Crimepack 3.1.3 Exploit kit Leaked, available for Download !
May 15, 2011
Crimepack 3.1.3 Exploit kit Leaked, available for Download ! Part 1 : Java Exploit As stated above, I focus on a malware that exploits a recent JRE vulnerability: CVE-2010-0840 to execute malicious files on a victim system. This malware comes inside a jar file, which contains the following two classes: Crimepack.class and KAVS.class. Part 1.1 : Crimepack.class This class is the engine of the malware, it is obfuscated, but you can quickly strip off the obfuscation (my python beta tool is great…), once you get rid of the obfuscation you can see the following code: As always, we have an Applet that access to the data parameter, generates a random name for the exe payload that will be dropped in the system temp directory and then executed. So at this point as you can see we have nothing new, the above is a common Java downloader… but let’s scroll down: Above, we can see that the malware is creating a new instance of the KAVS class (description follows), in order to trigge...
SentinelOne
