Spamming email analysis

bediger4000 · bediger4000 · commit 00af873f2581 · 2019-07-23T07:42:58.000-06:00
diff --git a/plugins/login_wall/ring_decoded/README.md b/plugins/login_wall/ring_decoded/README.md
@@ -18,6 +18,16 @@ It might be a rewrite or distant descendant of a [c99](/webshells/claw.php) web
 
 `ring.php` gets used to download [gsptg.php](/gsptg.php), some kind of SEO campaign injector.
 
+It's possible that antivirus companies call this webshell one of the following names:
+
+* Backdoor:PHP/Fobushell.D (Microsoft);
+* PHP/WebShell-M (Sophos);
+* PHP.Backdoor.Trojan (Symantec);
+* Trojan.PHP.Crypt.n (Kaspersky);
+* PHP/Kryptik.AJ!tr (Fortinet);
+* PHP/Kryptik.AJ (ESET-NOD32)
+* PHP_WEBSHELL.YWG
+
 ### IP Address 192.154.105.154
 
 192.154.105.154 &rarr; 192-154-105-154.static.gorillaservers.com.
@@ -75,10 +85,18 @@ execute the web shell code.
 
     <form method= "post" action= ""> <input type= "input" name= "_f_wp" value= ""/><input type= "submit" value= "&gt;"/></form>
 
+It's possible that the `_f_wp` name can be `l__l_` in variants.
+
 Entering "G0YgIaXqx" and clicking the button shows us `ring.php` as a web shell:
 
 ![ring screenshot](ring_screenshot.png?raw=true)
 
+Other passwords used for `ring.php` appear to be:
+
+* root
+* pass
+* avto
+
 The web shell source code is compressed via gzip and Xor-encoded with the 9-byte key "G0YgIaXqx".
 Gzipping the PHP is a pretty good way to conceal the Xor bytes,
 and even makes it hard to guess the Xor byte key length,
diff --git a/vigilante_suspected/scenery_4.jpg/README.md b/vigilante_suspected/scenery_4.jpg/README.md
@@ -41,7 +41,7 @@ The HTTP parameter named "p1" should contain PHP code for WSO
 to eval, [and it does](dc1.php).
 
 The HTTP request carried a file download as well as the HTTP POST data.
-This is pretty unusual, and suggests a programmatic access of the URL.
+This suggests a programmatic access of the URL.
 
 The file would have gotten uploaded as "scenery_4.jpg".
 
@@ -76,7 +76,8 @@ The Xor-encoding key bytes are the ASCII values of the string
 The attackers seem to have used an Xor-key individualized for each
 site they attacked.
 
-I edited the immediate-eval-code to obtain [decode the image file](data_decode.php),
+I edited `function type1_send()`
+in the immediate-eval-code to obtain [decode the image file](data_decode.php),
 a small program that decodes the data in the image file,
 and prints it out.
 This seemed like the easiest way to obtain the decoded bytes.
@@ -90,6 +91,25 @@ they did not rename variables, eliminate extraneous while space,
 or any of the other methods that attacker(s) use to obscure their
 code and its function.
 
+We see consistently "snake_case" named functions and variables.
+The code looks good, but has both ASCII space and ASCII tab
+indentation.
+It mostly has Unix-style newline line endings,
+but a few stray carriage-return characters appear. 
+This indicates that a lot of cut-n-paste programming
+went on, but the programmer took some care to make the
+pasted code appear consistent.
+
+The code includes 3 object-oriented class definitions,
+classes PHPMailer, phpmailerException and SMTP.
+This code is obviously borrowed.
+[Class SMTP 5.2.10](https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.10)
+dates to May, 2015, consistent with the date of this attack.
+
+I give this code a grade of B - workmanlike, and solid.
+It's consistent with the way PHP is usually deployed,
+built on a foundation of utility classes and code.
+
 ### Data in "image" file
 
 The deobfuscated data looks like this:
@@ -122,4 +142,79 @@ The deobfuscated data looks like this:
       }
     }
 
+Pretty clearly some email spamming material, a fake from address, a destination address,
+and a template to customize the email body.
+
 ### Immediate-eval spamming code
+
+There's a problem in the spamming code.
+Looks like a cut-n-paste got done twice.
+The file(s)-accompanying the download get processed twice,
+once without actually decoding them,
+near the beginning of the code,
+and a second time twoards the bottom of the code.
+My guess is that encoded-accompanying-files are a later add-on.
+Originally the "image files" contained only the template for spam
+email's bodies.
+
+The spamming code gets eval'ed by the destination WSO instance.
+The looks through any files that arrived along
+with the POST request.
+If the files have ".jpg" in their file name,
+the spamming code uses the accompaying file(s) as data,
+passing the file name to `function type1_send()`,
+which is the "business logic" of this malware.
+
+After decoding and deserializing the data in the "image file",
+`function type1_send()` checks the value of the key "ak"
+in the deserialized PHP array.
+Above, you can see that 'ak' has the value "[AUTH_KEY]".
+`type1_send()` checks if this is present, and does not proceed
+if it isn't.
+It checks the data to see if some entity has "authorized" the spam.
+
+There may be a problem with the code if the deserialized array has a key named 'c'
+in it. It looks like it would try to serialize and base64-encode an array named `$res`
+which is not mentioned otherwise in `type1_send()`.
+This looks like stray code left behind during a refactor.
+The data sent along in this capture didn't include a key named 'c', so it probably would have worked.
+
+After that, `function type1_send()` creates an email from 
+the data in the deserialized array.
+
+|Array key|Meaning|
+|:---------:|-------|
+|e|"uid", To address|
+|s|Array of email Subject strings|
+|l|message body template|
+|f|Array of From addresses|
+|lt|text or HTML email selector|
+
+The "macro expansion" gets run over email subject, body and from address
+
+1. `function alter_macros()` - partially create string by choosing from alternative phrases.
+The above data could end up with a partially filled in string like this:
+    oh hey cutie... if you're still single and free we could meetup for fun?? [FTEIL]
+2. Insert a random number if substrings like `[RAND-12-45]` appear. The random number should be between 12 and 45 in this case.
+3. Insert another random number if substrings like `[NUM-5]` appear.
+I believe that substring would put a random number between 1000 and 9999.
+
+The message body gets one more substitution:
+The substring `[FTEIL]` gets replaced by the "uid",
+in this email data, the string "#fec691067cad63a1f115c5d21f8c01bb#".
+
+`function type1_send()` returns a serialized array that contains any SMTP erros,
+and a count of "good" and "bad" emails, where "good" emails did not cause a problem
+in the code of `function sendSmtpMail()`.
+
+This has all the features we've come to hate over the years:
+
+* A randomly-chosen email body that has a come-on in it.
+* An obviously wrong "from" address
+* Randomly-chosen strings of digits, probably in an attempt to pass signature scanners and such.
+
+This particular email seems odd in that it isn't advertising anything.
+No URLs would appear in the email body.
+Based on the body template and the "from address",
+the senders probably intended this email as a cold-call, an introduction to see who they
+could get to respond to it, and then try to get cash from those responders in other ways.
diff --git a/vigilante_suspected/scenery_4.jpg/alter_macros.php b/vigilante_suspected/scenery_4.jpg/alter_macros.php
@@ -0,0 +1,19 @@
+<?php
+
+$body = "{well|oh} {hello|hey|hey there|hello there} {mister|sir|cutie}{,|..|...} if {your|you're|ur} {single|still single|willing|up to it|down for it} and {free|avail|available|around} we {could|can} meetup for fun?? [FTEIL]";
+
+function alter_macros($content)
+{
+    preg_match_all('#{(.*)}#Ui', $content, $matches);
+    for($i = 0; $i < count($matches[1]); $i++)
+    {
+        $ns = explode("|", $matches[1][$i]);
+        $c2 = count($ns);
+        $rand = rand(0, ($c2 - 1));
+        $content = str_replace("{".$matches[1][$i]."}", $ns[$rand], $content);
+    }
+    return $content;
+}
+$newbody = alter_macros($body);
+
+print $newbody."\n";
diff --git a/vigilante_suspected/scenery_4.jpg/dc2.php b/vigilante_suspected/scenery_4.jpg/dc2.php
@@ -26,21 +26,6 @@
 		}
 	}
 }
-
-if (isset($_FILES))
-{
-	foreach($_FILES as $key => $file)
-	{
-		if(strpos($file['name'], ".jpg"))
-		{
-			$res = type1_send($file['tmp_name']);
-            if ($res)
-            {
-                echo $res;
-            }
-		}
-	}
-}
 	
 function custom_strip_tags($text)
 {
@@ -2855,6 +2840,20 @@ function sendSmtpMail($from_email, $from_name, $to, $subject, $body, $type, $con
 		return Array(1, 0);
 	}
 }
+if (isset($_FILES))
+{
+	foreach($_FILES as $key => $file)
+	{
+		if(strpos($file['name'], ".jpg"))
+		{
+			$res = type1_send($file['tmp_name']);
+            if ($res)
+            {
+                echo $res;
+            }
+		}
+	}
+}
 function mx_lookup($hostname)
 {
     @getmxrr($hostname, $mxhosts, $precedence);
diff --git a/vigilante_suspected/scenery_4.jpg/num_macros.php b/vigilante_suspected/scenery_4.jpg/num_macros.php
@@ -0,0 +1,19 @@
+<?php
+function num_macros($content)
+{
+    preg_match_all('#\[RAND\-([[:digit:]]+)\-([[:digit:]]+)\]#', $content, $matches);
+	print "count(\$matches[0]) = ".count($matches[0])."\n";
+    for($i = 0; $i < count($matches[0]); $i++)
+    {
+        $min = $matches[1][$i];
+        $max = $matches[2][$i];
+print "$i: min $min, max $max\n";
+        $rand = rand($min, $max);
+        $content = str_replace($matches[0][$i], $rand, $content);
+    }
+    return $content;
+}
+
+$x = num_macros($argv[1]);
+print $argv[1]."\n";
+print $x[1]."\n";
diff --git a/webshells/222.77.242.65-2019-07-10a/README.md b/webshells/222.77.242.65-2019-07-10a/README.md
@@ -49,4 +49,6 @@ The preferred language of the computer's user was Chinese:
 That matches the attack coming from a China Telecom address,
 but that's a pretty weak link.
 
+## Analysis
+
 ![webshell screenshot](chinese_webshell.png?raw=true)
