Harry Potter and the Rogue anti-virus: Part 1

Published: 2011-06-13. Last Updated: 2011-06-13 08:20:42 UTC
by Bojan Zdrnja (Version: 1)

My colleague Branko and I spent a lot of time reversing various FakeAV/RogueAV copies as we were quite interested in how they manage to constantly have < 5 detections on VirusTotal (and therefore successfully evade detection by normal anti-virus programs).

We noticed that various FakeAV versions use pretty advanced obfuscation, basically anything you can think of: anti-disassembly (destroying functions, opaque predicates, long ROP chains ...), anti-emulation, anti-VM, anti-debugging, even with some bugs of their own.

Branko spent a lot of time analyzing this to improve his Optimice plugin for IDA Pro. If you haven’t heard about it, and you spend a lot of time analyzing malware or reverse engineering binaries, be sure to check it at http://code.google.com/p/optimice/. It’s an amazing tool that can cut down on your time spent on reversing by an order of magnitude.

Below is a screenshot of what Optimice can do – on the left side you can see the original FakeAV code, while on the right you can see the same code after Optimice deobfuscated and optimized it. Much easier to analyze, isn’t it:

Back to FakeAV now – time to explain the title of this diary. While reversing one of the FakeAV copies we noticed that under certain circumstances (when FakeAV is trying to update itself), it basically calls its own binary with a very interesting argument, as you can see in the screenshot below:

Those Harry Potter fans among you probably immediately noticed the argument BOMBARDAMAXIMUM which, according to some online references is “a spell that, being a stronger version of Bombarda, provokes explosions capable of bringing an entire wall down”. I’m not sure which wall this is about, but at least there is some sense of humor here.
If the argument was supplied, the binary will call two functions: the first one will create couple of mutexes, while the second function will connect to a C&C, send some data and (probably – we couldn’t confirm this since the C&C is down) updates itself. This part of code is shown below: