Leaderboard

@wirtz in legatura cu vip, si daca esti prienten cu tex gratis nu iti va da vip, pentru ca sunt lucruri private puse care nu pot ajunge asa simplu pe mainiile oricarui user! Asa ca vip-ul la meritat si jos palaria!

Trimis

Azi dimineata am luat un crypter ud de pe un forum de rusi Dowload base 64 aHR0cHMlM0EvL3d3dy5kcm9wYm94LmNvbS9zL3d5cTYzYTllbHBlNnQwNC9VTkNyeXB0LnJhciUzRmRsJTNEMCUzRA==

I've been wanting to take a little bit of a look at the recent SteamStealer malware going around throughout November and December. There's a few different types, mainly being .src executables that once executed connect to a designated domain and drop more stuff. The other more recent type uses a custom crypter with a library containing a RunPE function to inevitably load SteamStealer into the process. In any case, I won't be doing any "on the surface" analysis/removal tips, as it's been nicely done by blogs such as this. I'll instead be taking a look at the source code for a few of these .src files, and talking a bit about them as well. So first off, the big thing regarding a lot of these recent .src files is they are obfuscated with Confuser, or its successor known as ConfuserEx. Confuser is a pretty popular free obfuscator mainly because it's one that isn't completely easy to reverse. It's still reversible, just not as easy as many other free obfuscators out there. You can do it with WinDbg which is absolutely gruesome and not really recommended for .NET deobfuscation, as anything really past methods is difficult and time consuming. Alternatively, you can use the wonderful internet world we have to get any slew of tools to decrypt methods, delegate killer, dump, and string decrypt. Let's first take a look at what the thumbnails for the samples look like: As we can see, the thumbnails appear as a Steam inventory with various items. Back to obfuscation, if we try to take one of our .src samples obfuscated with Confuser into IDA, here's what we get: After deobfuscation however, we can successfully take a somewhat broken look at the source code. Near the top of the code you can generally find the following (and hilarious) format: newobj instance void SteamWorker::.ctor() stloc.0 ldloc.0 ldstr "7656119816xxxxxxx" // Steam ID ldstr "203496355" ldstr "N71Ll_bP" All of the Steam ID's extracted from various source code samples are all 8 or 9 (mostly 9) digit ID's, implying they're new and not old accounts by any means. With this said, these accounts were of course created for the sole purpose of spamming trades with this malware, and most likely selling valuable items for real money. I wouldn't be surprised if they were purchased or stolen ID's. callvirt instance void SteamWorker::getSessionID() ldloc.0 ldstr "csgolounge" ldstr "how much is this karambit knife? hxxp://screen4say.com/image.png" callvirt instance void SteamWorker::SpamGroup(string, string) ldloc.0 ldstr "dota2lounge" ldstr "how much is this unusual courier? hxxp://screen4say.com/image.png" callvirt instance void SteamWorker::AddGroupAndMess(string, string) ldloc.0 callvirt instance void SteamWorker::getFriends() ldloc.0 ldstr "He give me this knife hxxp://screen4say.com/image.png ty for you :)" callvirt instance void SteamWorker::sendMessWall(string) ldloc.0 callvirt instance void SteamWorker::DeleteAll() Above is an example of one of the many domains used in the malware (purged). You can see it would join the Steam group "csgolounge" and then message users "how much is this karambit knife?" with a link to the malware. This is how it mainly propagated, by joining various Steam trade groups and spamming anyone with public inventories. Mainly "csgolounge" and "dota2lounge" as those were the main games used for the malware. Domains used from what I've seen are: prntsrc-online, screen4free, hostingscreen, screenshotyou, etc. If we do a lookup on any one of those: Domain name: prntsrc-online.com Domain idn name: prntsrc-online.com Status: clientTransferProhibited Registry Domain ID: Registrar WHOIS Server: whois.reg.ru Registrar URL: https://www.reg.com/ Registrar URL: https://www.reg.ru/ Registrar URL: https://www.reg.ua/ Updated Date: 2014-12-15 Creation Date: 2014-12-15T19:18:01Z Registrar Registration Expiration Date: 2015-12-15 Registrar: Domain names registrar REG.RU LLC Registrar IANA ID: 1606 Registrar Abuse Contact Email: Email Masking Image@reg.ru Registrar Abuse Contact Phone: +7.4955801111 Registry Registrant ID: Registrant Name: Ivan Ivanov Registrant Organization: Yandex LTD Registrant Street: ul.Koshkina 15 kv 4 Registrant City: Moscow Registrant State/Province: MOSCOW STATE Registrant Postal Code: 132170 Registrant Country: RU Registrant Phone: +79871975615 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: spamspam228@mail.ru Registry Admin ID: Admin Name: Ivan Ivanov Admin Organization: Yandex LTD Admin Street: ul.Koshkina 15 kv 4 Admin City: Moscow Admin State/Province: MOSCOW STATE Admin Postal Code: 132170 Admin Country: RU Admin Phone: +79871975615 Admin Phone Ext: Admin Fax: Admin Fax Ext: Admin Email: spamspam228@mail.ru Registry Tech ID: Tech Name: Ivan Ivanov Tech Organization: Yandex LTD Tech Street: ul.Koshkina 15 kv 4 Tech City: Moscow Tech State/Province: MOSCOW STATE Tech Postal Code: 132170 Tech Country: RU Tech Phone: +79871975615 Tech Phone Ext: Tech Fax: Tech Fax Ext: Tech Email: spamspam228@mail.ru Name Server: ns1.hostinger.ru Name Server: ns2.hostinger.ru Name Server: ns3.hostinger.ru Name Server: ns4.hostinger.ru DNSSEC: Unsigned Regarding this search, we can see it's a Russian based domain that was created and is administered by spamspam228(at)mail.ru. There's no doubt spamspam228 is a legitimate email, right? My favorite part isn't the email, but that the registrant's name is Ivan Ivanov from the organization Yandex LTD. This is absolutely hilarious considering Yandex is a Russian search engine (and ISP I believe?). I don't think Mr. Ivan Ivanov from Yandex is behind this. If we now go ahead and look up this email, we can see: The email [email protected] is related to these domains : 1. printsrceen.com 2. prntsrc-online.com There's another interesting one: Domain Name: PICTURES-SCREEN.NET Registry Domain ID: Registrar WHOIS Server: whois.publicdomainregistry.com Registrar URL: www.publicdomainregistry.com Updated Date: 2014-12-23T16:15:07Z Creation Date: 2014-12-23T16:15:05Z Registrar Registration Expiration Date: 2015-12-23T16:15:05Z Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Registrar IANA ID: 303 Registrar Abuse Contact Email: Registrar Abuse Contact Phone: +1-2013775952 Domain Status: clientTransferProhibited Registry Registrant ID: Registrant Name: Xuila Pitrov Vasielvis Registrant Organization: ScreenPictures Registrant Street: Puschcicha,4,15 Registrant City: Moscow Registrant State/Province: Moscow Registrant Postal Code: 148821 Registrant Country: RU Registrant Phone: +7.9652422078 Registrant Phone Ext: Registrant Fax: Registrant Fax Ext: Registrant Email: jesus7298@mail.ru Registry Admin ID: Admin Name: Xuila Pitrov Vasielvis Admin Organization: ScreenPictures Admin Street: Puschcicha,4,15 Admin City: Moscow Admin State/Province: Moscow Admin Postal Code: 148821 Admin Country: RU Admin Phone: +7.9652422078 Admin Phone Ext: Admin Fax: Admin Fax Ext: Admin Email: jesus7298@mail.ru Registry Tech ID: Tech Name: Xuila Pitrov Vasielvis Tech Organization: ScreenPictures Tech Street: Puschcicha,4,15 Tech City: Moscow Tech State/Province: Moscow Tech Postal Code: 148821 Tech Country: RU Tech Phone: +7.9652422078 Tech Phone Ext: Tech Fax: Tech Fax Ext: Tech Email: jesus7298@mail.ru Name Server: ns1.webhost1.ru Name Server: ns2.webhost1.ru DNSSEC:Unsigned Administered by a Xuila Pitrov Vasielvis, from Russia once again, from the organization "ScreenPictures". It's the domain name backwards, hilarious. It's registered/administered by/to the email jesus7298(at)mail.ru. Once again, an interesting choice for an email. If we now go ahead and look up this email, we can see: The email jesus7298@mail.ru is related to these domains : 1. pictures-screen.net 2. picturesscreen.net 3. screenshotcapture.net See the pattern? Lots of malicious domains hosted and administered by Russians. So right away after deobfuscation you can find the Steam ID of the account the items are ultimately being sent to for collection, and information regarding the domain housing the malware. Of course after we find a Steam ID, we can look that up and find the profile on Steam Community. I won't be posting the Steam ID's publicly even though these accounts were used for malicious purposes, because I'm just here to analyze and that's it. You can probably dig up the profiles if you care enough to report them. Right, so we can see that this account is level 1 (new), the only game it has played is Dota 2, and it has joined the Dota 2 group so it can spam the malware. We can see this person was nice enough to leave their Skype, name (possibly fake in some cases), etc. I have blanked it out as I noted I will. Let's take a look at another account: This account is a bit more active, with 5.9 hours played of Dota 2 in the last two weeks. It's also level 2 as opposed to the previous account which was only level 1. This account is also in two of the usual spam groups, rather than one. With all of the above said, the above account was likely actively spamming successfully more than the first. Either that, or it was just used for spamming with the malware in general rather than prepared to be used for spamming. You can see the "view more info" button, which hilariously the user left most if not all of their online credentials and places to find them. One of the links was to a Russian hack forum in which they hosted a thread offering various "services". We can see some of the items the malware looked to steal: ldstr "440,570,730,753" ldstr "753:gift;570:rare,legendary,Dc,mythical,arcana,normal,unusual,ancient,tool,key;440:unusual,hat,tool,key;730:tool,knife,pistol,smg,shotgun,rifle,sniper rifle,machinegun,sticker,key" callvirt instance void SteamWorker::addItemsToSteal(string, [opt] string) The first few are Dota 2 tiers for the rarity quality for an item, and then we branch off to keys, unusual hats, hats in general, etc, and eventually ending up with Counter Strike items. Considering for example that unusual hats depending on the type, effect, etc can go upwards of several hundred dollars, this is a pretty annoying malware for people that aren't aware of it. Overall however it's not a very impressive piece of malware by any means, just looks like script stuff. However I don't think it was meant to/supposed to be. It has obviously satisfied its original and intended goal, which was to steal items. A lot of people have had their items stolen, simply because a lot of people aren't aware as I noted above. Although I said I wouldn't go into removal, to avoid this malware other than just understanding how it works, just make your trades private. Source