Rustock Crackz

Last Thursday’s post commented on malware commonly bundled with crackz. A large number of users are running files that appear to be distributed from a number of crack sites. We will not publish those domains on this post.

The filename bundles carry a common theme for a downloader that delivers more than a user would expect. Crack.exe, keygen.exe, patch.exe and install.exe have been bundled within phony cracks and released to a number of sites. They contain trojan downloaders, among other things, pulling down and executing spambot variants and many other malware executables, including our old friend Vundo. Here are just a handful of the bundle names that we’ve been seeing:

Notice the clever(?) use of the double file extension, ending in .zip.exe or .txt.exe. DO NOT download and run these files.

In our labs, we find that running these files results in a ridiculous attack. The volume of malware that ends up running on the system is so large that the system becomes entirely unusable. We haven’t seen an attack quite so bad since the 2nd-thought.com site was taken down.

One of the components infects services.exe on the system (often named “axer.exe”), and drops rootkit and spambot components (surprisingly, we see a consistent driver filename “pqasghjd.sys”), sending out waves of spam from this system process. The kernel level driver component hooks SSDT entries NtCreateKey, NtOpenKey and NtTerminateProcess, in an attempt to hide registry keys and prevent termination of the malware’s user-mode processes. It also attaches to the Ntfs file system driver, in order to obscure access to its presence on-disk.

The spambot components download updated lists of user accounts and available smtp servers over http, and then peddles rather “adult” themes in outgoing messages. All of the messages include a link to phony “personal growth” pills for men. Here are a couple of “mentionable” subject lines, just to get a small percentage of users to actually open the message:
“Life will get better with this”
“Wanna know why she’s hot”
“Jessica Alba bikini pics”
“All the love you need”
“Scarlett Johansson and Justin Timberlake spotted together”
“Get ready for a stunning improvement to your love life”
“Scarlett Johansson and Tom Brady spotted in Mexico”

This entry was posted in Online Fraud. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *


You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>