[42309] in bugtraq
Re: MSN Messenger Password Decrypter for WinXP/2003
daemon@ATHENA.MIT.EDU (frank boldewin)
Wed Jan 18 18:56:09 2006
Message-ID: <00a501c61bba$e53376a0$3500a8c0@MSGBLWD1>
From: "frank boldewin" <frank.boldewin@gmx.de>
To: <bugtraq@securityfocus.com>
Date: Wed, 18 Jan 2006 00:08:13 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
type="text/plain";
boundary="----=_NextPart_000_00A2_01C61BC3.46AA0CC0"
This is a multi-part message in MIME format.
------=_NextPart_000_00A2_01C61BC3.46AA0CC0
Content-Type: text/plain;
format=flowed;
charset="iso-8859-1";
reply-type=original
Content-Transfer-Encoding: 7bit
the MSN-Password-Recovery.exe is a normal nullsoft installer.
after installing the software there's one pe-file called:
MSN Password Recovery.exe
which is upx packed. after unpacking with upx -d
i throwed it into IDA and had a short look for suspicious code snippets.
funny is this one:
.text:004021AF call ebp ; SendDlgItemMessageA
.text:004021B1 push offset OutputString ; "Greetings to
all reversers who reverse" ...
.text:004021B6 call OutputDebugStringA
.text:00401260 OutputString db 'Greetings to all reversers who reverse
this program - it',27h
.text:00401260 db 's easier to make another program rather
than brake ours!',0Ah
;)
basically it enums the creds and if it finds one, the tool looks eg. at:
HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Creds\username@blabla.com
key ps:password and it's values
then decrypts with CryptUnprotectData() and shows you the password to the
cred if you're a registered customer. ;)
but i really can't find malicious stuff in there, nor phone home stuff.
with regards,
frank
> On 13 Jan 2006 00:51:37 -0000, kukukuku.com <kukukuku.com> wrote:
> Doesn't work anymore in 7.5. This tool works though:
> http://www.msn-password-recovery.com
>
> File: MSN-Password-Recovery.exe
> Status:
> MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or
> runtime packers were found, this is suspicious. Normally programs
> aren't packed and don't force the sandbox into lengthy emulation. Do
> realize no scanner issued any warning, the file can very well be
> harmless. Caution is advised, however.) (Note: this file has been
> scanned before. Therefore, this file's scan results will not be stored
> in the database)
> MD5 2784bee6f9bd768fb67dd5cb028345ad
> Packers detected: UPX
> The link on that site to the Skype recovery tool domain leads to a
> completely
> unrelated ad for a website building software package
------=_NextPart_000_00A2_01C61BC3.46AA0CC0
Content-Type: image/gif;
name="at.gif"
Content-Transfer-Encoding: base64
Content-Location: http://archives.neohapsis.com/imgs/at.gif
R0lGODlhEgARAID/AMDAwAAAACH5BAEAAAAALAAAAAASABEAAAIrhI+pyxoPG3iOhXariTkfD3aJ
iJDfVp7ptHpqiGoctbjaaE95CdHSD1wUAAA7
------=_NextPart_000_00A2_01C61BC3.46AA0CC0--
