About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Monday, June 25, 2012

023 Crime OSX DNS Changer / OSX.RSPlug.A - web -2007


SHA256: 2bdcdab0a5d41f4b6aa48e2ab55177552c8419c3f8ce140c4850a0616d7a2f3e
SHA1: f620af9a43d6e46e6b028dc8b109ff5d4cced911
MD5: 5291beb71cba2c5779119bff7a10abdb
File size: 16.6 KB ( 17034 bytes )
File name: ultracodec1237.dmg



 Download (pass infected)


 

Thursday, June 7, 2012

023 Crime Downloader Trojan (name?) - web - June 7, 2012

Audio_Recording_MP3
MD5: FDC170166CB958E138E7D401F3C6F896
SHA256: A3253B1732A50146038A68B3B46260F80BEC6C1C

 Download (pass infected)

pcap file




022 Crime Win32/Bakcorox.A - proxy bot - web - June 7, 2012

 Download (pass infected)


pcap file



DNS query:  day7read.info
DNS response:  day7read.info ⇒ 74.207.249.7
Connects to:  day7read.info:443 (74.207.249.7)
Sends data to:  8.8.8.8:53
Sends data to:  day7read.info:443 (74.207.249.7)
Receives data from :  8.8.8.8:53
Receives data from:  day7read.info:443 (74.207.249.7)
 

Monday, June 4, 2012

021 Crime TDL - web - June 4, 2012

malicious domain
newgenerationp.com/d/u


 
Download (pass infected)

xor key 85 
MD5  A16977E9CCBF86168CE20DFC33E0A93C
SHA-256 05344813787920a04b207416ea05516b21958b3f6c8ad9fb8f0ce507c41efd01


https://www.virustotal.com/file/05344813787920a04b207416ea05516b21958b3f6c8ad9fb8f0ce507c41efd01/analysis

Thursday, May 10, 2012

020 Crime Ramnit Rootkit - web -May, 10 2012

Sample credit - Artem Baranov and Hendrik Adrian

Research:

 
Download (pass infected)


Size: 135680
MD5:  607B2219FBCFBFE8E6AC9D7F3FB8D50E

Thursday, May 3, 2012

019 APT Speech.doc MacOS_X/MS09-027.A Word exploit for MS Word

Someone uploaded. Thank you for sharing.
Document language code is Arabic, which is kind of interesting.

Research: Microsoft An interesting case of Mac OSX malware


 Download (pass infected)

File: speech.doc
Size: 158854
MD5:  F4CBFE4F2DDF3F599984CF6D01C1B781


Sunday, April 29, 2012

018 Crime "Microsoft Update" phish -> Blackhole exploit kit with Zeus payload - web - April 2012

File: KB971033.exe
Size: 201216
MD5:  EC750B75E83749C715D7834E130FCE8E

File: hnszs0.exe
Size: 184832
MD5:  9DB4174373601F74FCE0ECBC77A9577D

Sample credit Bryan Nolen

Download (pass infected)


LIST OF FILES INCLUDED
│   investigation_notes.txt

├───dropped_files
│   ├───exe
│   │       hnszs0.exe
│   │       KB971033.exe
│   │
│   ├───java
│   │       jar_cache.zip
│   │
│   ├───pdf
│   │       ap1.pdf
│   │       ap2.pdf
│   │
│   └───swf
│           score.swf

├───email
│       MSUPDATE.eml

├───extracted_files
│       pid_1412_Explorer_Dumped.EXE

├───html
│       exploit.html
│       landing.html

└───pcap
        dump.pcap



Quick analysis made by Bryan Nolen

Landing page (hxxp://volozhin.gov.by/pub/KB971033/?clien-e=3D1093821896211 and saved as html/landing.html) contains a hidden IFRAME that leads to the exploit page. This landing page also contains a META REFRESH that leads to another suspect binary (hxxp://volozhin.gov.by/pub/KB971033/KB971033.exe saved as dropped_files/exe/KB971033.exe) - detection on this second binary is low ( https://www.virustotal.com/file/0e14f5e6cdab9218135d3a7eed11f0457c9934210859f6075d63bc609469d43b/analysis/1335596875/ )

Exploit page (hxxp://fewfewfewfew.ibiz.cc/main.php?page=95fc4549d83b0486 and saved as html/exploit.html) utilises a trio of exploits designed to attack java, adobe acrobat, or flash.

Analysis of the javascript was perfomed with the assistance of URLQUERY report link (http://urlquery.net/report.php?id=47909).

The attack payloads are saved as
  • dropped_files/pdf/ap1.pdf 
  • dropped_files/pdf/ap2.pdf 
  • dropped_files/swf/score.swf 
  • dropped_files/java/jar_cache.zip

The "final" malicious payload is saved as (dropped_files/exe/hnszs0.exe) and its detection is VERY poor ( https://www.virustotal.com/file/c48df0394939fccb9a3ac0853d0ae696d04e7c5230d3a6468ebce257a0be4ccc/analysis/1335598639/ )

A copy of explorer.exe extracted from the memory image after infection is included, based on observations this is the process it migrated into after infection. It is saved in (extracted_files/pid_1412_Explorer_Dumped.EXE)

PCAP is supplied in the pcap folder. The hosts identified in this malware are:

Landing Page:    volozhin.gov.by         212.98.162.62
Exploit Page:    fewfewfewfew.ibiz.cc         83.69.233.156
C2:        google-analytics-sv1.com     91.230.147.222
(alt C2):    localdomain01.com         91.230.147.145

Note: the Alternate C2 was seen in earlier investigations of this malware and changed to the C2 address above when this round of investigation was performed.

Full memory dumps from my sandbox VM avaliable on request.

I have a strong suspicion this is a Zeus varient.


-Bryan Nolen <bryan _at_ arc .dot. net .dot. au>
@bryannolen

SITE TYPE
LEGITIMATE, COMPROMISED   
212.98.162.62
volozhin.gov.by
    Belarus    AS12406 Business network j.v.    Business Network JV
                       
BLACKHOLE    
83.69.233.156
fewfewfewfew.ibiz.cc 
   Russian Federation    AS28762 AWAX Telecom Ltd    AWAX Telecom Ltd.

PAYLOAD - ZEUS   
C2
91.230.147.222
google-analytics-sv1.com
Russian Federation    AS57189 PE Spiridonova Vera Ana    OOO Aldevir Invest
 
C2
91.230.147.145
localdomain01.com Russian Federation    AS57189 PE Spiridonova Vera Ana    OOO Aldevir Invest





Wednesday, April 4, 2012

Saturday, March 3, 2012

Thursday, March 1, 2012

Welcome to Contagio Exchange - community malware dump


Mila P.
Greetings,
as you see from the description above, Contagio Exchange is meant to be a communal malware collection. Contagio mobile dump has been very successful and useful because researchers can upload their samples and download them without waiting for me to analyze or post it - directly from the mediafire box.

Whenever I have time, I will moderate and post descriptions for the files and individual download links (in addition to the main dropbox link) in the same format you see on the  mobile malware dump.

This collection is meant to be a shared library of malware samples, not a repository of every type and sample in existence. I would like it to have current and useful samples for everyone to analyze and play with. Links for search and download are in the right hand column.


This collection is not meant to be a
  •  replacement for Contagio malware dump, it will continue to operate as usual.
  •  mega catchall dump of everything you can download from Malwaredomainlist,   Cleanmx, or offensivecomputing.net
  •  competitor to the above or any similar collections and sites
  •  mess of zipped and unzipped generic and "lord knows what it is" files
  •  repository of every sample in existence
  •  danger to society
For this collection to succeed, please follow these simple rules:
  1. Zip all and every file with the password 'infected' before uploading. Zip is better than rar for consistency.
  2. Read #1 again - it is very important to prevent the mediafire dropbox from turning into a hazard
  3. Add your name to the description (if you want a credit), description itself, links to research or sandbox results to explain what it is.  You can add a text file inside the package called description.txt or use the comment box during the upload. Please do not upload mystery files.
  4. Name zip files like this "virusname_md5.zip" or include MD5 in the name of the zip - if possible
  5. If you are not sure what it is and / or the detection is generic, please do not dump it into a sorted main exchange box but use U.F.O. - Unidentified Flying Object box so that others knew what to expect

Mediafire dropbox information
  • This is a paid and long standing mediafire account with unlimited storage and more than enough bandwidth to support it. 
  • Your samples are not held hostage as you can download them and store on your system each time or on a schedule. If there is ever any change to this storage, I will give enough warning or ways to get them.   
  • All links are direct, no ads
  • Dropbox works on all OS but best on Firefox and Chrome. I did not try it on Safari and it has issues on IE and Palemoon. If you have a problem with using it, you can email the samples (rename the file extension and double zip exe files) and indicate it is for the exchange.
  • As an added benefit, you can use the dropbox for malware exchange with anyone - if you don't mind your sample to become public. Once you upload, go to the download link on top of the upload box and click on a round gear next to the sample and select 'share'. It will generate a direct link you can post or email.

P.S. I don't financially benefit from the dropbox downloads (in fact, it is the opposite) , posts, or malware samples. It is for the sake of fun and education.

thank you!