The Dark Visitor

The most loyal TDV readers may remember a post from a while back showing some Google searches that turned up more than one hundred Chinese .gov sites with malicious links or defacements.  It appears that there are a few more to add to the list as of late.  One of the Chinese malware blogs that I follow posted a string of blog posts indicating that .gov sites were gettting compromised and having malware embedded in them.

www.sxfc.gov.cn, www.lfzs.gov.cn and a few non-.gov sites had very similar malware links embedded in them.  At the time of this writing, many of the links embedded in the sites are broken but some of the malware is still there for the wget’ing.

After a few redirects, we get to a1.css, which is an FSG packed PE file.  It is well detected by antivirus (38/39 on virustotal.com).  Nothing too interesting.

The Chinese malware that I have come across is either not packed at all or uses well-known packers like UPX and FSG.  What have you TDV readers come across?  Any custom packers?

On the 21st, Rising Anti-Virus issued a security alert to web users that hackers had installed a trojan on the popular ticketing website piaocn.com.  The virus was located on the http://####.706sese.Cn server.  Users, visiting the website to book tickets, could possibly have the malicious software downloaded onto their computer and lose internet game, online banking or QQ account numbers.

The http://####.706sese.Cn website was ranked the number one offender for spreading malware.  In the last week, it had attacked 1.44 million people.

The Rising malicious website monitoring network showed that there had been a recent increase in the number of trojan infected and phishing websites.  On the 20th, Rising’s “cloud security” system had intercepted 6.83 million web users visiting infected websites.  It was highly likely that these people had downloaded trojans and online game stealing trojans.

A Rising security expert said that presently, ticket sales and movie download sites are the primary targets of hackers to install malicious software and that they contained over 80% of all trojans.

Rising reminded users that hackers were especially activity during holidays such as New Year, Chinese New Year, Christmas…etc, when people are getting tickets home, shopping,  and downloading movies.

ChinaByte just released an article on commonly used “Security Software” that is domestically produced:

1) 溯雪 (Snow Trace) – Password decoder
2) 乱刀 (Chaotic Knife) – Password analyzer for UNIX
3) 天网 (Sky Net) – Firewall approved by Ministry of Public Security
4) 冰河 (Glacier) – Trojan developed by Huang Xin
5) 小分析家 (Little Analyst) – Monitoring software sniffer similar to NetXray
6) 快速搜索 (Fast Search) – Port scanner with multiple thread search

Trojan Horse

So the Analyt’s Diary blog at viruslist.com has an article on some new mass SQL injection attack that jacks up .asp pages with redirects to browser exploits. The exploits drop one of two trojans that steal passwords and whatnot. Here is h.js:

document.write(“”);
document.write(“”);

Wordpress won’t display the script. Basically, it loads an iframe that points to two separate URLS (these URLs contain browser exploits so don’t follow them):

hxxp://vvexe.com/haha/index.html and
hxxp://www.kenya.com/faq.htm

I can’t seem to get to either of these sites at the moment. I’ll try again later.

Update:  I spent some time looking at this malware.  The two pages listed earlier in this post contain iframes to browser plug-in exploits for real player and other typical vulnerabilities.  The exploits attempt to load and run down.exe (e160f590d894a98474697ac0db987746 not packed/delphi code) which in turn downloads hxxp://www.vvexe.com/haha/down.txt to get the additional files 1.exe (a7fc8c966fdeb550fe19aba3169569be not packed/VC++), do.exe (5af5edaa2cebf1fed56ad36799b2c850 ) and cool.exe (18867d6de1a3a9241c14c22c19b51351 not packed/delphi).

1.exe is a WoW trojan and waits for passwords sent to:

grunt.wowchina.com and [kr|us|tw|eu].[version|logon].worldofwarcraft.com.  It also looks for and attempts to disable many types of security software.  It attempts to send the stolen credentials to an asp on www.yilu777.com.

do.exe is a little more interesting.  It appears to be a generic remote access trojan that sends a beacon to qq number 58836533.  A quick search for that qq number revealed that this person’s paipai account has been frozen:

So I do some more digging and find the QQ profile with a name and nick:

Searching for the nickname got me to a few blogs and profiles that had some young girl who is really into anime. Maybe her QQ account got pwn3d or maybe, just maybe she is a member of “China Girl Security”. I tried to get an add on that QQ account so I could talk to the hacker but didn’t have any luck.

Note to Chinese hackers: Please pay the tax on your WoW gold profits.

Breaking news is that the International Space Station has been infected by the W32.Gammima.AG trojan. The trojan is also referred to as the kavo.exe virus and is designed to gather information on ten online games:

ZhengTu
Wanmi Shijie or Perfect World
Dekaron Siwan Mojie
HuangYi Online
Rexue Jianghu
ROHAN
Seal Online
Maple Story
R2 (Reign of Revolution)
Talesweaver

Not familiar with all the games but most are Chinese or Korean. Chinese hackers specialize in stealing online gaming information. Symantec also offers up this bit in its writeup:

The worm ends the Matrix Password process if it finds a dialog box with the following characteristics:
Title: MatrixPasswordDlg
Message: Warning! (In Chinese characters)

Will check more into the origin of this malware later today but all indicators suggest that it could be Chinese.

Hat-Tip: Benny

Oliver Day is guest posting over at Blogs.zdnet.com and has an interesting article on research into malware infections inside China. He discusses the data and the difficulty in making an accurate analysis of what that information means:

The percent of infections claiming to be from China are not an absolute measure and it is safe to assume that there are not only registrations originating from China claiming to be from other countries but also registrations from outside the country claiming to be Chinese. One of the general assumptions I’ve operated under is that the majority of the infections we see are not operated by those who profit from the infections.

Read more about infected Chinese sites here…

One thing that has always interested me is the types of targets Chinese hackers seek out for attack. Since it is impossible for us to protect everything, or be everywhere, understanding the most likely targets should be a high priority. Of course this is only part of a comprehensive cyber security program but knowing how your adversary thinks is one area we need to explore.

An article in pchome.net gave the five most desired websites Chinese hackers sought out in order to hang trojans. Trojans have been the tool of choice for Chinese hackers since their first indigenously produced program Glacier was introduced into the cyber conflict with Taiwan in 1999.

According to pchome.net, these were the preferred websites:

1)

Government websites

: Government sites are chosen due to low-level security and the lack of specially trained security personnel. They do not bring financial gain but have the potential to influence public opinion. This type of attack “challenges authority” and brings about personal satisfaction for the hacker. A successful attack on a government website provides the attacker with recognition and fame.

2)

Medium and Small-Scale company websites

: Similar to government websites due to the lack of security. While these types of attacks to not bring about fame for the hacker, they are very good practice for the novice.

3)

Community websites

: Huge number of visitors, even if the trojan is only around for a short period of time, it can result in a large number of infected visitors. Although the value of the individual users is not as great as a financial website, the collective of infected users can be used to create a botnet. Furthermore, this allows the hacker to steal virtual game assets and QQ (ICQ) money.

4)

Financial websites

: This type of website does not have a larger number of users but the average individual has a high net worth. If a hacker is able to install a trojan here, they can gain user account passwords, access bank accounts and control stock securities. Although this type of website has very high security, it is the most desirable.

5)

E-commerce sites

: These website share the benefits of both community and financial websites and are the most lucrative. Hackers are able to manipulate price, supply/demand and control the online transactions. Furthermore, they can use trusted user accounts to construct phishing “activities.” E-commerce website are the most favored for hackers to carry out phishing exploits.

Army lessons learned: First rule in the Army is never present a problem without a solution. Solution, hire people like Jumper who are experts in preventing these types of attacks.

People often ask me if I am worried about this website getting hacked or shutdown by Chinese hackers…I tell them no, I have an excellent firewall…called Jumper.

According to HC360.com, with the end of Chinese college entrance exams (高考) and the start of registration, parents and students need to protect their online information from hackers.  The warning explains that while the internet contains a lot of relevant information about registration, it also has risks.

Digital Security Laboratories (sucop.com) is reminding parents of the students taking the exams to increase their vigilance and prevent incidents with hackers before they occur.  They list several methods the hackers commonly use to get information from the students:

1) The underground hacker industrial chain uses information on the college entrance examination in order to disseminate trojans and viruses.  The article further explains that this element of the underground economy is already in place and fully developed.   People engaged in this type of activity are highly adept at using social engineering to manipulate large-scale events such as the Olympics, disasters, entrance exams…etc. They used the information collected from online users for their own financial benefit.

2)  The underground transaction website: Online registration is now very common and some websites publicly advertise that the can alter student records, household registration and achievements.  This is just a way to cheat parents and students out of their money.

3) Some phishing websites are even a greater danger:  The hackers use these phishing websites to post false information and disrupt the registration process of the college.  They also solicit enrollment expenses from the students that do not exist.  Furthermore, they also use the site, combined with the methods mentioned above to get the student information to resell.  Hacker have also used loopholes in the college registration sites to blackmailed students by tampering with the data they entered on the online form.

New Chinese hacker program making the rounds called Chinese Vampire v2.2.1 (starving anti-virus) billed as a trojan downloader tool, ARP attack, QQ tail…etc. The screenshot below shows the downloader interface:

From what I have read about the tool, it is very effective. So effective in fact, that another Chinese hacker calling himself Sadness, from the Black Wolf hacker group, stole it. Yes, he did. Look at the trackback URLs associated with this screenshot compared to the one above (circled in red). Notice that our thief has changed it to the Black Wolf website instead of the www.9u9u9.cn address.

The true author of Vampire v2.2.1 runs the website pictured below and calls himself SKSgod…sigh. He was really unhappy with the theft of his property and posted a pretty nasty response to Sadness. Yeah, hacker on hacker violence doesn’t concern me in the least.

Now the truly exciting part of this post, there is also a female hacker involved in the marketing of this fine product named Jiajia (佳佳). Hmmm, you say…that name sounds familiar? Well it should! It is the same name as one of the members of the Six Golden Flowers.

Jiajia of the Six Golden Flowers

Is the same Jiajia? I don’t think it is but not sure. On her blog, this Jiajia claims that due to the controversy over the stolen program, there are only two legitimate sites to download Vampire v2.2.1. One is her site and the other at SKSgod’s. Yes, there was a picture associated with Jiajia’s website:

Now this girl certainly doesn’t look like Jiajia number one and she appears to be a bit younger. Also, the characters next to the picture said “Sleepless Night.” Hell, this could be the picture off an album cover (and yes I did try to see if I could find a record called Sleepless Night) for all I know. She may just be the Brittany Spears of China. Thought I would include it anyway…sue me.

Dear Chinese hacker master,

Sadly, I have all these compromised computers just laying around the place and don’t know what do with them, could you please help?!?

- Confucius…sed amateur

Dear Confused,

No need to be embarrassed, we have all experienced this dilemma at one time or another. Let me offer a few simple solutions to this common problem:

1. Steal virtual property from the compromised computer. Take their game account ID, QQ number and Q money.
2. Steal real property from the compromised computer. Real property can consist of bank accounts or online stock speculator account numbers. There are many types of trojans designed specifically for getting the account numbers of online stock speculators.
3. Steal people’s private data. Remember, just like the Edison Chen photo scandal, regular people can be extorted too if you threaten to release their explicit photos on the internet. Use their private information that could be harmful to blackmail them. If you steal commercial data such as financial reports and personnel records it can be used for your illegal benefit. Also, you can attempt to control their webcam in order to fill the desires of peeping toms.
4. Use the victim’s connections to get illegal benefits. Perhaps you think your QQ number is insignificant, you don’t have QQ 秀 (unclear) or QQ money. Not so, your friends QQ numbers, your e-mail contacts and cellphone contacts are all targets for the attacker. The attacker can fake your identity to carry out all manner of illegal activity. Everyone’s personal connections have commercial worth. The most common example of this is the 12950 service that used groups of QQ numbers to send out trash/spam? information to steal money or the MSN virus that automatically sent out information to your friends to defraud them. NOTE: the 12590 service could refer to this: Optional service Game treasure box makes the mobile into a game machine. A mobile QQ can go anywhere, 12586 online entertainment (that has many strange old friends), 12590 interactive message service (that has various voice monsters), CRBT and MMS (that are full of fun, personalized ring tones and pictures that can be downloaded anytime)……your enjoyment with these features is endless!
5. Plant rogue software on the compromised computer. This will make it automatically click online advertising for profit. This can really effect your online experience as I suspect everyone hates online pop-up ads. After the attacker controls a lot of compromised computers, they can force out ads and obtain profits from the ad owners. The number one reason for rogue software flooding is that many companies purchase rogue software developers’ advertisements. Other attackers use the rear platform? to covertly click on advertisements in order to gain profits. This causes the ad owner to waste money through invalid clicks.
6. Use the compromised computer as a springboard (proxy server) to attack other computers. Any type of hacker attack can leave behind traces and in order to better conceal yourself, it is necessary to use many proxy jumps. The compromised computers can act as an agent and a scapegoat. The attacker can disseminate even more trojans and think of your computer as a downloading station. It is a possibility that network speed and performance will be improved with proxy servers.
7. The compromised computer is the foot soldier to launch DDOS attacks. DDOS attacks can earn money for internet gangs or cyberwarfare (those who engage in it) as some people will hire these internet goons who initiate conflicts. Internet gang members can carry out an attack directly against their target and then blackmail the victim. Compromised computers are a chess piece for internet gangs and DDOS attacks have become a poisonous cancer for the internet.

Yep, a little fun in the beginning with this post (I made it up)  but the rest is a real list of uses for compromised computers put out by Chinese hackers.

I swear I heard the sound of people flipping their webcams towards the ceiling after reading number 3.

UPDATE: Hat-Tip to Therese who sets me straight on the definition of QQ 秀:

QQ 秀 == QQ “Show”

It’s one of the things that you can spend QQB on. You purchase outfits and accessories to dress up your little avatar. It’s like putting on a show. Therese also provides a Flickr link to “patriotism QQ-Show.”

http://www.flickr.com/photos/keso/2421813915/