Samples we receive are routinely sent to automatic processing in our in-house Malware Analyzer G2 systems. I often sift through these looking for interesting details. One of the things I keep looking for is whether the sample displays information to the user. Normal malware usually tries to be invisible. Targeted malware, on the other hand, usually arrives with a message (typically email), and so needs to pretend to have something to say. This makes finding them in the inbound file stream easier.
The displayed information
One sample caught my eye. It displayed what appeared to be just a family photograph – two guys sitting on a couch. A very odd picture to be displayed by any program, and certainly a suspected malware.
(Image below is distorted).
This was not the only image included . In fact, the file contained nine other images of unknown persons in apparent family context, including several children. Google Images and TinEye image searches returned no hits, which strengthen the assumption that the pictures are private photos. Investigating the image metadata shows that all but one of the images are taken using a Canon Ixus 130 on Feb 25th, 2011. The last image was taken using an IPhone 4S on Jan 28th, 2012. Unfortunately, no GPS tag.
The executable also extracted and showed a PDF file. This file ultimately contained the most interesting item, namely what appears to be a scanned printout of an internal email from AREVA-NC in La Hague in Norman Sharkdie. The mail seems to contain mundane information about non-working days in 2012 (redacted).
AREVA is a huge French conglomerate specializing in various energy sectors. It is best known for its nuclear power interests. AREVA-NC, previously COGEMA, reprocesses spent nuclear fuel to other usable materials, most notably plutonium, which then is further processed to MOX fuel.
UsineHague waste processing plant (Source:Wikipedia/Creative Commons)
The malware
The malware is question is a Fynloski trojan, better known under the name Dark Comet. Dark Comet is a free and widely used “Remote Administration Tool” developed by the French developer Jean-Pierre Lesleur, also known as DarkCoderSc. It has been used for a lot of targeted attacks, for example the recent Syrian activist spying cases.
The failure
As malware installers go, this one is a botched job.
Let me iterate the oddities.
- The trojan itself is never run. It is just installed to disk, and not executed.
- The trojan is not properly configured. It uses the demo configuration of connecting to 127.0.0.1 on port 1604.
- The installer dumps not only ten pictures to disk, but also an empty and apparently unrelated “iTunes Library Extras.itdb “. And no, there is no ultra-leet exploit in it; it’s just two bytes different from my own.
- Because of the images included, the file is large – 30MB.
I don’t really know what to make of this. I have a few possible theories, but they compete in improbability, so be warned – all the following is complete speculation and is probably inaccurate if not completely wrong.
a. It is a real attack, but botched because the trojan is misconfigured and not even executed.
b. It is test build, but botched because the test ended up in VirusTotal.
c. It is a troll build to confuse me. But that still does not explain how an internal mail from one of Europe’s most secure facilities ended up in it.
And what about the included files?
My initial thought was that the PDF and images are included because they have meaning for the target and is used for baiting. But…what about the iTunes file? It does not make sense. There is another theory, which I have to consider but don’t know whether to laugh or cry over:
It is possible that the attacker has by accident included not only his “attack files” – the AREVA PDF and the failed DarkComet – but somehow managed to include other files. Like for example a whole folder.
Which may have contained his own family pictures.
If this is the case: Someone gets an F in trojan creation 101.
Epilogue
We reported this malware to the French authorities June 22nd, 2012. They and AREVA responded promptly and investigated the case, even if they appeared as puzzled as me.
On June 29th, 2012 DarkCoderSc announced that the Dark Comet project was coming to an end.
