Report - CrySyS Lab

5.3 Modules found on planetanews.org
The modules found on the servers planetanews.org and politnews.org are generally old, they most
likely belong to older campaigns. The files are generally stored in files with “.txt” extension in ASCIIhexadecimal
format extended with command tags. An example is shown below:
[DATA]
4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000
0CCCCCCCCCCE966000000E996000000E970020000E9CB000000E92F020000E90E010000E9C70200
…
00000000000000
[/DATA]
[EXT]
c:\sys.exe
Figure 40– Executable file format in .txt files found on planetanews and politnews
As one can see, the hex string begins with 4D5A, which is the equivalent of “MZ”, so no extra
encryption is in place.
Most likely these modules are deciphered and used by C&C communication tools, like the sample
b0b59e2569fb1de00f76a8d234d2088a described below.
Some of the modules are found in raw hex-ascii files like:
4D5A90000300000004000000FFFF0000B80...
ode.txt
Figure 41– Executable file format in .txt files found on politnews – without tags – ct.txt
hash: 5c03228a7f9149b07fc7316d68119342
compile time: 2009-08-04
This module saves the list of running processes and the content of the “\windows\system32\wbem”
folder into the file “C:\sysdll12.txt”
ct.txt
hash: BA7F9A2CEC106773D17DF4F571B4B8E8
compile time: 2009-08-11
This module uses the GetTcpTable call and saves the list of active TCP connections and their status
into the file “C:\\sysdll9.txt”.
34