msm-code

rule nymaim: trojan
{
    meta:
       author     = "mak"

    strings:
       $call_obfu_xor = {55 89 E5 5? 8B ?? 04 89 ?? 10 8B ?? 0C 33 ?? 08 E9 }
       $call_obfu_add = {55 89 E5 5? 8B ?? 04 89 ?? 10 8B ?? 0C 03 ?? 08 E9 }
       $call_obfu_sub = {55 89 E5 5? 8B ?? 04 89 ?? 10 8B ?? 0C 2b ?? 08 E9 }
       $nym_get_cnc = {E8 [4] C7 45 ?? [4] C7 45 ?? [4] 83 ??}//3D[4] 01 74 4E E8}

msm-code

<b84216c7> <<< [+] [     4 bytes]:
    client ip 195.187.238.160

<be8ec514> <<< [+] [   257 bytes]:
    uri found:                         66.168.203.239:34352
    uri found:                         98.109.148.2:34352
    uri found:                         80.147.180.254:34352
    uri found:                         162.222.25.250:34352
    uri found:                         78.28.51.22:34352
    uri found:                         75.166.109.79:34352

msm-code

<d2bf6f4a> >>> [+] [    62 bytes]:
    state information:
        data field 0:               0x263
        data field 1:               0x23426908
        data field 2:               0x0
        data field 3:               0x0        <- injects version
        data field 4:               0x0
        data field 5:               0x0
        data field 6:               0x0        <- webfilters version
        data field 7:               0x0

msm-code

def inner_decrypt(raw, rsa_key):
    encrypted_header, encrypted_data = raw[-0x40:], raw[:-0x40]
    decrypted_data = rsa_decrypt(encrypted_header, rsa_key)

    md5 = decrypted_data[0:16]
    blob = decrypted_data[16:32]
    length = from_uint32(decrypted_data[32:36])

    serpent_decrypted = crypto.s_decrypt(encrypted_data, blob)[:length]
    assert md5 == hashlib.md5(serpent_decrypted).digest()

msm-code

def parse_message(blob):
    i = 0
    while i < len(blob):
        chunk_type = blob[i:i+4]
        chunk_len = from_uint32(blob[i+4:i+8])
        chunk_content = blob[i+8:i+8+chunk_len]
        process_chunk(chunk_type, chunk_content)
        i += 8 + chunk_len

msm-code

def nymaim_decrypt(key, raw_bytes):
    nibble0 = raw_bytes[0] & 0xF
    nibble1 = raw_bytes[1] & 0xF
    salt = raw_bytes[2:2+nibble0]
    password = key + salt

    data = raw_bytes[2+nibble0:len(raw_bytes)-nibble1]
    decrypted = rc4_decrypt(password, body)
    decrypted_len = struct.unpack('<I', decrypted[:4])[0]
    assert decrypted_len == len(decrypted - 4)

msm-code

╰─$ strings decrypted_nymaim | grep -E "nginx" -B 4
HTTP/1.1 200 OK
Connection: close
Content-Length: %u
Content-Type: application/octet-stream
Server: nginx/1.9.4

msm-code

╰─$ strings decrypted_nymaim | grep -E "PortMap|upnp"
DeletePortMapping
urn:schemas-upnp-org:service:WANPPPConnection:1
urn:schemas-upnp-org:device:InternetGatewayDevice:1
GetSpecificPortMappingEntry
upnp:rootdevice
AddPortMapping
AddAnyPortMapping
urn:schemas-upnp-org:service:WANIPConnection:1
NewPortMappingDescription

msm-code

╰─$ strings decrypted_nymaim | grep -E "#!#|Firewall"
#!#*|Action=Allow|#*
#!#*|Action=Block|#*
#!#*|Active=TRUE|#*
#!#*|Active=FALSE|#*
#!#*|Dir=In|#*
#!#*|Dir=Out|#*
#!#*|Profile=Private|#*
#!#*|Profile=Public|#*
#!#*|LPort=#*

msm-code

def dga_single(self, state):
    name = ''
    len = self.getbyte(state, 8) + 5
    for i in range(len):
        r = self.getbyte(state, 0xFFFFFFFF)
        c = self.getbyte(state, 26) + 0x61
        name += chr(c)
    n = 0
    while n == 0:
        n = self.getbyte(state, 5)