This fake codec installer uses the nullsoft installer package. The first thing it does after it is run, is extract "step1.exe" (~8KB) and "step2.exe" (~63KB) to the temp folder, then it executes them. "step1.exe" sets the computer's dns servers to 85.255.116.147 and 85.255.112.211, then flushes the dns cache. All dns resolution is now done through these hostile dns servers. "step2.exe" is a usermode rootkit, it copies itself to "c:\windows\system\kdekc.exe", then sets itself to run via the HKLM run key (entry is named "kdekc.exe"). The (usermode, via code injection) rootkit hides files, folders, and registry keys who's names contain "kdekc.exe". It does not hide processes, the hidden files/folders/keys are still accessible provided you know the exact name, "c:\windows\system\kdekc.exe" is locked. The injected code randomly redirects searches and other web browsing to advertising sites.

After "step2.exe" exits, the installer deletes "step1.exe" and "step2.exe" from the temp folder, and then displays the EULA (see below). The only thing accepting the EULA (the acceptance/rejection of which has no effect on the changes to the dns settings or the rootkit/advertising code) does is copy "Uninstaller.exe" to "c:\program files\VideoAccess\". This uninstaller's only function when run is to delete itself and the folder it is in.


EULA (void due to malicious/hostile code)
note typos in blue
things that are just bad in red
That's kinda hard considering the only persistent program (excluding the "uninstaller") is hidden by a rootkit.


No site of theirs with any kind of video content appears to exist.


The fake codec now (after its malware payload is already delivered) admits that it is not even remotely connected to decoding video.


Now they reserve the right to essentially install any software (malware) from any third party they feel like. The "main" software (or at least the only software they install, I guess that makes it main) was installed before the EULA was even displayed, so how can you decline?


Also note that they must change sites/names so often that they don't even mention a company name, product name, or website in their EULA.

Other (unmentioned) IPs connected to by the malware: 85.255.115.245, 85.255.117.108
Seems like blocking access to the IP range 85.255.112.0 - 85.255.127.255 wouldn't be a bad idea (haven't seen anything in that range that would be bad to block).

On a windows 98SE system the rootkit hooks the following functions by inserting a jump to the rootkit code:

ADVAPI32.RegEnumKeyA
ADVAPI32.RegEnumKeyExA
ADVAPI32.RegEnumValueA
ADVAPI32.RegEnumValueW
KERNEL32.CreateProcessA
KERNEL32.CreateProcessW
KERNEL32.FindFirstFileA
KERNEL32.FindNextFileA
KERNEL32.HeapSetFlags
KERNEL32.lstrcmpiW

Here is an example of one of the functions that the rootkit hooks:
blue is what the rootkit overwrites with the jump
ADVAPI32.RegEnumKeyA, unmodified



red is what the rootkit changes it to (a jump to the rootkit code)
ADVAPI32.RegEnumKeyA, modified

The malware calls home with http connections, but all the content of that communication is transmitted by altering UserAgent,
Referer, and other http headers which are non-critical to the connection.

I have attached a list of interesting strings that I extracted from the malware while it was active in memory (as opposed to on
disk, where it is packed) (attached)
strings.txt


Did anyone find this analysis interesting? Is there anything else anyone wants me to try to check? What do you think about the
fact that this program is installed before the EULA is even displayed, and that the uninstaller doesn't remove any of these
changes to the system?


Some other things to note (for people who help remove malware), the only changes visible the HJT log from this malware is that
the DNS servers are changed to 85.255.116.147 and 85.255.112.211. Other symptoms to note are redirects when clicking on
search results, and popup ads from ad-free sites.

Thank you for submitting such a detailed analysis. The usermode rootkit you mention is called "kedr". If you look towards the end of the list of strings you uploaded, you can see information from the file's export table. The original file name was "kedr_ver0.02.exe", and the next four strings are the names of functions it exports.

If you plan to submit reports in the future, please perform the analysis on Windows XP or newer. This is because most new malware have features that require a new operating system. If the malware is ran on an old version of Windows, these features might never be activated and thus go unnoticed. But just to reiterate, thank you for contributing.

Best regards

Yea, I noticed that string, but I didn't find much mention of it anywhere.

I don't have an xp test machine available at the moment (perhaps I will at some point). Really I hadn't planned to make it into a full test machine, but it just got so interesting once I got started that I kept going with it.

Just an minor update about the newest version, they have stopped using "step1.exe" and "step2.exe" as the dropped file name, they are now using "pdyq.exe" as the dns changer, and "mdqj.exe" as the rookit/search result redirector, which are still dropped to the temp folder and run, then deleted. The dns changer doesn't persist, the rootkit copies itself with a random (usually 5 letter) name to the %system% folder before it is deleted from the temp folder.

I have found 3 address range groups which are closely connected to the fake codec websites, the first one was added to my firewall's blocked list when I found it was full of fake codec sites (and nothing else), the other 2 range groups were already on my list from quite a while back and triggered a number of time while researching the fake codec trojan (from trojan access attempts and attempting to access fake codec mirror sites). It seems like a good idea to block these ranges on any internet access you are in charge of, be sure to set your firewall [or any firewall-using device] to log any hits on this rule so that if it is hit during typical daily computer use you can investigate and report back what site/IP you found.

Here are my firewall rules I mentioned:


fake codec source, bad dns; 85.255.112.0 - 85.255.127.255

InterCage Inc; 69.50.160.0 - 69.50.191.255
InterCage Inc; 69.31.64.0 - 69.31.79.255
InterCage Inc; 69.22.162.0 - 69.22.163.255
InterCage Inc; 69.22.168.0 - 69.22.175.255
InterCage Inc; 69.22.184.0 - 69.22.184.255
InterCage Inc; 216.255.176.0 - 216.255.191.255

Cernel, Inc; 64.28.176.0 - 64.28.191.255


Webair no-longer provides serivce to the fake codec makers
Webair Internet Development Inc; 216.130.160.0 - 216.130.191.255
Webair Internet Development Inc; 69.42.64.0 - 69.42.95.255
Webair Internet Development Inc; 209.200.0.0 - 209.200.63.255
Webair Internet Development Inc; 67.55.64.0 - 67.55.95.255
Webair Internet Development Inc; 209.10.197.0 - 209.10.197.255
Webair Internet Development Inc; 209.10.246.0 - 209.10.247.255
Webair Internet Development Inc; 209.11.26.0 - 209.11.26.255
Webair Internet Development Inc; 209.11.31.160 - 209.11.31.191
Webair Internet Development Inc; 209.11.39.0 - 209.11.39.255
Webair Internet Development Inc; 4.43.119.0 - 4.43.119.127
Webair Internet Development Inc; 216.25.44.105 - 216.25.44.124

Edit: bad ip range updated

Another minor update, they are now using 01.exe as the name for the dropped rootkit/search hijacker, and 02.exe for the dns changer. The the trojans are now in an encryped rar archive within the installer, the installer drops the encrypted .rar file (1.rar) and winrar extractor (command line version) and runs the extractor with the correct password, then it runs the extracted decrypted trojans. This is an attempt to prevent the trojans from being detected from within the installer.

Hello,

Regarding the Webair ranges you mentioned; Webair makes best effort to
remove any clients who violate our AUP, which this would fall into.

We were made aware of such an abusive user not too long ago who was
distributing malware via fake codec installers. We downloaded the .exe's
into our sandbox and found that 9 A/V engines identified it with a
Zlob trojan variant. Once we confirmed the activity, we promptly shut down
the sites and canceled the client involved. As of now I am not aware of
any IPs on our network that are distributing any sort of malware. If you
do have any information as to any current activity please let me know
what it is and what IPs it involves and we will shut them down immediately.

Sagi Brody
Webair Internet Development Inc.
sagi@webair.com

Webair was on my block list before I discovered the fake codec sites, during my research the new connection between the fake codec people and webair IP range was discovered.

Webair was already on my block list because of massive p2p search result spamming, and trojans distributed via those spammed results. You may want to check into what any of your clients are doing in terms of peer to peer, spamming open peer to peer networks (with trojans or anything) doesn't make the p2p developers too happy. (this information may be out of date)

Also, do you have any information to contribute about the fake codec trojans, how long they were hosted, or about the creators/distributors of the fake codec trojans? Do you have any tips for other network hosts in terms of how to avoid providing service to or recognizing the fake codec trojan people before they even sign up?

Interesting developments.

Welcome to the board Sagi.

Ai_Tak, keep up the good work (thumb-up smiley).

Regards.

AI,

I do not believe we have any such activity live on our network at the
moment. We weeded out any p2p trojan distributors and spammers long ago.
Can you remove your personal block and see if you get any hits? I'd be
interested to see if there are any.

As far as advice to other networks/hosts, the following are things that
may throw up red flags as to possible virus distribution via 'codecs':

- the front-end homepage has no content (how many legit sites have a blank homepage?);

- the download is misleadingly linked behind "free sample video" pictures;

- the download page displays "Windows Media Player cannot play video
file. Click here to download missing Video ActiveX Object.", just like
the "goldcodec" infectors of a few months back. That is also very
misleading;

- all the client domains are registered at Esthost;

- The filename keeps morphing, and it uses the infamous
double-extension filetype to mask the 'exe' extension in Windows. IE ours
was goldcodec.589.exe, then mediasetup.107.exe, and I've heard that
those numbers simply increment, and that trial-and-error will find
other filenames with the same bugs in them.

A few years ago when this activity was in its infancy it was not as clear
and took us some investigative work to isolate and remove it. I'd bet the
old activity you saw came from the same time period.

To make matters worse, unlike 'spamming' this is not the usual thing that
runs across one's abuse desk. There are no simple headers to track the
activity and we normally have to check netflow/sFlow logs to substantiate
the reports.

As far as the recent Zlob distributor, we were actually alerted to it by a
LARGE number of complaints to our abuse desk and promptly shut it down.
Some more information is available at:
http://www.f-secure.com/weblog/archives/ar...6.html#00001021

Sagi Brody
Webair Internet Development Inc
sagi@webair.com

The p2p spamming information seems like it really was out of date. Bad clients tend to jump around from host to host, staying only until they are terminated, or (if that doesn't happen) until the reputation of the hoster drops too much for them to benefit. Both their short stay hopping around nature (they benefit from even short term service), and their reputation damaging properties are good reasons to carefully screen clients before you even start to provide service to them.

The p2p spam was likely quite old, the fake codec connection to webair happened since december 2006, neither seem to exist anymore.

It might be a good idea to simply (through automation) check for clients that have minimal html pages (possibly that aren't publicly linked but are accessible) who also have exe files hosted.

The fake codec trojan seems to have a direct connection with Trojan.Linkoptimizer.B (aka Gromozon), via the inhoster ip address 85.255.115.133.