Anti Rootkit Blog

Frank Boldewin, a German IT security specialist has recently published a clear and concise analysis of Peacomm.C code, otherwise known as The Storm Worm, Nuwar or Zhelatin.

The Storm Worm has been hitting hard since Jan 2007 when it was unleashed as spammed emails duping users into following news about the large storms that were hitting Europe at the same time. The Storm Worm has resurfaced under many guises throughout the year. Coming up to Valentines Day millions of emails were spammed out duping the users into viewing a message from a loved one.

This code and underlining Rootkit has helped criminals setup a major Botnet comprising of captured zombie PC’s from all around the world. Most of these PC owners are oblivious to the fact that their PC is part of a Botnet and is in control of criminals intend in using it to make money for themselves.

Frank dissected the code after receiving a spammed out email which had a link to malware which when installed would have installed the Peacomm.C rootkit and the PC would become part of the botnet.

“On 22th August 2007 I received an email informing me about “New Member Confirmation”, including Confirmation Number, Login-ID and Login-Password. To stay secure I should immediately change my Login info on a provided website link. So I’ve started investigating what surprises are awaiting people clicking on such kind of links. Next to a friendly message telling me that my download should start in some seconds, I also got a browser exploit for free, to ensure the “software package” gets really shipped. “Hey that’s cool”, I thought by myself. “It’s like Kinder Surprise® - three in one!” Unfortunately, at this time I hadn’t enough incentive for a deep analysis and so I just stored the malicious file called applet.exe in my archive for later fun with it.”

Frank goes into some depth in his analysis including topics such as:

• First stage XOR decrypter
• Second stage TEA decrypter
• TIBS Unpacker
• Anti-Debugging code
• Files dropping
• The driver-code infection
• Finding the OEP to the native Peacomm code
• Finding and patching the VM-detection tricks
• SSDT file hiding
• Shellcode injection for process spawning
• System files locking

This excellent in-depth analysis in PDF format along with the Peacomm.C binaries can be downloaded from Frank’s site www.reconstructer.org.

A html version is available from antirootkit.com

Have fun, enjoy the read and be cautious with the binaries.

regards

Steo
www.antirootkit.com

This entry was posted on Sunday, October 21st, 2007 at 8:05 pm and is filed under News, E-Cards, wincom32, peacomm, Analysis, Nuwar, Storm Worm. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.