe.

After this the injected code replicates itself into other processes by injecting them and hooking APIs.

Im going to be showing code snippets that are from the injected code using the technique I posted on previously about Debugging Injected code with IDA Pro.

Reversing the dropper (as well as recently published here, here, here ) we can see that the malware creates an autorun key as its persistence mechanism with a unique key.

If you wanted to find out exactly where this is in your injected code.

Now lets verify this artifact holds for us in our memory dump.

The way we can do this is to use the mutscan command and pipe this output to a file.

Doing this and we search for MTX we get a few results that look like this.

This just illustrates that you can do a rough once over debugRE to find artifacts for a piece of malware that may not be published in a formal threat analysis from AV, researcher, someone else.

Shylock uses named pipes to communicate but also it uses this unique id that was referenced above.

The following screenshot shows the routine in which it is created.

Now leveraging this information from our debuggingRE process we can use this to create another fingerprint from a Shylock infection.

We can verify this in Volatility with the filescan program using python vol.py -f img.mem filescan output.txt and look for a named pipe that is a hexadecimal number 32 bytes in length.

No VNC component was on the VM image as it was stock Windows XP SP2 I believe.

The Windows Defender RCE that was exploited in-the-wild and patc 2 weeks ago.

Malware Named Pipe How To Control Cookies

To find out more, including how to control cookies, see here.