Storm Worm update

La nuova pagina di Storm Worm e' arrivata, insolitamente presto, a meno di una settimana dalla falsa pagina di greetings cards.

La pagina pubblicizza adesso una applicazione p2p chiamata Krakin e promette "Easy to install, prevents tracking, blogs and chat platforms, and video mail"
Ad aumentare l'autorevolezza del sito sono presenti anche una serie di note di copyright.

La pagina contiene anche un javascript offuscato

Anche in questo caso il codice della chiave della funzione XOR di decodifica dello script cambia ad ogni caricamento della pagina per aumentare la possibilita' di nascondere il codice ai programmi antivirus.
Passando il codice sorgente della pagina a Virustotal vediamo che circa il 45% degli antivirus riescono a rilevare il codice javascript nella pagina come pericoloso.

----------------------------------------------------------------------------------------------------------------------------------
Complete scanning result of "ptowl.com.htm", processed in VirusTotal at 10/18/2007 02:48:29 (CET).

[ file data ]
* name: ptowl.com.htm
* size: 14451
* md5.: dbc82c9a39b1579f95c07492fb529b71
* sha1: 6bcb59d9df0fd036d5d4fcf8f92dddc9d04e2542

[ scan result ]
AhnLab-V3 2007.10.13.1/20071012 found nothing
AntiVir 7.6.0.23/20071017 found nothing
Authentium 4.93.8/20071017 found [IRC/MS06-006]
Avast 4.7.1051.0/20071017 found [JS:Agent-Q]
AVG 7.5.0.488/20071017 found [JS/Psyme]
BitDefender 7.2/20071018 found [Trojan.Downloader.JS.Agent.MT]
CAT-QuickHeal 9.00/20071017 found nothing
ClamAV 0.91.2/20071017 found [JS.XorCrypt]
DrWeb 4.44.0.09170/20071017 found [VBS.Psyme.428]
eSafe 7.0.15.0/20071015 found [JS.MS06-006]
eTrust-Vet 31.2.5218/20071017 found nothing
Ewido 4.0/20071017 found [Downloader.Agent.kd]
F-Prot 4.3.2.48/20071014 found nothing
F-Secure 6.70.13030.0/20071016 found [Trojan-Downloader.JS.Agent.kd]
FileAdvisor 1/20071018 found nothing
Fortinet 3.11.0.0/20071017 found [JS/Agent.KD!tr.dldr]
Ikarus T3.1.1.12/20071018 found [Trojan-Downloader.JS.Agent.kd]
Kaspersky 7.0.0.125/20071018 found [Trojan-Downloader.JS.Agent.kd]
McAfee 5143/20071017 found nothing
Microsoft 1.2908/20071018 found nothing
NOD32v2 2599/20071017 found nothing
Norman 5.80.02/20071017 found nothing
Panda 9.0.0.4/20071018 found nothing
Prevx1 V2/20071018 found nothing
Rising 19.45.22.00/20071017 found nothing
Sophos 4.22.0/20071017 found [Troj/JSXor-Gen]
Sunbelt 2.2.907.0/20071013 found nothing
Symantec 10/20071016 found [Downloader]
TheHacker 6.2.9.096/20071017 found nothing
VBA32 3.12.2.4/20071017 found nothing
VirusBuster 4.3.26:9/20071017 found nothing
Webwasher-Gateway 6.6.1/20071017 found [JavaScript.CodeUnfolding.gen!High (suspicious)]
-----------------------------------------------------------------------------------------

Il file che invece viene scaricato cliccando sui link presenti nella pagina e' krakin.exe, e contiene il solito p2p botnet client.
Al momento circa il 60% degli antivirus presenti in Virustotal rilevano il malware come Zhelatin o Tibs.
-----------------------------------------------------------------------------------------------------------------------------
Complete scanning result of "krackin.exe", processed in VirusTotal at 10/18/2007 02:49:08 (CET).

[ file data ]
* name: krackin.exe
* size: 122864
* md5.: 031556f13053cef17965118ac03ace05
* sha1: bf42ae4756c4840ccb83b4b31bfdb63c441319a2

[ scan result ]
AhnLab-V3 2007.10.18.0/20071017 found nothing
AntiVir 7.6.0.23/20071017 found [WORM/Zhelatin.Gen]
Authentium 4.93.8/20071017 found nothing
Avast 4.7.1051.0/20071017 found nothing
AVG 7.5.0.488/20071017 found [Downloader.Tibs.7.AM]
BitDefender 7.2/20071018 found [Trojan.Peed.HQP]
CAT-QuickHeal 9.00/20071017 found [Win32.Packed.Tibs.cn120]
ClamAV 0.91.2/20071017 found nothing
DrWeb 4.44.0.09170/20071017 found [Trojan.Packed.187]
eSafe 7.0.15.0/20071015 found [Suspicious File]
eTrust-Vet 31.2.5218/20071017 found nothing
Ewido 4.0/20071017 found nothing
F-Prot 4.3.2.48/20071017 found nothing
F-Secure 6.70.13030.0/20071018 found [Packed.Win32.Tibs.cn]
FileAdvisor 1/20071018 found nothing
Fortinet 3.11.0.0/20071017 found [W32/PackTibs.CN!tr]
Ikarus T3.1.1.12/20071018 found [Packed.Win32.Tibs.cn]
Kaspersky 7.0.0.125/20071018 found [Packed.Win32.Tibs.cn]
McAfee 5143/20071017 found [Tibs-Packed]
Microsoft 1.2908/20071018 found [TrojanDownloader:Win32/Tibs.P]
NOD32v2 2599/20071017 found [Win32/Nuwar.AV]
Norman 5.80.02/20071017 found [Tibs.gen173]
Panda 9.0.0.4/20071018 found nothing
Prevx1 V2/20071018 found nothing
Rising 19.45.22.00/20071017 found nothing
Sophos 4.22.0/20071017 found [Mal/Behav-146]
Sunbelt 2.2.907.0/20071017 found nothing
Symantec 10/20071018 found [Trojan.Packed.13]
TheHacker 6.2.9.096/20071017 found [W32/Zhelatin.gen]
VBA32 3.12.2.4/20071017 found nothing
VirusBuster 4.3.26:9/20071017 found [Trojan.Tibs.Gen!Pac.138]
Webwasher-Gateway 6.6.1/20071017 found [Worm.Zhelatin.Gen]
[ notes ]
packers: Malware_Prot.Z
------------------------------------------------------------------------------------------

Ci si aspetta adesso la consueta ondata di mails di spam con l'invito ad installare questo innovativo client p2p.

Aggiornamento 18 ottobre

Lucass in un commento al post mi segnala il nuovo testo della mail che invita a visitare il sito del falso client p2p.
------------------------------------------------------------------------
Oggetto: man here is the link

Man this thing is awesome. It.s the new sharing network with IP blocking
so no one knows who you are

http: //67.64.104.4/
-----------------------------------------------------------------------

Edgar