MS08-067: New RPC Worm from China

Sorry, gentle reader, this blog post is for the Geeks. Bottom line for non-geeks.

MAKE SURE YOU HAVE YOUR WINDOWS SERVERS PATCHED WITH MS08-067.

Non-geeks, quit reading here. Sorry.

We've received word of a new "in the wild" worm based on the MS08-067 "out of cycle" security patch released by Microsoft on October 23rd.

The first report that we received was that ThreatExpert had identified the new worm. Their post was the first place we found an MD5 of the new malware, which was listed as MD5 = AE4251541EBEA00014D3DABC90118279.

We used the article to check VirusTotal to see who was already detecting this one, and got the following results back:

AntiVir - - TR/Expl.MS08-067.G
BitDefender - - Trojan.Downloader.Shelcod.A
F-Secure - - Exploit.Win32.MS08-067.g
GData - - Trojan.Downloader.Shelcod.A
Ikarus - - Virus.Exploit.Win32.MS08.067.g
K7AntiVirus - - Exploit.Win32.MS08-067.g
Kaspersky - - Exploit.Win32.MS08-067.g
Microsoft - - Exploit:Win32/MS08067.gen!A
NOD32 - - Win32/Exploit.MS08-067.B
Prevx1 - - Malicious Software
SecureWeb-Gateway - Trojan.Expl.MS08-067.G
Sophos - - Mal/Generic-A

We know from the ThreatExpert Report that Kaspersky, Microsoft and Sophos were all detecting it BEFORE their report.

Symantec clearly knows about it as well, as Computerworld interviewed their Kevin Haley, who told them Symantec is calling the malware "Wecorl", and that they believe it came out of China. Haley also warns that because infected machines attempt to contact all peers on their subnet via port 139, if a single infected laptop gets into an organization after becoming infected while not behind the corporate firewall, the results could be quite serious.

The Symantec Technical Details are quite thorough, including the names of several websites where the malware attempts to download additional code from. Firewall administrators will want to be on the lookup for traffic to these sites:

* robot.10wrj.com
* ls.cc86.info
* ls.lenovowireless.net
* ls.playswomen.com

The full URLs were not given in the technical article.

When we finally got our hands on the malware, thanks to Packet Ninja's Daniel Uriah Clemens, we were able to conclusively agree with Haley about the Chinese origins. Big hints are revealed in the strings of some of the dropped malware, which includes strings we found on Chinese anti-virus discussion sites, dating back as early as August of this year, discussing code used by a DDOS Botnet. (For example, this page on "HackPro.cn").

In particular, the configuration of the webserver planted on the boxes defaults to Chinese language (Accept-Language: zh-cn), and the list of anti-virus update and forums which should be null routed clearly was built by someone considering Chinese anti-virus tools as the main ones which should be blocked.

---

This list updates the "hosts" table on the compromised computer, which prevents contact with the various anti-virus sites listed below.
127.0.0.1 www.360Safe.com
127.0.0.1 www.360.cn
127.0.0.1 bbs.360safe.com
127.0.0.1 baike.360.cn
127.0.0.1 kaba.360.cn
127.0.0.1 bbs.360.cn
127.0.0.1 360.cn
127.0.0.1 forum.ikaka.com
127.0.0.1 tool.ikaka.com
127.0.0.1 file.ikaka.com
127.0.0.1 update.ikaka.com
127.0.0.1 bbs.ikaka.com
127.0.0.1 bbs.janmeng.com
127.0.0.1 www.ikaka.com
127.0.0.1 forum.jiangmin.com
127.0.0.1 update.rising.com.cn
127.0.0.1 online.rising.com.cn
127.0.0.1 center.rising.com.cn
127.0.0.1 www.rising.com.cn
127.0.0.1 fw.rising.com.cn
127.0.0.1 csc.rising.com.cn
127.0.0.1 buy.rising.com.cn
127.0.0.1 sos.rising.com.cn
127.0.0.1 download.rising.com.cn
127.0.0.1 help.rising.com.cn
127.0.0.1 go.rising.com.cn
127.0.0.1 up.duba.net
127.0.0.1 bbs.duba.net
127.0.0.1 shadu.baidu.com
127.0.0.1 www.kztechs.com
127.0.0.1 security.symantec.com
127.0.0.1 shadu.duba.net
127.0.0.1 online.jiangmin.com
127.0.0.1 cn.mcafee.com
127.0.0.1 bbs.mcafeefans.com
127.0.0.1 mcafeefans.com
127.0.0.1 www.ahn.com.cn
127.0.0.1 www.kaspersky.com.cn
127.0.0.1 www.kaspersky.com
127.0.0.1 www.pcav.cn
127.0.0.1 www.vrv.com.cn
127.0.0.1 bbs.sucop.com
127.0.0.1 www.sucop.com
127.0.0.1 sucop.com
127.0.0.1 bbs.cpcw.com
127.0.0.1 www.shudoo.com
127.0.0.1 alert.rising.com.cn
127.0.0.1 www.dswlab.com
127.0.0.1 dswlab.com
127.0.0.1 bbs.dswlab.com
127.0.0.1 zhidao.ikaka.com
127.0.0.1 bbs.kafan.cn
127.0.0.1 bbs.kaspersky.com.cn
127.0.0.1 www.trendmicro.com.cn
127.0.0.1 bbs.trendmicro.com.cn
127.0.0.1 cn.trendmicro.com
127.0.0.1 www.kpfans.com
127.0.0.1 kpfans.com
127.0.0.1 www.mcafee.com
127.0.0.1 dnl-cn1.kaspersky-labs.com
127.0.0.1 dnl-cn2.kaspersky-labs.com
127.0.0.1 dnl-cn3.kaspersky-labs.com
127.0.0.1 dnl-cn4.kaspersky-labs.com
127.0.0.1 dnl-cn5.kaspersky-labs.com
127.0.0.1 dnl-cn6.kaspersky-labs.com
127.0.0.1 dnl-cn7.kaspersky-labs.com
127.0.0.1 dnl-cn8.kaspersky-labs.com
127.0.0.1 dnl-cn9.kaspersky-labs.com
127.0.0.1 dnl-cn10.kaspersky-labs.com
127.0.0.1 dnl-cn11.kaspersky-labs.com
127.0.0.1 dnl-cn12.kaspersky-labs.com
127.0.0.1 dnl-cn13.kaspersky-labs.com
127.0.0.1 dnl-cn14.kaspersky-labs.com
127.0.0.1 dnl-cn15.kaspersky-labs.com
(many other Kaspersky sites listed are omitted here).

---

Knowing that the origins of the virus were probably Chinese, we started looking to our Chinese friends for help understanding the malware.

Here's an October 2, 2008 posting on duba.net that gives samples of the DDOS Configuration Script, and uses the same name for the malware found on the August link above ( vv1dap32.exe ). This is NOT THE WORM, but is rather referring to the DDOS engine which is being loaded by the worm-infected computers.

In that earlier DDOS program, the updated malware was loaded from "ushealthmart.com". That malware is still available (webcc.exe) and still very unlikely to be detected according to Virus Total, who shows only a 6 of 36 detection rate for the earlier worm, which they have seen reported since October 7th.

F-Secure 8.0.14332.0 2008.11.03 Worm:W32/AutoRun.JF
Kaspersky 7.0.0.125 2008.11.03 Worm.Win32.Downloader.wo
NOD32 3579 2008.11.03 Win32/KernelBot.AA
Panda 9.0.0.4 2008.11.03 Suspicious file
Sophos 4.35.0 2008.11.03 Troj/Agent-ICY
Symantec 10 2008.11.03 W32.Kernelbot.A

Some strings found in the current malware may help with identification of an author, or at least an authoring host:

e:\work\supermj\drivers\360antirk\objfre_w2K_x86\i386\360IceBreaker.pdb

d:\Works\KernelBots_Up28\Server\Release\Server.pdb