7.7 Ddos:: Unknown Secrets and Botnet Counter-Attack

7.
7 DDoS : Unknown Secrets and Botnet Counter-Attack
www.issuemakerslab.com sionics & kaientt
Contents
Overview Botnet Structure
7.7 DDoS
Bot Malware Analysis Botnet Counter-Attack Demo
www.issuemakerslab.com
Overview
7.7 DDoS Attack
Cyber attack against major government, news media, and financial websites of South Korea and US
Re-Collection Server hacked Web Hard sites (spreading malware) C&C IP Relay Server
C&C Master Server
IP Relay Distributed C&C Server
DDoS Target Websites
DDoS Attack
Zombie Bot
Distributed Support Server (HDD Destroy Malware)
Attacker
flash.gif
Main Support Server (HDD Destroy Malware)
Botnet Begins!
Encryption Protocol send: + 0x28) ^ 0x47 recv: ^ 0x47) - 0x28 Filename dvcmgmt.exe X ntdsbcli.exe ntdcmgt.exe inetsvc.exe Y send: ^ 0x92) + 0x61 recv: - 0x61) ^ 0x92 perfmon.exe tasksc.exe Port 131 143 339 112, 125, 133 112, 125, 133 128, 125, 133
A Encryption Protocol C&C Master Server Re-Collection Server Distributed C&C Server XOR 0xCC ??? ??? netlmgr.exe 213.33.116.41:53 C&C IP Relay Server 216.199.83.203:80 213.23.243.210:443
B XOR 0xFC ntmssvc.exe ??? ntmpcsvc.exe 75.144.115.102:53 67.69.18.51:53 220.250.64.246:443
C XOR Ramdom 8 Bytes ??? ??? ??? 98.118.201.35:443 93.104.211.61:53 116.68.144.212:80
Botnet Begins!
Structure of Botnet
Composed in hierarchical structure C&C Server was operated as a distributed server by more than thousands of units through hacking.
Re-Collection Server C&C IP Relay Server C&C Master Server
IP Relay Distributed C&C Server
File Information Stealing Malware

The hackers first circulated malwares that collect file information beforehand. These are estimated to have been circulated through various ways. The malwares collected information about the files that exist in the directories such as Recent, My Documents, Favorites and etc. from Victims PCs and sent it to the C&C Server.
3 Types of Malware
A
Encryption Protocol XOR 0xCC DDoS Malware (July ~) Beginning C&C IP Relay Server Information DDoS Config File msiexec?.exe (= ntdll.exe) msiexec?.exe (= ntdll.exe) wmiconf.dll pxdrv.nls wimgat.exe wimgat.exe ntscfg.dll atv04nt5.img wmcfg.exe Spam HDD MBR Destroy mstimer.dll wversion.exe File Information Stealing Malware (May ~) ntmpsvc.dll netlmgr.dll ssdpupd.dll Config File perfb093.dat drmkf.inf regscm.dll (early: rasmcv.dll) maus.dl www.issuemakerslab.com sysvmd.dll (early: sysenv.dll) dhcp32.exe (= ntdll.exe) vol32.css perfvwr.dll svrms.nls
B
XOR 0xFC
C
XOR Ramdom 8 Bytes
Bot Malware Analysis

msiexec?.exe (= ntdll.exe)
Checks c_10986.nls file Drops file and decompresses (inflate) Creates Service called WmiConfig Communicates with C&C IP Relay Server and creates pxdrv.nls file Removes the previous version of the services and config files


Dropping and inflating file


Communication Protocol with C&C IP Relay Server

pxdrv.nls file format

wmiconf.dll
decodes pxdrv.nls file connects Distributed C&C Server and receives 10 Distributed C&C Server IP receives the file(~CGF????.tmp) after sending the time(saved in pxdrv.nls) parses the received file and executes reads attack targets in uregvs.nls, and starts DDoS attack


Communication Protocol with Distributed C&C Server

~CGF????.tmp file format
A : Compare Time B : Command Code1 C : Start Time D : End Time E : Command Code2 F : File Size G : File Data

uregvs.nls file format

uregvs.nls file format
A : Unknown time B : Total Target URL Count C : URL number D : Target URL E : Resolved IP address F : Total resolved IP address Count G : Target Port H : Exponent MAX NUM count I : Modular value J : Time of starting the attack K : Time of ending the attack L : Related Query Performance Counter value M : Sleep term (between target) N : Total thread count per Target URL O : Related http connection time P : R's length Q : Allocated memory address of R R : Target URL; Port; Attack Type(get, post); Request path;;

DDoS Packet Type
DDoS Attack Packet Type and Order

circling "packet per thread Source IP Destination IP Target Target Target Target Target Target Target Target Broadcast Target Target Attack Type SYN SYN ACK ACK UDP UDP ICMP ICMP ICMP HTTP GET HTTP GET smurfing User-Agent Random(5) User-Agent Random(5) Cache-Control
ETC
1 2 3 4 5 6 7 8 9 10 11
Orginal Spoofing Original Spoofing Original Spoofing Original Spoofing Target Original Original



wmcfg.exe
wmcfg.exe is executed only when the msvcr90.dll (Microsoft C Runtime Library) file exists. drops the following files: %System%\config\SERVICES %System%\config\SERVICES.LOG %System%\mstimer.dll %System%\wversion.exe starts the following service: mstimer deletes itself

mstimer.dll
decodes SERVICES.LOG file attempts to connect the 8 Distributed Support Servers randomly and requests the flash.gif file. http://200.6.218.194/flash.gif http://92.63.2.118/flash.gif http://163.19.209.22/flash.gif http://202.14.70.116/flash.gif http://75.151.32.182/flash.gif http://122.155.5.196/shop/images/flash.gif http://201.116.58.131/xampp/img/flash.gif http://newrozfm.com/img/glyph/flash.gif

mstimer.dll
sends the binary at the front part of flash.gif through spam mails to other users. However, because the binary is damaged file, the users who received the spam mails dont suffer from any damages substantially.

flash.gif file format

~AX?.tmp
executed by mstimer.dll drops the following file: wversion.exe (HDD MBR Destroyer) records the time of execution for wversion.exe in win.ini deletes itself

wversion.exe (HDD MBR Destroyer)
executed by mstimer.dll after midnight on July 10. initializes the HDD MBR by 0x55 and inserts the string, "Memory of the Independence Day" In addition, in the case of the following extension, it makes the file unavailable by setting a random password and compressing into gz. (zip, pas, c, cpp, java, jsp, aspx, asp, php, rar, gho, alz, xml, pst, eml, kwp, gul, hna, hwp, txt, rtf, dbf, db, accdb, pdf, pptx, ppt, mdb, xlsx, xls, wri, wpx, wpd, docm, docx, doc) deletes itself
Botnet Counter-Attack
Demo
It's Showtime!
Q&A
Questions?
contact us via e-mail sionics 0x40 issuemakerslab.com kaientt 0x40 issuemakerslab.com

7.7 Ddos:: Unknown Secrets and Botnet Counter-Attack

Uploaded by

Copyright:

Available Formats

7.7 Ddos:: Unknown Secrets and Botnet Counter-Attack

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

7.7 Ddos:: Unknown Secrets and Botnet Counter-Attack

Uploaded by

Copyright:

Available Formats

7.

7 DDoS : Unknown Secrets and Botnet Counter-Attack

www.issuemakerslab.com sionics & kaientt

Overview Botnet Structure

Bot Malware Analysis Botnet Counter-Attack Demo

C&C Master Server

IP Relay Distributed C&C Server

DDoS Target Websites

Main Support Server (HDD Destroy Malware)

B XOR 0xFC ntmssvc.exe ??? ntmpcsvc.exe 75.144.115.102:53 67.69.18.51:53 220.250.64.246:443

C XOR Ramdom 8 Bytes ??? ??? ??? 98.118.201.35:443 93.104.211.61:53 116.68.144.212:80

IP Relay Distributed C&C Server

File Information Stealing Malware

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

DDoS Attack Packet Type and Order

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

Bot Malware Analysis

You might also like