- Re: information and reverse engineering bits of the Mydoom worm
- Posted by Gadi Evron on January 28th, 2004
Nicolas Brulez posted a reply on alt.comp.security and comp.security.misc:
http://groups.google.com/groups?selm...&output=gplain
Gadi Evron.
- Posted by s&w@none.none on January 28th, 2004
On Thu, 29 Jan 2004, Gadi Evron <ge@linuxbox.org> wrote:
ROT13?
well, I have one msg body that is ~2k. It looks to me like binary data, not
ROT13. Here's a small sample, from the beginning of one body:
z?ܵۘwhgi*
which is:
c0 7a 3f f7 90 f9 dc b5 da d2 fe db 98 77 f1 9e ...
maybe a programming error allows an index to point past an array of
strings. But then again, another starts off differently:
-z`*$݉iĐ'}h*C_!J<36*/ )8-9t
س%}\kܡvl(Nl
in addition, of the four of these that I have (they do resemble taiwan spam
they came in pairs. I.e., each member of the pair was identical to the
other, and had the same timestamp. And they all originated from dialin.net.
If the infected computer is on dialup, it might have been the same one
during two different sessions.
- Posted by Tim H. on January 29th, 2004
<s&w@none.none> wrote in message
news:20040128233122.3DC47FA869@bingo.bananasplit.i nfo...
On Thu, 29 Jan 2004, Gadi Evron <ge@linuxbox.org> wrote:
The actual virus is 22.5KB. Also, it's compressed with UPX so the raw ROT-13
won't be available until you decompress it. Nicolas' script makes converting
it dead easy!
-Tim
- Posted by Markus Zingg on January 29th, 2004
On Thu, 29 Jan 2004 00:34:21 +0200, Gadi Evron <ge@linuxbox.org>
wrote:
Hmm, I think we are not talking about the same thing. I therefore
thought it's best to show some raw text of an example of the e-mail.
The message text part - not the binary attachement - is what I'm
talking about and in all other variants the message text in fact
contains the strings as seen in the disasembly. I do more tend to
agree with another poster here that the worm - either intentionally or
due to a bug - uses some parts of itself as text which gives the
apearance. Note that there are different variants of this floating
around. I'm basically searching for some easy to catch pattern for
this thing...
Markus
<----- cut here ------>
Return-Path: <xxxxx@xxxxxxxx.com> <- I munged this address
Received: from pirinenc.com ([81.44.90.119])
by nct.ch ([192.168.174.25]) with ESMTP
id 000044d0-16-021bd7c4; Thu, 29 Jan 2004 08:28:25 +0100
From: xxxxx@xxxxxxxx.com
To: m.zingg@nct.ch
Subject: Mail Delivery System
Date: Thu, 29 Jan 2004 08:27:26 +0100
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0004_9A71E5F3.39963C16"
X-Priority: 3
X-MSMail-Priority: Normal
This is a multi-part message in MIME format.
------=_NextPart_000_0004_9A71E5F3.39963C16
Content-Type: text/plain;
charset="Windows-1252"
Content-Transfer-Encoding: 7bit
(4\?f
&܅hejJ3q#lIr
o.Ѥ}JqBei
q4R
V:uVkl?*h8ųAik'e54x(|ϸ0q(e. ^v|
&YK?3t10?;Ў31PU%yVe/_XAG$NJ7DT)YVaC^I/y<74\Z*HPyR{|\_uA_rd?z]h
[l?ITZqh&\{'`TW1?\#tZ5tyACYK [fЃ!W??N~p?X3zfP`!cemi^Nˉߞ B[?Syʎu*dCSNܼQ?Y5LrD_w~mc
*O\ٓH NoKΰP*Z|ֽ`;/>,1dZ]h?
c?!YR^ܲanjgrF
(gă ܯ-MK{>"*EUAk۾vm?R^o:Yѽ,(.$ |
_
ڹ?nƔF5/DԌGw?5vAjPEkϓ9fV%f8U2q2
1Zy|uڪ>a9}????*f5wL*5
b/.q*X:'I$MgS9Qx6y
Rʰ?
J*A$7鰩Ia-?83%Nn|[[**7F<
({,"2qPXGl*
g5e!#u*.coG\[*#f(sP#IСNRN;K
:IedY*Q&H~??En{вv)X/gĵT-?.,%7isUnitxM2AΈ
-:jB`:??9Ro\*ZmUJ9ԳG04U!qV
*ANi#(|*nD5~c],9L"mv0?-`RtA"3XŹ?kaV|FH*&\i*xR
^Jl?;m(ԋ'j<f9/4
*#~#wfPKjDO*&Xk*
dzx8⯢2ě֥Je
?lQef iM-Y}YN2vR2аlVOGu*<h(PV%*%zG*
~';%fFwjꓛ?Y}
ZĔ6(q
9(GYLV7rcFV69Ѥ1^TY#
j!EiGX1;׆rM/nB*vw$^hDcvd;khr
P qk?>
LЛk%^{Ӊ6ÇBm"W
˫"xw|'DWɓ
s];b)Ghdߣ?3I6`2iF'Q\(3H?}j?? $<*d|Ѩg/?M#Ϯw&M\?Xt&?p{MZ[;'x
&YFv^"Qˊl%w}y$ί{Bϑ
[^k{qUpcRiѱO&:Qs
(z-R*L!,t>mֿ'xkq*Lvd0<}ڌ?y~5m:nB 1(l""^
l?(?忓b(L???ŞD?VDa,m*p;(a
̇2G<FUL
71d7$?g(-7~.0nPv鸖i<kR4ʋ*̕ӪEp ;\0'5;tU
-hQ
Op~
뢲>A㡊inX?Ȗȥw|#$W(Pu
NWpL2 `ȶ~XNbC%3:&`e
l/֙%rZ(E!I??Egsig3HRs{E9_NW?K* qBQ_\EAe8rA|QloS#X.
&!|i J.}φ/{{VY
x?QK??9 ~;*?gW0p:[p2{T
^UFa*Ip0j?HSHo8Xq:`V?d8RD 5q-2)3PTma94I]w˳J즿?
{YxHa?|c`|'`AiqnaR{d
/:c6m(ElƄB1sǘ^cY7^4a8|1 (1?wjdF1$X\T}`
*|sr䓲T(?q;I86#٧&p
------=_NextPart_000_0004_9A71E5F3.39963C16
Content-Type: application/octet-stream;
name="doc.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="doc.zip"
<----- cut here ------>
Note, below here follows the real payload of the worm, so what you see
above is the TEXT area of the mail.
Hope this cleared things up...
Markus
- Posted by s&w@none.none on January 29th, 2004
On Thu, 29 Jan 2004, "Tim H." <tekphobia@comcast.net> wrote:
What we have here is a failure to communicate, even after repeated clear
attempts by myself and M. Zingg. Perhaps others feel that their knowledge
is so superior that they don't have to listen, only expound. Perhaps
related to why this group was trimmed from the original newsgroups by
somebody. But then you miss out on some curious info.
WE ARE TALKING ABOUT THE MSG BODY. Not the attached worm.
Well, pardon what seems like an angry outburst. The content is real but the
tone is in fun
But one more time: instead of the msg body saying something like, "The
message contains Unicode characters...", it instead has ~2k of seeming
nonsensical characters. This, together with the fact that mine came in
pairs, makes me think it is a slipup in the coding.
- Posted by Markus Zingg on January 29th, 2004
From looking at the headers, in all cases where it arrived here in
pairs so far went back to the fact that the worm was sent to the
backup MX and the master MX entry of our domain. I figure that's the
reason but of course could be wrong. I otherwise agree thogh that it
COULD be binary information from either the worm code itself or from
anyhwere else in the process space of the infected machine. Again, my
limited knownleage of asian languages don't allow to judge wether it
might be some real text or if it's really just garbage. I also would
be highly interested to know if there are repeated and ending patterns
used or (worst case) if it's really just random data.
Markus
- Posted by s&w@none.none on January 29th, 2004
On Thu, 29 Jan 2004, Markus Zingg <m.zingg@nct.ch> wrote:
well, now that I look more closely, most or all have arrived in pairs. The
receiving MX, though, is the same for each member of the pair. I've seen
discussion somewhere about the worm guessing the prefix for the MX name
(e.g., mail.xyz.net) but in my case the prefix is very uncommon, so it must
be doing real lookups for MX records.
also, fwiw, here are pastings of my two (just simply copied from the mail
viewer). When I created a file and ran a disassembler on it, nothing real
turned up - which would be the case, not knowing the offset.
case 1
z?ܵۘwhgi*
ɨ
zB6`nLo'Ɗ6ffg$T%0fρ!3ۓ Dh
,ki1"\\5_ë3y*Bi2&rnN|b (Jjd*hj}vн[HWx
,$Bц;$I/[_f#]]xAW
&DC͜gV'_$8̶dӆ^a6-̋s!%QQNrL
?׃/,5yffC52H*)j5h؋ڍjɟCOn*낲 đEE9
FEh_˞CYpSGuSH
K.ZfG{wcPb{wb^'Inܡ*Ve?A
XZB?eԓ`[Wнoҵ]BoJ1wQSn;3*H*u]-
CGL!/s>Gb.{"4aޏքe3VV>^G(HQV .GBU
(f5^{
&7
Ew.
z*b84.ggQ䆎p(gT5[u%ȉqCP3>
G,zC?:Z-So{'l:"LU
'5Es<ͺe(6~$w;|o`I,&n*[2z{o[J?!;
[b;~ދrbn
|n)'\
5ܵcBU'Y;sށS5CZy?dK9c "~U읾_3|e_%"Tq
7ޚjI6ef6~*҃La6-ĮaEt~M7PWũ
fn k5{>]ه~&׳E4lSWS\*n"8r~]^bIh
o!ġVc2s<_Ow
*ur)fCAE]bm:%!7sU1T$}3N!Ǘ[kɝz[AwI*-Ov
*i
"I?x'dX#I;IZ<r;~0tV56iwk!S04b& HÈ2
t\MO;`>\)KFJɩ̾APS]m2
FU6xh4g0ec1t
MRHj( E6*|q\^ԍar|:nB21^Ԑ\?,kHP E]-JY
ɃMцl|[lrY2.l1h_A
XN|Nvkb'p
eC2;5fþ_bT˥azh&~r(/x6k4VI4ofϙNгxJ#ƽ|f95
J>Y|[&M~eCxU_)F/>Gf?Bۅ)*1Y*iRgfOO*[<{%
k`2P7UJ0vQVtjFHL9ys)*
1
ZcWJ҈Ws/Yf*vLюB
OS,̨3Dz\QXʋNۍr!(ڣC$?!h&m DLLƋy5o1
0d4ۣWxav}/YK8)W_ݿ_k7*)PX\T
5v狿}
u`.mtXUXɏwSEq/K7'Cpas|Fo˩/-^$yf9qdD;
W
7vzI^љ*3JK"
Ј/jj[c2/Ծu2)ddKH'6߉$
5;^TyxYKZY<-(F(MŎ
N/jV_G,awhE|nhe
wj&M&}'(#/j)͢EsݮYX*9NĄpb[1я/>n4tqpiKz;kr
CLAORh*c,.
šXV)QYe
͎2TQ\]/kM"Ir'EPùte4[n5K 3gT> P
===================
case 2
-z`*$݉iĐ'}h*C_!J<36*/ )8-9t
س%}\kܡvl(Nl
ir'&YxW]*vbpm
_ĤŚGV`
BQ!B094bFOYy!|O{Jс;KJhUMQ>M6 `F̯?QiM1~M?)/
ldȝ\-/h#O^W[I3|wѲ>^gs-VAXy]cGppDUNe$\i;
O
[N .s|r82pyDdR8>>5gp#ڏԏ*̰{EL
^8z%m0kd}XL夝]QQ<d{8<|QG?ĥv7/j
\7jRCj1y)Wj
~z֍#XB8ۉԸTXҮ*0[z7kVĢ]dp^l]
`Vwn35C1ᑣdZ4Y?*x:d˥̶
ߓ]\F*_ǘ(HZāduh>Sw`M^qԷML
ReF;h)\J*ࣔERq!`w{
9bŹ,
JO<R3C$%#kJu7;;}C)Q/nU8h0gz"ƈ3]7xLVm:%v
ȓGHzO&WL3f2lh:y*{T^0,3`neǵ gěS&1X
/{"wTR\l_pG&ڂ}cBjUk>9OzW
lW}3R|`"**<
Y)r&\GQq[:h1ʾÝr#|#rϸMj3ᩥcyB2<Jn*SQi; ~J!
f{(E7*,-^.DŽ,ov.Jh!pۓmX?A,om*o$_Ղv$|%609
u
BUtM6
z:¬7G
^Hq}_cN*BH_,H^4y>ۉCZMa-3ƣ;(>XGqTՒDEs
q,1
<v5Ё*֖ͫݑ_iJɬ
{~F\u:^vNEv3&`
|JK9!R1Du$ݮ
- Posted by s&w@none.none on January 29th, 2004
so sorry, the M2N mangled it, as seen below
On 29 Jan 2004, s&w@none.none wrote:
