Xanda's Blog !~!


Yara Rule for Angler EK redirector JS

Few friends ping-ed me recently and asked for intel on Angler EK. One of the thing that i can really release publicly at the moment without interfering/conflicting with my employer’s interest, is the yara rule to detect the Angler Exploit Kit redirector. The redirector is actually JS code, injected to innocent page to redirect visitor to Angler Exploit Kit.

Here you go:

rule AnglerEKredirector
      description = "Angler Exploit Kit Redirector"
      ref = "http://blog.xanda.org/2015/08/28/yara-rule-for-angler-ek-redirector-js/"
      author = "adnan.shukor@gmail.com"
      date = "08-July-2015"
      impact = "5"
      version = "1"
      $ekr1 = "<script>var date = new Date(new Date().getTime() + 60*60*24*7*1000);" fullword
      $ekr2 = "document.cookie=\"PHP_SESSION_PHP="
      $ekr3 = "path=/; expires=\"+date.toUTCString();</script>" fullword
      $ekr4 = "<iframe src=" fullword
      $ekr5 = "</iframe></div>" fullword
      all of them
 August 28th, 2015  
 IT Related  
 0 Comment

Yara rule for jjencode

I’ve recently worked on yara rule to detect jjencode. So here is my simple rule:

rule jjEncode
      description = "jjencode detection"
      ref = "http://blog.xanda.org/2015/06/10/yara-rule-for-jjencode/"
      author = "adnan.shukor@gmail.com"
      date = "10-June-2015"
      version = "1"
      impact = 3
      hide = false
      $jjencode = /(\$|[\S]+)=~\[\]\;(\$|[\S]+)\=\{[\_]{3}\:[\+]{2}(\$|[\S]+)\,[\$]{4}\:\(\!\[\]\+["]{2}\)[\S]+/ fullword 

See you next time :)

 June 10th, 2015  
 IT Related  
 1 Comment

Fingerprinting (potential) Sinkhole Server

A short update, a note for myself

Last May, while discussing with a friend, we’ve concluded that these 2 header (HTTP header) example indicate that those servers are sinkhole servers:

HTTP/1.0 200 OK
Server: Apache 1.0/SinkSoft
Date: Tue, 27 May 2014 06:11:29 GMT
Content-Length: 0
Connection: close
HTTP/1.1 200 OK
Date: Mon, 26 May 2014 07:26:20 GMT
Server: Apache/2.2.20 (Ubuntu)
X-Sinkhole: malware-sinkhole
Vary: Accept-Encoding
Content-Length: 0
Content-Type: text/html

So we can look for:

  • Apache 1.0/SinkSoft
  • X-Sinkhole:

Today, I’ve found “Server: TornadoServer” is another indicator. But i’m not yet 100% sure. Comments are welcome

 July 1st, 2014  
 IT Related  
 0 Comment

Installing Compact Language Detection 2 (CLD2) on Ubuntu

I’ve been using chromium-compact-language-detector before, and when they moved to v2.0, chromium-compact-language-detector has been renamed in to Compact Language Detection 2 (CLD2). I’ve read blog post on the performance review and i’m really impressed. So let give them a try.

Install the dependencies:

sudo apt-get install mercurial gcc-multilib python-dev build-essential

Download CLD2 and the python binding:

cd /tmp/
svn checkout http://cld2.googlecode.com/svn/trunk/ cld2
hg clone https://code.google.com/p/chromium-compact-language-detector/

Compile CLD2 and install the lib (for 32bit) :

cd /tmp/cld2/internal/
cat compile_libs.sh | sed 's/\ \-m64\ //g' > compile_me.sh
chmod +x compile_me.sh
sudo cp *.so /usr/lib/

Compile CLD2 and install the lib (for 64bit) :

cd /tmp/cld2/internal/
sudo cp *.so /usr/lib64/

Compile the python binding:

cd /tmp/chromium-compact-language-detector/
python setup.py build
python setup_full.py build
sudo python setup.py install
sudo python setup_full.py install

Give the library a test:

python test.py

For documentation:

python -c "import cld2; help(cld2.detect)"

Done! Thanks

 April 2nd, 2014  
 IT Related  
 , ,   

Macports on Mavericks

Quick update for those who found something buggy with their Macports after upgraded their OSX to Mavericks

  1. Download and install Xcode 5.0.1
  2. Install Command Line Tool
    xcode-select --install
  3. Accept Xcode license agreement
    sudo xcodebuild -license
  4. Download Macports source
    cd /tmp
    wget https://distfiles.macports.org/MacPorts/MacPorts-2.2.0.tar.gz
  5. Extract and compile
    tar xvfz MacPorts-2.2.0.tar.gz
    cd MacPorts-2.2.0
    sudo make install
  6. Update your Macports
    sudo port -v selfupdate


 October 24th, 2013  
 IT Related  
 1 Comment