About contagio exchange

CONTAGIO EXCHANGE Contagio exchange was created to absorb malware samples shared by readers of Contagio. This is meant to be a community driven malware collection.
Edit Aug 2013 - The community is busy and Mila too so this was not a very active site (my fault probably) so I will be just dumping malware strings here - it often helps in malware identification and googling is the best way.
With just strings, not exactly a fun blog to read but might become s useful resource over time.
I will not be posting samples here, just md5. You can find the corresponding samples on contagio or ping me if you can't find
M
P.S. Robot pictures delivered by Robohash.com (generated from file hashes)

Monday, August 12, 2013

Beebus Warp strings - APT

File: Beebus_WARP_D7EC457BE3FAD8057580E07CAE74BECB
MD5:  d7ec457be3fad8057580e07cae74becb
Size: 80896






Ascii Strings:
---------------------------------------------------------------------------
!This program cannot be run in DOS mode.
S%Rich|
.text
`.rdata
@.data
----------------------------snip
_^[]
FGQPS
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
?456789:;<=
 !"#$%&'()*+,-./0123
 (8PX
700WP
`h````
ppxxxx
(null)
GAIsProcessorFeaturePresent
KERNEL32
e+000
runtime error
TLOSS error
SING error
DOMAIN error
R6028
- unable to initialize heap
R6027
- not enough space for lowio initialization
R6026
- not enough space for stdio initialization
R6025
- pure virtual function call
R6024
- not enough space for _onexit/atexit table
R6019
- unable to open console device
R6018
- unexpected heap error
R6017
- unexpected multithread lock error
R6016
- not enough space for thread data
abnormal program termination
R6009
- not enough space for environment
R6008
- not enough space for arguments
R6002
- floating point not loaded
Microsoft Visual C++ Runtime Library
Runtime Error!
Program:
<program name unknown>
GetLastActivePopup
GetActiveWindow
MessageBoxA
user32.dll
1#QNAN
1#INF
1#IND
1#SNAN
string too long
invalid string position
Unknown exception
GetDiskFreeSpaceW
GetDiskFreeSpaceExW
GetDriveTypeW
SetErrorMode
FindNextFileW
FindFirstFileW
VirtualAlloc
GetComputerNameW
GetVolumeInformationA
FindFirstVolumeA
LoadLibraryA
GetProcAddress
ExpandEnvironmentStringsA
GetStartupInfoA
CreatePipe
PeekNamedPipe
CloseHandle
DeleteCriticalSection
HeapFree
GetLastError
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileA
ReadFile
WriteFile
KERNEL32.dll
wsprintfW
USER32.dll
InternetCloseHandle
InternetAttemptConnect
InternetConnectA
InternetOpenA
HttpSendRequestA
InternetSetCookieA
HttpAddRequestHeadersA
HttpOpenRequestA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpQueryInfoA
InternetReadFile
WININET.dll
RtlUnwind
RaiseException
GetModuleHandleA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
CreateFileW
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
LCMapStringA
LCMapStringW
KERNEL32
USER32
ADVAPI32
WSOCK32
GetProcAddress
GetProcessHeap
HeapAlloc
LoadLibraryA
FreeLibrary
CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateFileMappingA
CreateMutexA
CreateProcessA
CreateRemoteThread
CreateThread
DuplicateHandle
DeleteFileA
ExitProcess
ExitThread
EnterCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
FlushViewOfFile
GetCommandLineA
GetComputerNameA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceA
GetDriveTypeA
GetExitCodeThread
GetFileAttributesA
GetFileSize
tLocalTime
GetLogicalDriveStringsA
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileSectionA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
GetPrivateProfileStructA
GetSystemInfo
GetSystemDirectoryA
GetSystemTime
GetTickCount
GetTempPathA
GetVersionExA
GetWindowsDirectoryA
GetDiskFreeSpaceExA
GlobalAlloc
GlobalMemoryStatus
GlobalFree
DeleteCriticalSection
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
IsBadCodePtr
LeaveCriticalSection
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
MapViewOfFile
MapViewOfFileEx
MoveFileA
MoveFileExA
OutputDebugStringA
OpenFileMappingA
OpenProcess
ReadFile
ReadProcessMemory
ReleaseMutex
RemoveDirectoryA
ResumeThread
SearchPathA
SetEndOfFile
SetFileAttributesA
SetFilePointer
SetPriorityClass
SetThreadPriority
Sleep
SuspendThread
TerminateProcess
TerminateThread
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtect
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WaitForMultipleObjects
WriteFile
WritePrivateProfileSectionA
WritePrivateProfileStringA
WritePrivateProfileStructA
WriteProcessMemory
CreateToolhelp32Snapshot
Process32First
Process32Next
Thread32First
Thread32Next
RegisterServiceProcess
AttachThreadInput
ClientToScreen
ClipCursor
CloseWindow
CharUpperA
CreateDialogParamA
CreateWindowExA
DefDlgProcA
DefFrameProcA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
EnableWindow
EndDialog
ExitWindowsEx
GetClassNameA
GetCursorPos
GetDesktopWindow
GetDlgItem
GetDlgItemInt
GetDlgItemTextA
GetForegroundWindow
GetMenu
GetMessageA
GetWindow
GetWindowLongA
GetWindowThreadProcessId
GetWindowTextA
IsWindow
IsWindowEnabled
IsWindowVisible
KillTimer
LoadCursorA
LoadIconA
LoadImageA
MessageBoxA
PeekMessageA
PostThreadMessageA
PostQuitMessage
RegisterClassA
RegisterClassExA
ScreenToClient
SendMessageA
SetCursor
SetDlgItemInt
SetDlgItemTextA
SetMenu
SetTimer
SetWindowLongA
SetWindowTextA
SetWindowPos
ShowWindow
TranslateMessage
UnregisterClassA
wvsprintfA
wsprintfA
GetUserNameA
AdjustTokenPrivileges
GetTokenInformation
LookupAccountSidA
LookupAccountNameA
LookupPrivilegeValueA
OpenProcessToken
GetLengthSid
RegConnectRegistryA
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumKeyExA
RegEnumValueA
RegGetKeySecurity
RegSetKeySecurity
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
EnumServicesStatusA
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
StartServiceA
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
InitializeAcl
InitializeSecurityDescriptor
AddAccessAllowedAce
GetAce
accept
bind
closesocket
connect
gethostbyname
gethostbyaddr
gethostname
getsockname
htonl
htons
ntohl
ntohs
listen
inet_addr
inet_ntoa
ioctlsocket
recv
recvfrom
select
send
sendto
setsockopt
socket
WSAGetLastError
WSACleanup
WSAStartup
!(*@)(!@IP
68.96.31.136
image/gif
Mozilla/4.0 (compatible; )
/s/asp?
%u.%u.%u.%u
http://
Unknown type!
Ramdisk
 Bytes free: %u MB(%s)/%u MB(%s)
CD-ROM
Remote
Fixed
Removable
Unable to determine.
%c:\
Memory: %dM in use: %d%%  Page file: %dM free: %dM
Microsoft Win32s
Windows ME
Windows 98
OSR2
Windows 95
%s %s (Build %d)
%s Version %d.%d %s (Build %d)
 Advanced Server
SERVERNT
LANMANNT
WINNT
ProductType
SYSTEM\CurrentControlSet\Control\ProductOptions
 Server
 DataCenter Server
 Professional
 Personal
Windows XP
Windows 2000
Windows NT 4
Could not get version info.
CPU Speed: %d.%d MHz
MIPSR4000
UNKNOWN
I586
I386
I486
Processor:
Current Process id is %d
Start time %d day,%d hours,%d min,%d sec
Current user: '
System info for machine '
avp.exe
\cmd.exe
%USERPROFILE%\Temp\~ISUN32.EXE
sleep
\~ISUN32.EXE
%USERPROFILE%\Temp
%SystemRoot%\System32\cmd.exe
 0@PX`hpx
  !!""##$$%%&&''(())**++,,--..//0123456789:;<=>?
Content-Type: multipart/form-data; boundary=--MULTI-PARTS-FORM-DATA-BOUNDARY
Content-Type: application/x-www-form-urlencoded
http
https
.PAX
.PAD
unknown exception...
open internet failed...
connect failed...
handle not opened...
request failed...
add cookie failed...
https://
additional header failed...
Accept: */*
HTTP/1.0
POST
--%s
Content-Disposition: form-data; name="%s"
--%s
Content-Disposition: form-data; name="%s"; filename="%s"
request failed
Content-Length: %d
--MULTI-PARTS-FORM-DATA-BOUNDARY
query cookie failed...
query content-length failed...
query content-type failed...
response failed...
connection failed...
.?AVtype_info@@
kU'9
HMXB
?Zd;
?/L[
S;uD
z?aUY
D?$?
U>c{
zc%C1
.:3q
-64OS
NKeb
.?AVexception@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@

Unicode Strings:
---------------------------------------------------------------------------
jjjjj
jjjjj
jjjj
jjjj
(null)
%c:\
%2.2d-%2.2d-%4.4d %2.2d:%2.2d
-------
My Computer
         (((((                  H