Irregular Expressions » malware analyzing

What Is The Gauss Payload?

Dan O'Connor — Mon, 27 Aug 2012 03:49:58 +0000

If you have not seen this yet, Gauss is something that appears to have come out of the same labs or workshop as Flame and Stuxnet. This specifically seems to be targeted against the financial industry in the middle east.

Here is a Guardian article with some excellent information;
http://www.guardian.co.uk/technology/2012/aug/09/stuxnet-gauss-virus-kaspersky

Kaspersky is still actively working on figuring out the payload, and strangly they are asking for assistance.

https://www.securelist.com/en/blog/208193781/The_Mystery_of_the_Encrypted_Gauss_Payload

If you have the interest and capabilities you can contact them at the above site and get involved. Very very interesting just to get caught up on the current suspicions of what they think is going on.

Paypai.com

Dan O'Connor — Tue, 21 Aug 2012 05:35:29 +0000

I picked up another similar listener to the Groupon one the other day. This again is an attached ZIP file with an exe inside.

It says its from paypai.com depending on your font the i will look like a L.

The exe looks like it has been reused but I don’t see any mention of it’s original file name. The original name appears to have been stickiestfilm.exe md5 42bbb627d3bcc12745e8a6fbd4b2c825.

It also appears to have been used in several other campaigns according to it’s technical data.

https://www.virustotal.com/file/a9cbb0ac7ce189f4340fd23f295b118b28d74709c47205fed58c464e0ffcd942/analysis/

So far the only behavior I have seen is that it opens a command shell on local port 8000 TCP and awaits incoming connections. I did not see it send any out bound packets of yet.

Next is some source analysis.

Simple Malware Analyzing

Dan O'Connor — Wed, 20 Oct 2010 02:08:55 +0000

http://securitytube.net/Simple-Malware-Analyzing-video.aspx

Excellent video, short and to the point with a good list of tools to get you started if you are interested in this kind of thing.

If you do this, it’s better to do this with a physical machine and not a virtual machine. Many malware will detect if it’s in a VM or not and change what it’s doing. In the past I have used BartPE and ImageXML to take and restore my images, ImageXML can take a image of a running machin using VSS so that can save you one reboot.