Phoenix Exploit’s Kit v2.3 Inside
PEK (Phoenix Exploit's Kit) has become one of the most used by those who flood the Internet every day with different types of malicious code. Currently, a large amount of malware is distributed through this crimeware, which is also widely used for collecting information relevant to a botmaster.
Earlier we mentioned how it looks inside version 2.1 and at the same time we said that from the standpoint of design, different versions of PEK are practically very similar, with the typical dark background, the phoenix in the lower right corner and facing your authentication system trivial at first glance, but nevertheless performs a check under the SHA1 algorithm.
This time, it's version 2.3 of PEK, the final and stable so far (there is a preliminary version 2.4 known as the 2.3r). However, despite no visible differences appear, this version also upgrade a number of "details" in your code, incorporates a number of exploits which currently represent the highest success rate.
Earlier we mentioned how it looks inside version 2.1 and at the same time we said that from the standpoint of design, different versions of PEK are practically very similar, with the typical dark background, the phoenix in the lower right corner and facing your authentication system trivial at first glance, but nevertheless performs a check under the SHA1 algorithm.
This time, it's version 2.3 of PEK, the final and stable so far (there is a preliminary version 2.4 known as the 2.3r). However, despite no visible differences appear, this version also upgrade a number of "details" in your code, incorporates a number of exploits which currently represent the highest success rate.
Simple statistics
Displays information about the general data tones to the recorded information with PEK.
Displays information about the general data tones to the recorded information with PEK.
Advanced statistics
Displays detailed information about operating systems and browsers violated.
Displays detailed information about operating systems and browsers violated.
Countries statistics
Shows statistics of the countries where the zombies.
Shows statistics of the countries where the zombies.
Referer data
List the websites of direct reference.
List the websites of direct reference.
The list shows the version used for this article is very long, but is complete on the following link: PEK v2.3 Referers List.
Upload module
Updates the malware that spreads.
Updates the malware that spreads.
Exploits that incorporates the default for this version are:
- IE MDAC CVE-2006-0003
- Adobe Flash 9 CVE-2007-0071
- Adobe Flash 10 CVE-2009-1869
- Adobe Reader CollectEmailInfo CVE-2007-5659
- Adobe Reader util.printf CVE-2008-2992
- Adobe Reader Collab GetIcon CVE-2009-0927
- Adobe Reader newPlayer CVE-2009-4324
- Adobe Reader LibTiff CVE-2010-0188
- Adobe PDF SWF CVE-2010-1297
- Adobe Reader/Foxit Reader PDF OPEN CVE-2009-0836
- Java HsbParser.getSoundBank (GSB) CVE-2009-3867
- Java Runtime Environment (JRE) CVE-2008-5353
- Java SMB CVE-2010-0746
- IE iepeers CVE-2010-0806
- Windows Help Center (HCP) CVE-2010-1885
- IE SnapShot Viewer ActiveX CVE-2008-2463
Their "sale" began in early July 2010 at a cost of $ 2200. An interesting detail is what the sentence is shown with the logo: "CONCORDIA, INTEGRITAS, INDUSTRIA…" three Latin words which are closely related to a famous German family. His translation is harmony, integrity and diligence.
Regarding the spread executable binary, in this case, it's a variant of the trojan generated with the private constructor SpyEye:
Regarding the spread executable binary, in this case, it's a variant of the trojan generated with the private constructor SpyEye:
- exe.exe (014678ec0f5e2b92d7f089a20ffe77fa)
In the White paper called Phoenix Exploit's Kit In the mythology of a criminal enterprise can obtain more information on the different versions of this crimeware.
Related information
State of the art in Phoenix Exploit's Kit [White paper]
Campaign infection through Phoenix Exploit's Pack
Phoenix Exploit's Kit and Pay-per-Install via PC Defender Antivirus
Phoenix Exploit’s Kit. Otra alternativa para el control de botnets
Jorge Mieres
Founder & Director of MalwareIntelligence
Crimeware & Intelligence Analyst Researcher
3 comentarios:
Is CVE-2010-0746 even PUBLISHED? I can't find anything on it. Is this an error?
Hi, is not an error!!!
Cheers!
Jorge,
did you mean CVE-2010-0476 not 746?
it is MSoft SMB.
CVE-2010-0476 is not even close to Java or Smb..
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0476
typo?
Mila
Post a Comment