Messenger Password Decryptor

Messenger Password Decryptor (formerly IMPasswordDecryptor)是一個免費且集多個密碼恢復功能為一身的解+密軟件。Messenger Password Decryptor支持的即時消息應用包括： GTalk, MSN, AOL, Trillian, Pidgin, Digsby等等。目前，Messenger Password Decryptor 發佈了4.5版，支持解密的應用包括：

    * Google Talk
    * Windows Live Messenger
    * MSN Messenger
    * AOL Messenger (AIM)
    * Digsby IM
    * PaltalkScene
    * Trillian
    * Trillian Astra
    * Pidgin (Formerly Gaim)
    * MySpaceIM
    * Miranda
    * Beyluxe IM
    * Meebo Notifier
    * Nimbuzz Messenger
    * IMVU
    * XFire Game Messenger

工具下載：http://nagareshwar.securityxploded.com/2011/10/22/released-messenger-password-decryptor-v4-5/ 

出自：BugZone - http://www.pulog.org/tools/2289/mp-decryptor-4.5/

3 Free Tools to Fake DNS Responses for Malware Analysis

When analyzing malware using behavioral techniques, it’s often useful to intercept network connections in your lab. Since malicious software commonly uses hostnames when communicating with network resources, you can redirect such connections by defining the desired hostname to IP address mapping. Here are 3 free tools that can make it easy to accomplish this.

Rather than providing the malicious program the IP address of the actual host it’s trying to access, you can provide the IP address of an internal laboratory system. It’s possible to define this mapping in the “hosts” file on the infected laboratory computer. Alternatively, you can use a DNS server provide falsified DNS responses to queries. If you don’t want to configure a full-blown DNS server, you can use specialized tools such as ApateDNS, FakeDNS and fakeDNS.py.

ApateDNS in Action on Windows

Mandiant recently released a Windows tool called ApateDNS, written by Steve Davis. ApateDNS’s DNS responses will specify the desired IP address of your choosing, regardless of which hostname is being resolved. The tool logs all DNS queries it processes.

To use ApateDNS, you’ll need to point your infected laboratory system to the host where ApateDNS is running. In most scenarios, though, you’ll probably run ApateDNS directly on the infected host. While the tool attempts to automatically configure your local system to use localhost as the DNS server while ApateDNS is running, this doesn’t always work; be prepared to manually modify your DNS settings for this purpose.

FakeDNS in Action on Windows

FakeDNS is a free Windows tool from Verisign’s iDefense group, which is part of the larger Malcode Analysis Pack distribution. Though the original Malcode Analysis Pack web page is no longer accessible, you can still download the executable’s installer file from the iDefense website.

Like ApateDNS, FakeDNS responds to all DNS queries with the specified IP address, logging the details of the received requests and transmitted responses.

fakedns.py in Action on Linux

Another option for falsifying DNS responses in a malware analysis lab is the fakedns.py script by Francisco Santos. It’s written in Python, and will run on most platforms as long as Python is installed on the system. A version of this script is included in the REMnux Linux distribution.

The fakedns.py script is a command-line tool. By default, it will respond to DNS queries with the IP address of the host where the script is running, but this behavior can be modified using a command-line option.

To see how fake DNS servers can be used for malware analysis, take a look at my recorded Introduction to Malware Analysis webcast.

Hand-picked related posts:

• NetworkMiner for Analyzing Network Streams and Pcap Files
• Using Netsh for Easier Network Setup in a Malware Lab
• Process Monitor Filters for Malware Analysis and Forensics

— Lenny Zeltser

轉自 http://blog.zeltser.com/post/11869187517/fake-dns-tools-for-malware-analysis

Research Tool Release: ApateDNS

Written by Steve Davis

Here at Mandiant we deal with our fair share of malicious code. Being able to quickly identify specific information about a piece of malware is imperative. More specifically, knowing which domains a piece of malware uses for command and control (C2) communication is important to on-site incident responders.
 

To aid analysts in DNS identification, I have written ApateDNS. It is a simple tool that acts as a phony DNS server that can log or manipulate DNS requests being made to it. Malware analysts typically use this to redirect beacon traffic from a guest virtual machine to the host system (or another virtual machine) to  monitor beacon and/or communication channels using Netcat or a custom written C2 script. Forensic analysts typically use this tool to quickly extract DNS names from malware samples.
 

ApateDNS automatically sets up your Windows network configurations by attempting to determine the default route or current DNS settings. This is most useful when in a guest virtual machine since the default route is typically the host machine. As shown in the figure below, ApateDNS has found the default route in my virtual machine (192.168.239.1) and uses this IP address for any DNS request on my virtual host. The user may override this by specifying an IP address for DNS Reply IP.
 

Malware often uses multiple C2 domains. To catch this, ApateDNS allows a user to specify a number of non-existent DNS (NXDOMAIN) replies for any possible DNS lookup. As seen in the figure below, the malware returns a single, non-existent domain for each DNS request (since a “1” is entered for “# of NXDOMAIN’s”). The example malware beacons and detects if a valid IP address has been resolved from a DNS request, if not, it will continue to walk down its C2 domain list. By using the NXDOMAIN functionality, we see three different DNS requests made by the malware: evil1.example.com, evil2.example.com and evil3.example.com.
 

ApateDNS gives malware analysts an easy way to control DNS on their machine and forensic analysts a way to monitor DNS requests made by malware. Of course, not all malware utilizes DNS and some may not beacon without a specific set of conditions being satisfied. ApateDNS’s use cases are not limited just to malware. It can be used for any purpose where a user may want to monitor outbound DNS requests or traffic.
 

Feel free to check out ApateDNS here.

轉自 https://blog.mandiant.com/archives/1961?utm_source=rss&utm_medium=rss&utm_campaign=research-tool-release-apatedns

SQLite Database Browser

SQLite Database Browser is a freeware, public domain, open source visual tool used to create, design and edit database files compatible with SQLite. It is meant to be used for users and developers that want to create databases, edit and search data using a familiar spreadsheet-like interface, without the need to learn complicated SQL commands. Controls and wizards are available for users to:

• Create and compact database files
• Create, define, modify and delete tables
• Create, define and delete indexes
• Browse, edit, add and delete records
• Search records
• Import and export records as text
• Import and export tables from/to CSV files
• Import and export databases from/to SQL dump files
• Issue SQL queries and inspect the results
• Examine a log of all SQL commands issued by the application

轉自 http://sqlitebrowser.sourceforge.net/index.html

Volatility Memory Forensics | Federal Trojan aka R2D2

Last weekend, the German based Chaos Computer Club (CCC) published details on a backdoor trojan they claimed was being used by German authorities, in violation of German law.

Fore more info on German State Backdoor go to:
Possible Governmental Backdoor Found
More Info on German State Backdoor
Several German states admit to use of controversial spy software

Download:
Here’s a memory image running the malware (Thx to jwcsr): 0zapftis.rar
PW: infected

1.) Image Identification

$ python vol.py -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem imageinfo



2.) Processes

$ python vol.py -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem pslist



3.) Networking

$ python vol.py -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem connscan



One active connection to the IP address 172.16.98.1 on port 6666 is listed. According to the process list, the process ID 1956 don’t belong to a browser process, such as Iexplore.exe or Firefox.exe, but rather to Explorer.exe. What is this system process doing on the internet?

Note:
The Chaos Computer Club modified the binary. The original IP address of the proxy is 207.158.22.134 on port 443.

4.) Researching IP Addresses

$ whois 207.158.22.134



$ whois 83.236.140.90



5.) Malware Detection
Now, it’s time for the Volatility plug-in malware.py, which was originally developed for the Malware Analyst’s Cookbook. The function ‘apihooks’ looks at the Explorer process with the PID 1956 and finds nothing. No inline hooks!

$ python vol.py -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem -p 1956 apihooks



6.) Let’s try the function ‘malfind’ and the open source YARA project.

$ python vol.py -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem -p 1956 -Y /home/evild3ad/yara-rules/malware.yara -D /home/evild3ad/Volatility/dump-files malfind



7.) VirusTotal
The plugin ‘malfind’ dropped the suspicious PE file it discovered to my output directory as .dmp file. I submitted it to VirusTotal, and bingo, it is malicious and identified as ‘R2D2′ and ‘Bundestrojaner’.


8.) Registry
The registry is spread across numerous files called ‘hives’. The current user’s registry branch, HKEY Current User (HKCU), is located in the hidden file NTUSER.DAT of the home directory under \Documents and Settings\. There are two more important branches: HKEY Local Machine (HKLM) and the sub-branch for software in \Windows\system32\config. But first, we need to have ‘hivelist’ display where Windows put the files into memory.

$ python vol.py -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem hivelist



Volatility finds HKCU at the virtual address 0xe1bb2b60 and HKLM/Software at the virtual address 0xe1544b60. With this information, we can now use ‘printkey’ to display individual keys and work through the autorun list. After a few dead ends, I notice something suspicious about ‘HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows’.

$ python vol.py printkey -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem -o 0xe1544b60 -K ‘Microsoft\Windows NT\CurrentVersion\Windows’



All the DLLs that are specified in this value are loaded by each Microsoft Windows-based application that is running in the current log on session.
09.) Kernel Objects

$ python vol.py --profile=WinXPSP3x86 -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem filescan > filescan.txt



10.) Kernel Drivers

$ python vol.py --profile=WinXPSP3x86 -f /home/evild3ad/memory-samples/other/R2D2/0zapftis.vmem modules




Links:
Chaos Computer Club analysiert Staatstrojaner
Addendum Staatstrojaner
Piratenpartei Deutschland: Schreiben des bayrischen Justizministeriums als PDF 


轉自 http://www.evild3ad.com/?p=1136 

Nmap / Zenmap

Author Name
Frank McClain

Artifact Name
Nmap/Zenmap

Artifact/Program Version
4.6, 5.1

Description
Artifacts remaining on system after a scan using Nmap/Zenmap (especially Zenmap).  This is not from the standpoint of showing that the application was run, or by whom (so no prefetch, user assist, etc), nor proving that the application was installed at some point. This is from the standpoint of showing the use (ie, how) an application was put to, and the timeframe (ie, when) involved.

In c:\program files\nmap\zenmap\ a file was created when a scan was saved.  This had the same user-selected name as the saved scan, with the extension USR.  So if the scan saved was “test” then the subsequent file would be “test.usr.”  If you find one of these, you can bet the user saved a scan; this file should be identical to that.  It is an XML file that has all the information about the scan.

In %User%\.zenmap (hidden folder) there are primarily three files of interest:  recent_scans.txt, target_list.txt and zenmap.db. Recent_scans.txt is a list of saved scans (or perhaps the .USR instance, it’s inconclusive at this point); all it has is a list of files with their paths.  Target_list.txt is a list of all target IP addresses, separated by semicolons; it has no other information, not even an associated date.  Zenmap.db is the fun one; it’s a SQLite database that contains a history of what scans were run – type of scan, target IP, XML output (ie, basic scan detail) and time.

%User%\%Local%\Temp has another potential treasure trove of evidence.  You may find temporary files (with no extension) located at this level.  Some contain no data, some contain only a small amount, and others provide a detailed breakdown of the scan, really the veritable motherlode, as it shows the time of the scan, each target port, protocol, scan times, and so on.  Very good stuff, when present.  The temporary files that had only a little content basically mirrored the type of content in the USR files, so if you don’t have one, you might have the other and still have some insight into the scan.

And a slightly tangential question posed on twitter was how to identify a scan with packets.  Fairly simple, right – just start Wireshark, run an Nmap scan, and review the results.  Turns out across multiple types of scans run, that there are 60-byte packets, and all have the following content:  00 0d 60 da b4 e7 00 11  25 d1 04 e0 08 00 45 00.  That’s obviously not the entire contents of each packet, but that was consistent across all packets I saw.

File Locations
c:\program files\nmap\zenmap\*.usr (where * is the user-provided filename)
%User%\.zenmap\recent_scans.txt
%User%\.zenmap\target_list.txt
%User%\.zenmap\zenmap.db (SQLite db)
%User%\%Local%\Temp\tmpf5nhgm (these all start with “tmp” and appear to have 6 more characters following)

Research Links
http://forensicaliente.blogspot.com/2011/10/artifacts-created-by-nmapzenmap.html

Forensic Programs of Use
Nmap for Windows (cli) - http://nmap.org/download.html
Zenmap GUI for Nmap for Windows - http://nmap.org/download.html
SQLite Database Browser - http://sqlitebrowser.sourceforge.net/
Wireshark - http://www.wireshark.org/download.html

轉自 http://forensicartifacts.com/2011/10/nmap-zenmap/

Android惡意代碼攻防現狀

Android惡意代碼攻防現狀

by Claud

在2011年哈爾濱「自由軟件日」活動的報告。







































 


轉自 http://blog.claudxiao.net/2011/09/android_malware_status/