How We Decoded Some Nasty Multi-Level Encoded Malware

Great!

Huh, how strange...I just cleaned the perl version of this out of a compromised user account on a server I manage.

It's an XOR encryption, with a largish key - 12 bytes if I make the old hacker news comment correctly. If you do the standard known-text XOR key finding algorithm, you need a 24-byte known text.

That's some brute forcing, if you ask me.

But you're just looking for the text being in a certain range of characters. The first stage is determining the key length, you can do this by looking at the number of different character values in positions 1,2,3... then 1,3,5,... and 2,4,6,... then 1,4,7,... etc.

    keylength=1 127
    keylength=2 114 116
    keylength=3 107 102 106
    keylength=4 78 94 98 103
    keylength=5 111 118 115 114 119
    keylength=6 81 71 81 77 79 77
    keylength=7 104 112 110 104 110 110 109
    keylength=8 67 85 86 94 68 91 83 86
    keylength=9 87 86 86 90 92 85 83 85 82
    keylength=10 91 97 86 89 90 88 90 90 92 97
    keylength=11 90 101 102 98 99 93 100 100 100 95 93
    keylength=12 45 45 46 53 47 46 41 47 47 51 50 47
    keylength=13 89 85 100 90 89 91 94 95 82 90 86 88 92
    keylength=14 83 84 85 88 82 81 77 72 82 85 73 81 82 86
    keylength=15 73 81 72 76 76 70 75 73 74 72 77 76 73 71 73
    keylength=16 56 68 71 80 60 73 64 73 58 71 70 76 57 76 66 68
    keylength=17 81 86 82 74 77 82 85 87 81 87 78 84 77 77 79 80 82
    keylength=18 59 55 59 55 61 56 59 55 57 59 55 62 62 57 60 58 56 59
    keylength=19 77 80 80 77 71 89 78 76 73 74 68 80 80 80 74 76 78 79 72

The stand out line from that is keylength=12 as it provides a local minima for the number of different characters.

Having a good idea of the key length you can look at which of the possible 256 values for each position of the key produce the top numbers of printable characters. A quick perl script to do this gives:-

    POSS:0: n=211 chars=FHLRSUVZ]
    POSS:1: n=209 chars=cdjkouwx~
    POSS:2: n=208 chars=DIJKLORUW^_
    POSS:3: n=209 chars=BIKSVW
    POSS:4: n=206 chars=bejkntvy~
    POSS:5: n=210 chars=@CDEFKQXZ
    POSS:6: n=208 chars="#)+.023678>?
    POSS:7: n=206 chars=fgmorswz|
    POSS:8: n=208 chars=behjknt~
    POSS:9: n=205 chars=GMORSTW\
    POSS:10: n=207 chars=FLWXY[\
    POSS:11: n=208 chars=cdjkoux~

You'll note that the actual key (SjJVkE6rkRYj) is present in this output. I'll carry on with this if I get a chance tomorrow.

A few months ago, I removed an almost identical piece of malware from a client's account. Looking through the server logs, I noticed that the script was still being accessed on a fairly regular basis. I dropped a simple script to dump the contents of the cookies and request variables to a file when accessed. It didn't take very long to obtain the key.