BadRabbit-based network discovery

rabbit_ldr.cpp

#include <stdio.h>
#include <windows.h>

#pragma comment(lib,"Ws2_32.lib")

#include "peconv.h"
#include "resource.h"

signed int (__cdecl *setup_flags)(BYTE *buffer) = nullptr; //0x7897
signed int (__cdecl *scan_all_network)() = nullptr; //77D1 - scan all

//6B95 - add_to_list

int __stdcall add_to_list(LPCRITICAL_SECTION lpCriticalSection, wchar_t *buf, int flag)
{
	std::wcout << "adding: " << buf << " : " << flag << std::endl;
	return 0;
}

DWORD* g_Flag = nullptr;//17B8C
DWORD* g_Flags1 = nullptr;//
DWORD* g_Flags2 = nullptr;//0x17B7C

VOID WINAPI my_Sleep(DWORD dwMilliseconds)
{
	std::cout << "Sleeping: " << std::dec << dwMilliseconds << std::endl;
	Sleep(dwMilliseconds);
}

BYTE* load_malware()
{
	size_t raw_size = 0;
	BYTE *raw_exe = peconv::load_resource_data(raw_size, RABBIT32, RT_RCDATA, peconv::get_current_module_handle());
	if (!raw_exe) {
		std::cerr << "Failed to load the resource!" << std::endl;
		return nullptr;
	}
	size_t v_size = 0;
	peconv::hooking_func_resolver my_res;
	my_res.add_hook("Sleep", (FARPROC) &my_Sleep);

	BYTE *malware = peconv::load_pe_executable(raw_exe, raw_size, v_size, (peconv::t_function_resolver*) &my_res);
	peconv::free_resource_data(raw_exe);
	return malware;
}


bool make_network_scan(PBYTE malware)
{
	WSADATA wsaData = {0};
	if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
		return false;
	}
	peconv::redirect_to_local32((PBYTE)((ULONGLONG)malware + 0x6E66), (DWORD) &add_to_list);

	ULONGLONG func_offset = (ULONGLONG)malware + 0x77D1;
	scan_all_network = (int (__cdecl *) ()) func_offset;
	std::cout << "Deploying scan:" << std::endl;
	scan_all_network();
	return true;
}

void load_global_flags(PBYTE malware)
{
	BYTE buffer[0x1000] = { 0 };
	ULONGLONG func_offset = (ULONGLONG)malware + 0x7897;
	setup_flags = (int (__cdecl *) (BYTE*)) func_offset;

	g_Flag = PDWORD((ULONGLONG)malware + 0x17B8C);
	g_Flags1 = PDWORD((ULONGLONG)malware + 0x17BC0);
	g_Flags2 = PDWORD((ULONGLONG)malware + 0x17B7C);
	*g_Flag = 0;
	setup_flags(buffer);

	std::cout << std::hex << *g_Flags1 << std::endl;
	std::cout << std::hex << *g_Flags2 << std::endl;
}


int main(int argc, char *argv[])
{

	BYTE *malware = load_malware();
	if (!malware) {
		std::cout << "Failed to load" << std::endl;
		system("pause");
		return -1;
	}

	load_global_flags(malware);
  
	make_network_scan(malware);
  
	system("pause");
	return 0;
}

resource.h

// resource.h

#define RABBIT32 101

resource.rc

// resource.rc :

// Microsoft Visual C++ generated resource script.
//
#include "resource.h"

#define APSTUDIO_READONLY_SYMBOLS
/////////////////////////////////////////////////////////////////////////////
//
// Generated from the TEXTINCLUDE 2 resource.
//
#include "windows.h"

/////////////////////////////////////////////////////////////////////////////
#undef APSTUDIO_READONLY_SYMBOLS

/////////////////////////////////////////////////////////////////////////////

#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_PLK)
LANGUAGE LANG_ENGLISH, SUBLANG_DEFAULT

#ifdef APSTUDIO_INVOKED
/////////////////////////////////////////////////////////////////////////////
//
// TEXTINCLUDE
//

1 TEXTINCLUDE 
BEGIN
    "resource.h\0"
END

2 TEXTINCLUDE 
BEGIN
    "#include ""windows.h""\r\n"
    "\0"
END

3 TEXTINCLUDE 
BEGIN
    "\r\n"
    "\0"
END

#endif    // APSTUDIO_INVOKED


/////////////////////////////////////////////////////////////////////////////
//
// RCDATA
//

//this is an unpacked sample with a given md5.
RABBIT32    RCDATA  "1d724f95c61f1055f0d02c2154bbccd3.mwr"

#endif
/////////////////////////////////////////////////////////////////////////////

You can built it using: https://github.com/hasherezade/libpeconv_project_template
Requires original malware sample: 1d724f95c61f1055f0d02c2154bbccd3.mwr

See the compiled version deployed on HA: https://www.hybrid-analysis.com/sample/d0216c795599c117b9c8eafc679370634413a9697d0326f33a1e1ce431373ce2/5ad22d777ca3e15db4272883