Liberty Exploit System kit

[SysAdMini]

We have found some installation of the "Liberty Exploit System" kit in the last days.
It seems to be a new exploit kit.

Article at Mipistus blog
http://translate.google.com/translate?js=y&prev=_t&hl=es&ie=UTF-8&u=http%3A%2F%2Fmipistus.blogspot.com%2F2009%2F08%2Fliberty-exploit-system-otra-alternativa.html&sl=auto&tl=en&history_state0=

Some info about it at opensc.ws forum
http://www.opensc.ws/trojan-discussion-general-help/6211-actual-exploit-packs.html

examples:
http://www.malwaredomainlist.com/mdl.php?search=210.51.166.239&colsearch=All&quantity=50&inactive=on
http://www.malwaredomainlist.com/mdl.php?search=bsidiket.cn%2Fvn&colsearch=All&quantity=50&inactive=on
http://www.malwaredomainlist.com/mdl.php?search=updateservisetf.ru%2Falt%2F&colsearch=All&quantity=50&inactive=on
http://www.malwaredomainlist.com/mdl.php?search=fhijafif.cn%2Ffex&colsearch=All&quantity=50&inactive=on

The most interesting part is the pdf exploit of this kit. It is badly detected by most av products and also Wepawet fails to decode/detect it.
http://www.malwaredomainlist.com/forums/index.php?topic=2533.msg11410#msg11410

This is the detection rate of the last pdf file that I have seen today:
http://www.virustotal.com/analisis/1f7775592c857d5a4c4e216c2e9a77adb3986920ed5ba05ea7c7c3e04f48f01b-1251124874 5/41

[sursmurf]

Flash
[VT 0/41]
http://www.virustotal.com/sv/analisis/98498fda588dde4994d9fef38c1a24254aa5df4492ea73c9ece44f77630bb165-1251201197

Code: [Select]

http://adultping.net/tx/isntSome.swf

PDF
[VT3/41]
http://www.virustotal.com/sv/analisis/45baf4ac46fa750235ab7595a76a16b71331a82a48e6f4c1de156db244f91a36-1251201222

Code: [Select]

http://adultping.net/tx/exactSitDummy.pdf

[SysAdMini]

Code: [Select]

placecorp.info/tom/ofOverEtc.pdfhttp://www.virustotal.com/analisis/f7a0a7dbaefeb9e2c793ad046b2cdcdcad37997df9e056d760df0f7b7559b755-1251205668 4/41

Code: [Select]

placecorp.info/tom/isAnEthics.swfhttp://www.virustotal.com/analisis/1e930611fbaffe6c1d650d431726428a7c17950a881865a023638475fadafae9-1251206031 0/41

Code: [Select]

placecorp.info/tom/update.php?id=0http://www.virustotal.com/de/analisis/38be802c8d39f404b3ff72ddfa821588a556867f5b1337cb62ba831db3d46ed1-1250620238 3/41

control panel as usual

Code: [Select]

placecorp.info/tom/admin.php

[sursmurf]

Code: [Select]

http://franchjump.ru/lib/belowTendSome.pdf7/41
http://www.virustotal.com/sv/analisis/5434abe05a5ae1114754176e7297839e96d2b9ebe8082e28c31a3d2944e1cbe5-1251440682

Code: [Select]

http://franchjump.ru/lib/evilSOr.swf3/41
http://www.virustotal.com/sv/analisis/640e72c3753dd90322fbb26728d44011e0041824ede84419474f19b5227b38b9-1251440813

Code: [Select]

http://franchjump.ru/lib/update.exe11/41
http://www.virustotal.com/sv/analisis/d35dbb8eb7cc043ccb7f92aabe8886785ad35adb54cc8c139bdee00ab8d89c50-1251440850

[SysAdMini]

Complex Obfuscated JS code in PDF ** fhijafif.cn
http://www.web2secure.com/2009/08/complex-obfuscated-js-code-in-pdf.html

http://www.malwaredomainlist.com/mdl.php?search=fhijafif.cn&colsearch=All&quantity=50

[SysAdMini]

control panel of Liberty exploit kit

Code: [Select]

wwwudacha.com/hi/admin.php
exploits

Code: [Select]

wwwudacha.com/hi/index.php

pdf exploit

Code: [Select]

wwwudacha.com/hi/thereRandomOver.pdfhttp://www.virustotal.com/analisis/089f849dedefae01e823c98970bbec3bf770d35c429e7b7794b2b37a0c3f7de5-1251461403 6/41

flash exploit

Code: [Select]

wwwudacha.com/hi/upAnd.swf
http://www.virustotal.com/analisis/a0c37d24adddb344c1b1372c2a50828a78f32765dc3314f0e13b6b05220da3e7-1251461454 2/41

zeus/wsnpoem v2 trojan

Code: [Select]

wwwudacha.com/hi/update.php
http://www.virustotal.com/analisis/a1fef9948b991bb6c632508beb54f3b5b2ad660b5510cc0040fa50ff8591ee11-1251461656 14/40

[RS-232]

hxxp://xtraff.cn/scr/in.cgi?5

-> redirs to wwwudacha.com above...

[Malware-Web-Threats]

Code: [Select]

libesouz.ru/pao/
libesouz.ru/pao/yearsWeb.swf
libesouz.ru/pao/hasWordsBy.pdf
libesouz.ru/pao/update.php
libesouz.ru/pao/update.exe
libesouz.ru/pao/admin.php

pdf:
Wepawet
flash:
Wepawet
exe:
Wepawet
VirusTotal -1252535823  3/41 (7.32%)

Comodo - Heur.Packed.Unknown
Microsoft - TrojanDownloader:Win32/Cutwail.AQ
Rising - Packer.Win32.Mian007.a

http://wepawet.iseclab.org/domain.php?hash=86ed513f9307e4ec8349ea63d1f9d2ba&type=js

[Malware-Web-Threats]

Exploits:

Code: [Select]

hoooools.com/love/index.php
hoooools.com/love/sMoreUp.pdf
hoooools.com/love/ipsumUpTend.swf

Trojan:

Code: [Select]

hoooools.com/love/update.php

Control Panel:

Code: [Select]

hoooools.com/love/admin.php

Wepawet
VirusTotal - Trojan.Agent - 12/41 (29.27%)

[Malware-Web-Threats]

Exploits:

Code: [Select]

fornistan.cn/hunter/
fornistan.cn/hunter/sureRandom.pdf
fornistan.cn/hunter/willSheets.swf

Trojan:

Code: [Select]

fornistan.cn/hunter/update.php
fornistan.cn/hunter/update.exe

Control Panel:

Code: [Select]

fornistan.cn/hunter/admin.php

http://wepawet.iseclab.org/view.php?hash=f9da5de4318b7cabb7b3e830069a7249&t=1252759094&type=js

[Malware-Web-Threats]

Exploits:

Code: [Select]

ericwanhouse.cn/forum/
ericwanhouse.cn/forum/looksBy.pdf
ericwanhouse.cn/forum/latinInWeb.swf

Trojan:

Code: [Select]

ericwanhouse.cn/forum/update.php
ericwanhouse.cn/forum/update.exe

Control Panel:

Code: [Select]

ericwanhouse.cn/forum/admin.php

http://wepawet.iseclab.org/view.php?hash=4efd106b35edb3e6b8884ce7bf009d1c&t=1252762184&type=js

[Malware-Web-Threats]

Exploits:

Code: [Select]

search890.com/in/index.php
search890.com/in/hAtNot.pdf
search890.com/in/galleyLorem.swf

Trojan TDSS:

Code: [Select]

search890.com/in/update.php
search890.com/in/update.exe

Control Panel:

Code: [Select]

search890.com/in/admin.php

Wepawet
VirusTotal - Trojan TDSS - 23/41 (56.10%)

http://www.malwaredomainlist.com/mdl.php?inactive=on&sort=Date&search=chen.poon1732646@yahoo.com&colsearch=All&ascordesc=ASC&quantity=100&page=0

[WIEx]

Malware-Web-Threats,

Code: [Select]

http://search890.com/in/admin.php
login - user, password - pass

Screenshots:

http://img183.imageshack.us/img183/9253/43881823.png
http://img183.imageshack.us/img183/8742/28445300.png
http://img9.imageshack.us/img9/9541/58009081.png
http://img9.imageshack.us/img9/2248/36189791.png

150.000 visitors, 7.000 infected

[WIEx]

Code: [Select]

http://nfovidab.cn/stat1/admin.php
login - user
pass - pass

[WIEx]

Code: [Select]

http://hoooools.com/love/admin.php
user, pass