Created
February 19, 2015 00:03
-
-
Save N0rm4n/91eaaf72af6bb8eb5854 to your computer and use it in GitHub Desktop.
hy Malware Authors choose some persian words for their C&C servers !?
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| http://www.twitter.com/nimahtter | |
| Thanks @nixfreakz for ur help :) | |
| ================================================================= | |
| Q: what's EquationDrug? | |
| A: EQUATIONDRUG– A very complex attack platform used by the group on | |
| Its victims. It supports a module plugin system, which can be dynamically | |
| Uploaded and unloaded by the attackers. | |
| "EQUATIONDRUG is one of the group’s most complex espionage platforms. | |
| The platform was developed between 2003 and 2013 and subsequently | |
| Replaced by GrayFish. It appears to have been created as an upgrade from | |
| The EQUATIONLASER platform." | |
| Source: EQUATION GROUP: QUESTIONS AND ANSWERS ver 1.5 | |
| =================================================================== | |
| Q: Why Malware Authors choose some persian words for their C&C servers !? | |
| A: Kaspersky has reported this part of Malware actively targeted old windows system like: (Windows95/98/me and Windows XP/2003). The timeline of develompent and infection of EquationDrug Malware was between 2003 and 2013. It's also used web-based exploit to spread Malware on targets. | |
| The other important note is EquationDrug used same Vulnerability for escalation of privilege to install Payload on remote target as Stuxnet (0day) we have seen before . | |
| This is why the authors of EquationDrug have chosen Peninglish* (Persian) words for most of C&C servers domains . They have tried to hide their network activity and this is why they show us the most of the targets should be located In IRAN cyber space for that timeline (2008-2013). | |
| * Fingilish, Pinglish, Penglish or Fargelisi (a portmanteau word formed from Persian + English, or Farsi + English) is the way Persian words are written using the Latin alphabet (as opposed to the Persian alphabet), or generally the casual romanization of Persian words popularized after computers, emailing and online chat became ubiquitous. This type of writing is commonly used in online chat, emails and SMS. It developed and spread due to a former lack of software supporting the Persian alphabet, and/or due to a lack of knowledge about the software that was available. Although Persian writing is supported in recent operating systems, there are still many cases where the Persian alphabet is unavailable and there is a need for an alternative way to write Persian with the Latin alphabet. | |
| Wiki Source: http://en.wikipedia.org/wiki/Fingilish | |
| I will translate Persian (Penglish words) . | |
| All of Domains Registred between 2008-2-28 (Thursday) 2008-2-29 (Friday) | |
| EquationDrug C&C servers : | |
| damavandkuh[.]com ---> Damavand (The name of famous Mountain in north of IRAN) , Kuh (Maountain) (Whois History 47 records have been archived since 2008-03-02) | |
| nowruzbakher[.]com ---> NowruzBakher (Something like happy new year) | Whois History 46 records have been archived since 2008-03-02 | |
| sherkhundi[.]com ---> sher (Song) , khundi (Read) | Whois History 46 records have been archived since 2008-03-02 | |
| foroushi[.]net ---> Foroshi (For sales) | Whois History 44 records have been archived since 2008-03-02 | |
| honarkhaneh[.]net ---> Honar (Arts) , Khaneh (Home) ---> Home of Arts | Whois History 45 records have been archived since 2008-03-02 | |
| parskabab[.]com ---> Pars (Name) , Kabab (Famous persian food) | Whois History 44 records have been archived since 2008-03-02 | |
| darakht[.]com ----> Darakht (Trees) | Whois History 45 records have been archived since 2008-03-02 | |
| ghalibaft[.]com ---> Don't find good word :) | Whois History 44 records have been archived since 2008-03-02 | |
| roshanavar[.]com ---> Don't find good word :) | 44 records have been archived since 2008-03-02 | |
| afkarehroshan[.]com ---> Afkareroshan (Bright Ideas) | Whois History 46 records have been archived since 2008-03-02 | |
| meevehdar[.]com ---> Meevehdar (Fruitful) | Whois History 45 records have been archived since 2008-03-02 | |
| honarkhabar[.]com ---> Honar (Art) , Khabar (News) | Whois History 44 records have been archived since 2008-03-02 | |
| zhalehziba[.]com ---> Zhaleh (Female Name) , Ziba (Cute, beautiful) | Whois History 42 records have been archived since 2008-03-02 | |
| havakhosh[.]com ---> Hava (Weather) , Khoosh (good) ---> Good Weather | Whois History 44 records have been archived since 2008-03-02 | |
| toofanshadid[.]com ---> Toofan (Storm) , Shadid (Huge) ---> Huge Storm | Whois History 45 records have been archived since 2008-03-02 | |
| bazandegan[.]com ---> Bazandegan (Losers) | Whois History 43 records have been archived since 2008-03-02 | |
| sherkatkonandeh[.]com ---> Sherkatkonandeh (contributor) | Whois History 43 records have been archived since 2008-03-02 | |
| mashinkhabar[.]com ---> mashin (same as Machine) , Khabar (news) ---> News Machine | Whois History 43 records have been archived since 2008-03-02 | |
| DoubleFantasy: | |
| * Nothing Persian Yet | |
| EquationLaser: | |
| * Nothing Persian Yet | |
| Fanny: | |
| * Nothing Persian Yet | |
| GrayFish: | |
| * Nothing Persian Yet | |
| TripleFantasy: | |
| * Nothing Persian Yet | |
| Equation group’s exploitation servers: | |
| * Nothing Persian Yet |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment