A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #9254  by Striker
 Tue Oct 18, 2011 6:21 pm
Anyone got a sample? :>
 #9261  by EP_X0FF
 Wed Oct 19, 2011 1:32 am
Two drivers in attach. C-Media Electronics Incorporation certificate is revoked.
pass: malware
(27.84 KiB) Downloaded 232 times
 #9267  by shaheen
 Wed Oct 19, 2011 5:32 am
Wonder if any one has a dropper for it?
 #9271  by frank_boldewin
 Wed Oct 19, 2011 10:20 am
i don't have a dropper only several files from an infected box, but i'm not allowed to share currently.

from what i've seen so far it doesn't contain PLC code. it's more a keylogger, but the codebase and several techniques are very similar to stuxnet code.
if you are lucky and get all needed files you have to prepare your box a little to make it working.

cmi4432.sys and jminet7.sys drivers contain the same code. difference is that one is signed and the other one not.

driver installs a loadimage callback and injects 4 payloads into services.exe stored in PNF files.

there is also a fake lsass.exe, which does the keyboard hooking (WH_KEYBOARD hook).
*.pnf files need to be in %systemroot%\inf

if the driver gets loaded it decryts the pnf files from this directory.
if you wanna analyse the drivers with windbg you first have to bypass the
KDDEBUGGERENABLED check at the beginning of the code.

in order to work properly the drivers need the registry entry:


all other parameters are straight forward.

the FILTER registry string decrypts to some unicode string information:


the pnf files decrypts payload injected into services.exe

md5sums of files i got are:

 #9313  by EP_X0FF
 Thu Oct 20, 2011 1:01 pm
Blaze wrote:Dropper attached.
This isn't a dropper. This is another recompiled driver.
 #9316  by rkhunter
 Thu Oct 20, 2011 2:34 pm
EP_X0FF wrote:
Blaze wrote:Dropper attached.
This isn't a dropper. This is another recompiled driver.
According to the imports, it is focused on the injection in processes. KdDebuggerEnabled checking also present.
 #9329  by CloneRanger
 Fri Oct 21, 2011 12:29 am
If someone supplies me with the Full install, i'll test it against my Security software ;) And post the results :)