Makusop

Alina sparks source code review I got on my hands recently the source code of Alina "sparks", the main improvement that everyone is talking about and make the price of this malware rise is the rootkit feature. Josh Grunzweig did already an interesting coverage of a sample, but what worth this new version ? InjectedDLL.c from the source is a Chinese copy-paste of http://www.cnblogs.com/lzjsky/archive/2010/12/01/1892702.html and commented out, replaced with two kernel32 hooks instead, like if the author cannot into hooks :D a comment is still in Chinese as you can see on the screenshot. + this: LONG WINAPI RegEnumValueAHook(HKEY hKey, DWORD dwIndex, LPTSTR lpValueName,LPDWORD lpcchValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData) { LONG Result = RegEnumValueANext(hKey, dwIndex, lpValueName, lpcchValueName, lpReserved, lpType, lpData, lpcbData); if (StrCaseCompare(HIDDEN_REGISTRY_ENTRY, lpValueName) == 0) { Result = RegEnumValueWNext(hKey, dwIndex, ...

Alina 3 4 POS Malware The malware come from: http://vxvault.siri-urz.net/ViriFiche.php?ID=23179 Hosted on the site of a deputy. GetPCname: Create a mutex: Create /%appdata%/java.exe If the malware cant he will try with different name (jusched.exe, jucheck.exe, desktop.exe, dwm.exe, win-firewall.exe, adobeflash.exe) If all names are take and in read only mode the malware is trapped on infinit loop :))) Write the file: and if he fail to write he will Copy it: Add a registry persistence: Launch the process: Encode something (ive not checked what) Call the C&C And fail because the first is dead, so retry with 208.98.63.228 Backend info: 208.98.63.228: OrgName: Sharktech OrgId: SHARK-7 Address: 100 Pinehurst Ct. City: Missoula StateProv: MT PostalCode: 59803 Country: US http://xxx.98.63.228/main.php http://xxx.98.63.228/info.php http://xxx.98.63.228/test.php http://xxx.98.63.228/test2.php http://xxx.98.63.228/api.php http://xxx.98.63.228/config.php http://xxx.98.63.228/autoupdate.php ht...