PornoSecurity

Scary monsters (and super creeps)

Posted on 2010-03-03 11:44:53 in PornoSecurity

Hey there, I bet you tought I was dead, don't you? Truth is, again, I'm alive and kicking :>

Since I've been monitoring the SpyEye for a while now, I wanna tell you and show you something.
The toolkit, ready to be bought by cybercriminals all over the world, was discovered in obscure underground forums(it's the black scary market, baby!) early last month by Symantec and Others(tm) taking advantage of their worldwide intellingence gathering systems, of some covert operations..... you know, stuff like that:


SpyEye is actually very similar to Zeus: they share the majority of the functionalities, expose pretty much the same behaviour, and take advantage of the same mechanisms(http for communication, encrypted configuration, kewl web panel etc). SpyEye has some missing features like a ring0 rootkit for example(but you bet it will be added if the toolkit is gonna be popular) and some minor problems.. it still looks pretty young. One of the low-level distinctive signs I found of the spyEye droppers is the following schema used for api calls as well as the use(and hooking) of the LoadrDllLoad function.


The bootstrap configuration file of SpyEye is often brought you by the dropper itself, it is embedded as a PE resource and it is actually an encrypted zip. Just like with Zeus the decryption key can be found within the code but since the code is not obfuscated there's no need to let the dropper run(that is, infect a VM) to extract the plain-text. In the last days I have been monitoring a couple of SpyEye C&C and looking at the number of zombies starting from near-to-zero and increasing day by day. The image below shows the geographic distribution of a growing botnet I am monitoring:




What's the sexy thing in here? Well, look at the picture: blue points are SpyEye infected zombies, red points instead are sandboxes all over the world trying to analyze SpyEye samples ;)

Nick