{"id":3373,"date":"2010-09-25T12:56:29","date_gmt":"2010-09-25T19:56:29","guid":{"rendered":"http:\/\/blog.webroot.com\/?p=3373"},"modified":"2018-01-30T11:13:54","modified_gmt":"2018-01-30T18:13:54","slug":"civilization-5-torrent-bonus-uncivilized-malware","status":"publish","type":"post","link":"https://www.webroot.com/blog/2010\/09\/25\/civilization-5-torrent-bonus-uncivilized-malware\/","title":{"rendered":"Civilization 5 Torrent Bonus: Uncivilized Malware"},"content":{"rendered":"

\"\"\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"Add<\/a>\"\"<\/p>\n

\"\"<\/a>Bootlegged copies of Civilization 5<\/strong>, the highly anticipated, just-released real time strategy game, are already popping up in file sharing services. And, as we’ve come to expect, some of the pirated copies of the game come with that little something special — malicious components.<\/p>\n

One of our Threat Research Analysts, who also happens to be an avid gamer, started looking for pirated copies of the game Friday morning and, within five minutes of looking, found Trojans in some of the torrents in circulation. I’ve chosen to focus on one of these files, not only because it was the first we saw, but also the most interesting. The Trojan, bundled in a torrent with the ISO image of the Civ 5 installation disc, is called ‘read me before burn.exe<\/strong>‘ (MD5: 2f7ff2ecef4b5cf1c9679f79d9b72518).<\/p>\n

On a typical Windows system, the file appears to be a text document, but only because it uses a file icon of a text document. With the file extension visible, however, it’s clearly an .exe with a mission.<\/p>\n

\"\"<\/a><\/p>\n

The file, a dropper, is interesting for other reasons as well. As of last night, there were no detections for the file on Virustotal, which means other antivirus companies hadn’t yet pulled it into their systems.<\/p>\n

The ‘read me’ dropper drops a program named ‘my-slide-show-picture.exe<\/strong>‘ (MD5: 6cf871199432f0dd9a669427f58155db) into the currently-logged-in-user’s Application DataMicrosoft<\/em> folder, writes a run key to start up slide-show<\/em> at reboot (with the value window update<\/em>), then quits.<\/p>\n

\"\"<\/a><\/p>\n

Here’s the interesting part: Every time slide-show<\/em> executes, it writes the entire source code for another payload — a password stealer — onto the infected computer. Slide-show<\/em> then compiles this dropped source code, using the Visual Basic Compiler,into a program with an eight-random-character filename that’s exactly 136192 bytes in size. This happens every time the computer executes slide-show<\/em> — upon the initial execution and at every reboot. This breaks AV detection of the compiled payload that relies on a static MD5 hash.<\/p>\n

\"\"<\/a><\/p>\n

Now for the Stupid Malware Tricks part: When slide-show<\/em> writes out its source code, which is all embedded in slide-show<\/em> as base64-encoded text, anyone can read it all. That means we, the malware analysts of the world, can see the full functionality of the program without needing to actually do anything more than open it in a text editor.<\/p>\n

\"\"<\/a><\/p>\n

The original source appears to have been written by someone who is a native French speaker, because it is heavily commented in French, which is actually quite informative. This helpful malware author, whose name is apparently Albert<\/em>, tipped us off to useful hints about what he did, with comments like mot de passe<\/em> (password) and ecrivant un compte MSN Messenger <\/em>(write out the MSN Messenger account) sprinkled throughout.<\/p>\n

\"\"<\/a><\/p>\n

For too long, I thought my study of French in college would yield no useful purpose in my malware analysis day job. Thanks, Al, for making it all worthwhile.<\/p>\n

\"\"<\/a><\/p>\n

We also can see that the password stealer component is built out of nine separate components, each of which adds different functionality to the end product. Among the functionality is the ability of the program to steal passwords for MSN messenger, stored passwords in the Protected Storage area of Windows, passwords saved to Mozilla Firefox’s password storage, and elsewhere. The file concatenates any stolen information and holds it in anticipation of being able to upload it to the file’s command and control server, which is assigned to two subdomains managed through the No-IP dynamic DNS service. As I write this, the IP address where the payload attempts to communicate is offline, and the account’s been shut down.<\/p>\n

We’ve added detection for ‘slide-show’ as well as ‘read me’ to our definitions. What remains to be seen is whether would-be pirates will be dissuaded from bootlegging copies of the game, or if Albert <\/em>here still ended up with a boatload of stolen credentials. I guess we’ll find out next week.
\n\"wordpress<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Bootlegged copies of Civilization 5, the highly anticipated, just-released real time strategy game, are already popping up in file sharing services. And, as we’ve come to expect, some of the pirated copies of the game come with that little something special — malicious components. One of our Threat Research Analysts, who also happens to be […]<\/p>\n","protected":false},"author":65,"featured_media":17052,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3005],"tags":[],"yst_prominent_words":[3915,3485,7871,7857,3619,4379,3477,7859,7867,7861,7855,4441,7873,7865,7869,4509,6639,4269,7863,3471],"acf":[],"_links":{"self":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3373"}],"collection":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/comments?post=3373"}],"version-history":[{"count":1,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3373\/revisions"}],"predecessor-version":[{"id":23609,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/posts\/3373\/revisions\/23609"}],"wp:featuredmedia":[{"embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media\/17052"}],"wp:attachment":[{"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/media?parent=3373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/categories?post=3373"},{"taxonomy":"post_tag","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/tags?post=3373"},{"taxonomy":"yst_prominent_words","embeddable":true,"href":"https://www.webroot.com/blog/wp-json\/wp\/v2\/yst_prominent_words?post=3373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}