ユーザー向け情報

マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話
24時間体制サポート | テクニカルサポート利用方法

お問い合わせ履歴

電話する

+7 (495) 789-45-86

Profile

Trojan.Loader.896

Added to the Dr.Web virus database: 2021-11-03

Virus description added:

Packer: absent

Compilation date: 2020-14-10

  • SHA1 hash: ff82dcadb969307f93d73bbed1b1f46233da762f

Description

The backdoors downloader PlugX, is written in C.

Operating routine

After loading from the main module (msrers.exe) using the LoadLibraryW function, the Trojan loads the kernel32.dll library using the LoadLibraryA[/ string] and gets the address of the exported function GetModuleFileNameA:

#drweb

It then obtains the name of the main moduleusing the previously obtained function GetModuleFileNameA and checks if the name contains the substring "ers." (msrers.exe):

#drweb

From the hash 0xEF64A41E gets the function VirtualProtect to change the memory access rights to PAGE_EXECUTE_READWRITE at 0x416362 (msrers. exe):

#drweb

The following fragment will modify the code at 0x416362 (msrers.exe):


push 0xFFFFFFFF
push 0x100010B0 ; func_addr
ret

Place in the main module to be modified:

#drweb

Next, a function is called that receives the base kernel32.dll, as well as the addresses of the functions by hashes.

#drweb

Script to get a function by hash:


import pefile
 
ror = lambda val, r_bits, max_bits: \
    ((val & (2**max_bits-1)) >> r_bits%max_bits) | \
    (val << (max_bits-(r_bits%max_bits)) & (2**max_bits-1))
 
max_bits = 32
 
library_path_list = [...] # absolute path dlls
 
def get_func_addr(hash):
    for i in xrange(len(library_path_list)):
        library = library_path_list[i].split('\\')
        name_dll = library[len(library) - 1]
 
        pe = pefile.PE(library_path_list[i])
        for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
            func_name = exp.name
 
            hash_name_func = 0
            for j in func_name:
                hash_name_func = ord(j) + ror(hash_name_func, 0x07, max_bits)
 
            if (hash_name_func == hash):
                print '0x{:08x} -> {} -> {}'.format(hash, name_dll, exp.name)
                return          

Received features:

Function name Hash
VirtualProtect0xEF64A41E
GetLastError0x12F461BB
CloseHandle0xFF0D6657
ReadFile0x130F36B2
VirtualAlloc0x1EDE5967
GetFileSize0xAC0A138E
CreateFileA0x94E43293
lstrcat0x3E8F97C3
GetModuleFileNameA0xB4FFAFED

In the following, the following structure is used to call these functions:


struct api_addr {
    DWORD  (__stdcall *GetModuleFileNameA)(HMODULE, LPSTR, DWORD);
    LPSTR  (__stdcall *lstrcat)(LPSTR, LPCSTR);
    HANDLE (__stdcall *CreateFileA)(LPCSTR, DWORD, DWORD, LPSECURITY_ATTRIBUTES, DWORD, DWORD, HANDLE);
    DWORD  (__stdcall *GetFileSize)(HANDLE, LPDWORD);
    LPVOID (__stdcall *VirtualAlloc)(LPVOID, SIZE_T, DWORD, DWORD);
    BOOL   (__stdcall *ReadFile)(HANDLE, LPVOID, DWORD, LPDWORD, LPOVERLAPPED);
    BOOL   (__stdcall *CloseHandle)(HANDLE);
    DWORD  (__stdcall *GetLastError)();
};

Trojan takes the name dll (TmDbgLog.dll) and adds the ".TSC" extension to it. Next, it opens the file TmDbgLog.dll.TSC for reading and decrypts its contents, which turns out to be a shellcode.

After decrypting the shellcode (TmDbgLog.dll), the Trojan starts executing it:

#drweb

This is how the script for decrypting the shellcode looks like:


enc = bytearray(open('TmDbgLog.dll.TSC', 'rb').read())
 
dec = bytearray()
for i in xrange(len(enc)):
    dec.append(((enc[i] ^ 0xbb) - 1) & 0xff)
 
open('TmDbgLog.dll.TSC.dec', 'wb').write(dec)

Before decrypting and running the payload, the shellcode assembles the following structure:


struct st_mw {
  DWORD magic;
  DWORD *shell_base;
  DWORD shell_size;
  DWORD *enc_payload;
  DWORD enc_payload_size;
  DWORD *enc_config;
  DWORD enc_config_size;
  DWORD *payload_entry;
};

This is what the encrypted config looks like:

#drweb

The decryption of the config will be done directly in the payload:


import struct
 
enc = open('enc_cfg', 'rb').read()
key, = struct.unpack('I', enc[0:4])
 
key1 = key
key2 = key
key3 = key
 
dec = bytearray()
 
for i in xrange(len(enc)):
    key = (key + (key >> 3) - 0x11111111) & 0xFFFFFFFF
    key1 = (key1 + (key1 >> 5) - 0x22222222) & 0xFFFFFFFF
    key2 = (key2 + 0x33333333 - (key2 << 7)) & 0xFFFFFFFF
    key3 = (key3 + 0x44444444 - (key3 << 9)) & 0xFFFFFFFF
    dec.append(ord(enc[i]) ^ (key + key1 + key2 + key3) & 0xFF)
 
open('dec_cfg', 'wb').write(dec)

And it will look like this:

#drweb

Encrypted payload:

#drweb

Script to decrypt the payload:


import struct
import struct
 
enc = open('enc_payload', 'rb').read()
 
key, = struct.unpack('I', enc[0:4])
 
key1 = key
key2 = key
key3 = key
 
dec = bytearray()
 
for i in xrange(len(enc)):
    key = (key + (key >> 3) + 0x55555556) & 0xFFFFFFFF
    key1 = (key1 + (key1 >> 5) + 0x44444445) & 0xFFFFFFFF
    key2 = (key2 + 0xCCCCCCCC - (key2 << 7)) & 0xFFFFFFFF
    key3 = (key3 + 0xDDDDDDDD - (key3 << 9)) & 0xFFFFFFFF
    dec.append(ord(enc[i]) ^ (key + key1 + key2 + key3) & 0xFF)
 
d = bytes(dec)
 
uncompress_size, = struct.unpack('I', d[8:12])
 
buf_decompressed = ctypes.create_string_buffer(uncompress_size)
final_size = ctypes.c_ulong(0)
ctypes.windll.ntdll.RtlDecompressBuffer(2, buf_decompressed, ctypes.sizeof(buf_decompressed), ctypes.c_char_p(d[0x10:]), len(d), ctypes.byref(final_size))
 
open('dec_payload', 'wb').write(buf_decompressed)

After decrypting the payload, the shellcode transfers control to the trojan, with the previously assembled structure st_mw acting as one of the parameters:

#drweb

Further, trojan works in the same way as the backdoor BackDoor.PlugX.28.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

ロシアに本社を置く、『Dr.Webアンチウイルスソフトウェア』のデベロッパーです。
1992年に製品の開発をスタートしました。
Dr.Webは世界200ヶ国以上のユーザーに利用されています。
2007 年、アンチウウイルスサービス(SaaS)の提供が開始しました。
24時間体制サポート

Dr.Web © Doctor Web
2003 — 2022

Doctor Webは、ロシアに本社を置く、『Dr.Webアンチウイルスソフトウェア』のデベロッパーです。その製品の開発は1992年に始まりました。

株式会社Doctor Web Pacific 〒105-0003 東京都港区西新橋1-14-10 西新橋スタービル 2F