MalwareIntelligence is a site dedicated to research on all matters relating to anti-malware security, criminology computing and information security in general, always from a perspective closely related to the field of intelligence.

29.1.12

Hierarchy Exploit Pack. New crimeware for the cybercriminal gangs

The term "hierarchy" refers to an entity pyramidal action. Judging by the name of this new Exploit Pack of Russian origin, it seems that the author seeks to find its place within the criminal ecosystem, but all point to the feelings behind this is, above all, a beginner who seeks criminal more.



However, despite being a package of more criminal exploitation within a vast range of alternatives, it remains a real risk for any information system. Even considering that Hierarchy Exploit Pack criminal market reaches a stage where the circuit is ripe with a range of crimeware "vip" found not only among the list of "best crimeware" for criminals but also in the center of the storm-crime.

Under the nickname "Angelolog" hides its author. A nickname striking since according to their semantics, refers to "a branch of theology that deals with the study of angels". A rather obvious contradiction.


As usual, when an offender is "started in the business", does registering a domain that includes the same name as crimeware. Although clearly not the only domain that has been in the first instance. In this case, the data are as follows:

Домен: ANGELOLOG-HIERARCHY.RU
Владелец: Private Person
DNS-сервер: ns1.luckhost.kz.
DNS-сервер: ns2.luckhost.kz.
Телефон: +380933900884
E-mail: angelolog@mail.ru
Состояние: REGISTERED, DELEGATED, VERIFIED
Регистратор: REGRU-REG-RIPN
Создан: 2011.03.01
Оплачен до: 2012.03.01



The AS6876 (TENET-AS TeNeT Autonomous System TeNeT Telecommunication Company) found in Ukraine, isn't classified as malicious which suggests that "angelolog", a spammer menial, does not take long in the area of ​​crime.



While at first glance the design of the control panel is similar to the old Siberia Exploit Pack, it's actually a modification of Eleonore Exploit Pack. The evidence is very clear.

 Its structure is similar:


Hierarchy Exploit Pack contains the following exploits:

Office OCX
OpenWebFile Office OCX OpenWebFile arbitrary program execution BID-33243

MDAC
Arbitrary file download via the Microsoft Data Access Components (MDAC) CVE-2006-0003

AppStream LaunchObj
Symantec AppStream LaunchObj ActiveX control vulnerable to arbitrary code download and execution CVE-2008-4388

Hummingbird PerformUpdateAsync
Hummingbird Deployment Wizard ActiveX Control Insecure Methods (PerformUpdateAsync) CVE-2008-4728

Peachtree ExecutePreferredApplication
Peachtree insecure ExecutePreferredApplication method allows the execution of arbitrary programs CVE-2008-4699

C6 propDownloadUrl
C6 Messenger insecure method propDownloadUrl allows the execution of arbitrary programs CVE-2008-2551

Adobe getIcon
Stack-based buffer overflow in Adobe Reader and Acrobat via the getIcon method of a Collab object CVE-2009-0927

Adobe Libtiff
Libtiff integer overflow in Adobe Reader and Acrobat CVE-2010-0188

HPC URL
Help Center URL Validation Vulnerability CVE-2010-1885

IE iepeers.dll
Internet Explorer iepeers.dll use-after-free CVE-2010-0806

Sun Java Runtime RMIConnectionImpl
Privileged Context Remote Code Execution Vulnerability CVE-2010-0094

Sun Java Runtime Environment MixerSequencer
Invalid Array Index Remote Code Execution Vulnerability CVE-2010-0842

AFP Server Mac OS X v10.6.5
Remote attacker AFP Server to unexpectedly shutdown CVE-2010-1297

Sun Java Web Start BasicServiceImpl
Remote Code Execution Vulnerability CVE-2010-3563

Adobe Flash Player 10.2.153.1
SWF Memory Corruption Vulnerability CVE-2011-0611

Oracle Java SE
Rhino Script Engine Remote Code Execution Vulnerability CVE-2011-3544

It also incorporates the following malware:
payload.ser [F6795195968795C535EF6932A843E969] – 16/42


Exploit$1.class [625B6B915327D352E437B34D85FB67E2] – 1/44

Exploit$1.class [DD49FADD9372CBDEF709BB9F0B1105C7] – 2/43

Link.class [3013C223A80371BCA0798E1C21683305] – 11/44

Exploit.class [77E8E1CFCC6F0894015D8CA271BBBEF5] – 12/43

BasicServiceExploit.class [A63C9DB17FE7F60370B4FFD659B61B36] – 3/43

Exploit$1$1.class [21F2312A9D50F72810E242F72E751243] – 1/43

swf.swf [6EFD1CE8DC61C68BAD3B85A949709DD2] – 24/43

Exploit$.class [452CD049CE83E72F5C642F7457F4AA93] – 2/43

Gallery_Viewer.class [03497E41A5A5A6A6F92E2950AA087C06] – 8/44

Exploit.class [334EC1071B85D52A3DA4223ED7DC6D74] – 4/43

PayloadClassLoader.class [8563342ADD46F7EADC8745BB10267B2A] – 14/43

Gallery_Viewer.jar [1C73218F0CAF238400EB86E635862279] – 13/43

Gallery_Viewer.jar [2C4DF43924D237B56DB4096E6AF524B1] – 13/43

1.txt [CF7A4C337F3DA524350AC794B589F804] – 8/43

pdf.pdf [60CADBD724A6BF0527B5E731492D8A0F] – 16/43

Exploit.jar [69767793D644D6060A060133A6014CB9] – 21/42

1.exe [8321D8B973CE649252DF9C560B875647] – 9/43

Payload.class [EEB9BA7FB4F752E1249E696B638D4732] - 13/43

Exploit.jar [19A512A3CCBA3FCDEAA5262E82F0DECE] - 26/43

pdf5.pdf [2AD31CABE2527C5F94B2C351F6529F17] - 9/43

pdf4.pdf [48C583A82A004EC1B17688215E173EFB] - 11/43

swf.swf [4666A447105B483533B2BBD0AB316480] - 19/43

bot.exe [7AB9E8AC261D2A49D87EF304ADE03BA3] – 26/43


Regarding the exploits offer presented by this crimeware, it seems it is a "salad of exploits" which leads to assume, considering also that is a mod that the author could be a "collector Exploit Pack", performing their own development (without effort) through a "grout" of exploits of old Exploits Packs which is easily available in most underground forums.

On the other hand, the level of detection in almost all cases is on average less than 50%, which represents a critical aspect of any information system. Thus, no matter it's a crimeware without much representation in the criminal environment without a lot of creativity and without effective exploitation rate for the offender, it remains a latent threat. Especially when experience shows that old exploits as MDAC described in CVE-2006-0003, have a strong impact even after nearly six years to fix the bug that was exploited.


Related Information

Ale Cantis, Senior Crimeware Researcher
Cybercrime Research Team
Crimeware Working Group & CrimewareAttack Service | MalwareIntelligence

Ver más

24.1.12

Money Racing AV. Tracking a scareware affiliate

Since October 2011 we watch this affiliate system. Money Racing AV, a private PPS (Pay-Per-Sale) affiliate who spread actively fake antispywares (rogue). We have already seen this gang active in August 2009: A recent tour of scareware XII.Advertising can be found on various russian underground communities:




First contact with FTL (6 October 2011):

[14:29:33] Load4sales: hello
[14:30:02] mr: привет
[14:30:03] Load4sales: i'm late but just see your post on antichat about Money racing av v2
[14:30:25] mr: sorry bro
[14:30:26] mr: only for russians
[14:30:31] Load4sales: ah :/
[14:30:37] Load4sales: okay, thanks anyway
[14:30:46] mr: ok

The money racing gang operate from moneyracing.ru. And are know to for spread scarewares who have this type of graphical user interface:


Money Racing website login:


The fish image is the logo of G-Loomis (a company, makers of fishing rods, reels, rod blanks and accessories), and probably a coincidence but during the 19th century there was the Loomis Gang.
A notorious family of outlaws that operated in central New York.


I've etablished the following structure of money racing site:

Moneyracing.ru - 64.191.20.101
moneyracing.ru/templates/images/
moneyracing.ru/uploads/
moneyracing.ru/test.php <- Malicious
moneyracing.ru/manual/ (Standard)
moneyracing.ru/icons/ (Standard)
moneyracing.ru/cgi-bin/ (Standard)
moneyracing.ru/chat/
moneyracing.ru/plugins/
moneyracing.ru/screens/
moneyracing.ru/logs/
moneyracing.ru/img/
moneyracing.ru/soft/
moneyracing.ru/fish/ <- iframe
moneyracing.ru/css/
moneyracing.ru/css/style.css (Guessed)
moneyracing.ru/css/admin.css (Guessed)
moneyracing.ru/geo/ (Standard)
moneyracing.ru/geo/geoip.inc (Standard)
moneyracing.ru//
moneyracing.ru/feed/
moneyracing.ru/back/
moneyracing.ru/stat/
moneyracing.ru/cron/
moneyracing.ru/captcha/
moneyracing.ru/javascripts/

From all these directories, some are interestings. Like the folder /back/

<img src="image.jpg" border="0" align="baseline" />
Last-Modified: Wed, 15 Jun 2011 10:19:41 GMT


English translation:

Step 1.
Domain parking.
For starting the work you need park with us your domain on which all traffic will go.
For this setup your domain registar account DNS
ns1.dns.com
ns2.dns.com
After this, add domain for our parking in the Links section.
You can add few domains in same time, this will create a queue and if your domains goes banned it will be automatically replaced with new.
You can use request for automatic acquisition of fresh domain and replacing it in our TDS if you are using it.
**Domains which are banned removes from our DNS automatically.

Step 2.
Traffic Back URL
You should set URL "Traffic Back"
We will return surfer to you for to the indicated "Traffic Back" URL if
A. His OS and Browser does not match to us or if he was here in last 7 days.
B. Surfer went through our website and we redirects him back to yours "Traffic Back" URL
For non Adult traffic, average percent Exploited 18-20%, callhome 55-60%.
You earn 100% from 1000 USA installs. At the same time getting all your traffic back.
We accept only USA, WinXP, Vista, Win7, IE, FF.
All other traffic will be returned to your Back URL even before getting to our page.

And if we go back in 2009 we can see that these scarewares connect directly to moneyracing.ru:
Malware MD5: E1EEDEEF721D6F87FFB0E1EC9CEE9F95

urls found inside:


Scareware GUI:


Now if we do a simple brain reflexion on 'Racing Money'
Money... Alright!
Racing... hmm what.. racing = cars
And if we check the old IP used in years 200..
we found lanos-club.ru a forum about cars, maybe it's just a coincidence.


Back about the moneyracing.ru domain, we have also this 'test.php' a malicious page detected as Blackhole Exploit Kit, (probably very old)
Obfuscated code lead to xmlalien.in/main.php?page=1321edc7470b347f


Now, what's the IP of money racing can told us:


The 302/403 responses of DNS are interesting because they return the name of machines
for example, on the money racing network: orderonline-1.com was used as billing machine.

Machine name: bill.host
orderonline-1.com/cgi-bin/
orderonline-1.com/images/
orderonline-1.com/admin/
orderonline-1.com/icons/
orderonline-1.com/signup/
orderonline-1.com/manual/
orderonline-1.com/sig/
orderonline-1.com/css/
orderonline-1.com/js/
orderonline-1.com/%2523FFFFFF/
orderonline-1.com/%2523999999/
orderonline-1.com/cron/

And freshmediacontent.com as report machine:

Machine name: reports.host
freshmediacontent.com/admin/home/login
freshmediacontent.com/admin/home/logout
freshmediacontent.com/admin/members
freshmediacontent.com/admin/settings
freshmediacontent.com/admin/logs

I've recontacted the owner of money racing on 09 December 2011:


Out of business apparently and according to him.
He told me to search on undergrounds forum a guys with the nick: 'бомбе'
But i've never find a 'Bomb' or someone else affiliated with money racing, so i've again contacted him, 18 December 2011:

Even with attractive USA traffics and all the requierement, he keep to tell me to search 'бомбе'
But it's more probable that he don't want partners for the moment due to the exposure of  Vyacheslav Zakorzhevsky made in October 27.

Now more recently, in January, a colleague detected the domain core6575.opensourceavpro.com as malicious download, but the domain in question is from the money racing network.

• dns: 1 » ip: 213.133.100.207 - adresse: CORE6575.OPENSOURCEAVPRO.COM
Domain name:             OPENSOURCEAVPRO.COM
Name Server:             dns1.opensourceavpro.com 213.133.100.207
Name Server:             dns2.opensourceavpro.com 213.133.100.207
Creation Date:           2011.10.18
Updated Date:            2011.12.01
Expiration Date:         2012.10.18

Status:                  DELEGATED

Registrant ID:           GDZ6YAX-RU
Registrant Name:         Oleg Stoyanov
Registrant Organization: Oleg Stoyanov
Registrant Street1:      Botanicheskaya 8
Registrant City:         Moscow
Registrant Postal Code:  127276
Registrant Country:      RU

Administrative, Technical Contact
Contact ID:              GDZ6YAX-RU
Contact Name:            Oleg Stoyanov
Contact Organization:    Oleg Stoyanov
Contact Street1:         Botanicheskaya 8
Contact City:            Moscow
Contact Postal Code:     127276
Contact Country:         RU
Contact Phone:           +7 495 5468308
Contact E-mail:          olegstoyanov@hotmail.com

Registrar:               Regional Network Information Center, JSC dba RU-CENTER

By searching infos and urls we can determine the following syntax:
core6575.opensourceavpro.com/?RID=2671/terms.html
This domain was used as landing page for money racing partners.

A screenshot of the site:


From the cascading style sheets of the site I've found also an image who is absolutely not related with the usual scareware landing:



But i've found nothing related to a 'Youtube Studio' landing page on the server
but with Google i get this: youtubestudiopro.com.


Downloaded file is legit:

MD5: D3A748372338841FCD4366307F3EE657

The graph of youtubestudiopro.com is interesting:

Detail for 64.120.214.18:
Pharma domains, payment processors...

And if i click on contact: 64.79.111.19/contacts.html. Another landing page, this time 'Monstocloud':


The company adress is the same a Registry Fixer (egistryengineer.com):


Now for return to core6575.opensourceavpro.com, there is just a scareware hosted 'setup.exe' (AV Protection Online).

Malware MD5: 45BFC0DE3C78454B8C80623B7DE965B0

As usual we can have the machines name with 302 or 403 requests.
ourbigbooklibrarry.com and mediaforclouds.com as "reports.host".



storeordersonline.com and onlineorderbilling.com as "bill.host".



Also note that this '360 Security' was never found as 'executable version'
opensourceavpro.com have also a fake purchase page online
Even the captcha is a fake (a static GIF image) and not verified:


When we do a wrong billing order, the following text is displayed:

Sorry, please contact as by email: support@ccbil-payment.com

CCBill, is a payment processing service, mostly used for Adult.

We have also this url from opensourceavpro.com, once again related with the money racing network:

avsecurecs.com
• dns: 1 » ip: 212.124.122.144 - adresse: AVSECURECS.COM
Domain name:             AVSECURECS.COM
Name Server:             dns1.avsecurecs.com 213.133.100.207
Name Server:             dns2.avsecurecs.com 213.133.100.207
Creation Date:           2011.08.03
Updated Date:            2011.12.18
Expiration Date:         2012.08.03

Status:                  DELEGATED

Registrant ID:           PBU1LTD-RU
Registrant Name:         Cyprus company
Registrant Organization: Cyprus company
Registrant Street1:      6 Karaiskakis Street
Registrant City:         Limassol
Registrant Postal Code:  53034
Registrant Country:      CY

Administrative, Technical Contact
Contact ID:              PBU1LTD-RU
Contact Name:            Cyprus company
Contact Organization:    Cyprus company
Contact Street1:         6 Karaiskakis Street
Contact City:            Limassol
Contact Postal Code:     53034
Contact Country:         CY
Contact Phone:           +357 25555000
Contact E-mail:          tomronalds@hotmail.com

Registrar:               Regional Network Information Center, JSC dba RU-CENTER


Screenshot of avsecurecs.com:


Customer area:


On the "About Us" page they claim to be at 392 Potrero Avenue, Sunnyvale.


But 360 Security LP don't exist:


We have also found a phpinfo file on the server.


And get interesting informations:

SSH_CONNECTION 212.124.122.134 60463 176.31.230.169 22
System Linux ns226633.ovh.net 2.6.38.2-grsec-xxxx-grs-ipv6-64 #2 SMP Thu Aug 25 16:40:22 UTC 2011 x86_64
SCRIPT_FILENAME /home/sites/st2/html/chat/php.php
SCRIPT_URI http://st2.host/chat/php.php
SCRIPT_URL /chat/php.php
SERVER_ADDR 176.31.230.169
SERVER_ADMIN root@238072.b128.hostseek.ru

Actual domain of money racing is mrwrk.com, mrwrk stand probably for "Money racing workers"

Domain name:             MRWRK.COM
Name Server:             dns1.mrwrk.com 212.124.122.144
Name Server:             dns2.mrwrk.com 212.124.122.144
Creation Date:           2011.05.18
Updated Date:            2011.11.01
Expiration Date:         2012.05.18

Status:                  DELEGATED

Registrant ID:           YWAAUUH-RU
Registrant Name:         Kiborg Solutions LLC
Registrant Organization: Kiborg Solutions LLC
Registrant Street1:      shevchenko 12
Registrant City:         Kiev
Registrant Postal Code:  30015
Registrant Country:      UA

Administrative, Technical Contact
Contact ID:              YWAAUUH-RU
Contact Name:            Kiborg Solutions LLC
Contact Organization:    Kiborg Solutions LLC
Contact Street1:         shevchenko 12
Contact City:            Kiev
Contact Postal Code:     30015
Contact Country:         UA
Contact Phone:           +380 44 4907681
Contact E-mail:          soknosergei@yahoo.com

Registrar:               Regional Network Information Center, JSC dba RU-CENTER


mrwrk and SSH connections was under brute force (pure and with wordlists) but that have done nothing. This gang continue to make errors and we will continue to keep an eye on.

Steven K (Xylitol)
Malware Research

Ver más