!!!!!!!! WARNINGS !!!!!!!!
THIS REPOSITORY CONTAINS MALWARES!!!! DON'T DOWNLOAD OR RUN ANYTHING IN IT UNLESS YOU CLEARLY UNDERSTAND WHAT YOU ARE DOING!!!!
!!!! 警告 !!!!
該目錄下存有病毒程式!!!! 請不要嘗試下載或運行裡面的任何程式,除非你非常清楚你在幹什麼!!!!
DCM Virus Samples
DCM is a Trojan Spy-ware dedicated to APT attack of specific targets. It's first disclosed by Tecent's security team on Freebuf.[1] It's developed by Chinese agency which rumored to be some g0v related people. A self-claimed author member "DcmTeamMember" on V2EX posted the insights about the creation of the virus.[2]
This repository contains some samples of the DCM virus collected from various online virus sharing channels. The naming is the file's MD5 hash. If the original file is packed (usually with UPX) then an unpacked version is provided for convinence.
278ce79753aaa050fe750baba43490e5
Report: http://r.virscan.org/report/fee007c110eeb4dfdba508120ab6bef4
This is the exact version used in the analysis article on Freebuf. So
I will personally refer it as DCM-0
.
The resource files in the unpacked executable is encrypted with simple
XOR algorithm. (implemented in sub_4011C0
) I added a decryption
script for your convinence. The extracted and decrypted resource files
are also included.
1b7cd62b71235443cf267bd9104679dd
Report: https://totalhash.cymru.com/analysis/?fbbbc68a4b56c9c70487753be3c26f4293e79ec9
This version has the same program structure as DCM-0
. Even the
resource files are encrypted with the same algorithm. However the binary
seems to be a slightly larger than DCM-0
thus I would guess it's an
upgraded version to DCM-0
.
261f4bbc423d79a1115840f300d5daf0
Report: https://totalhash.cymru.com/analysis/?30161f778c28443b40b5cef76dc977b0c2c4c352
This version is another slightly changed DCM-0
. It has less behaviour
characteristics on the report. I will categorize these 5 bin resources
silimar to DCM-0
samples as DCM-Δ
.
89a5257fd9415b68ceab4a2122f70b45
Report: https://totalhash.cymru.com/analysis/?823daa3fe3c32c32573b0317b488db901a191018
This version is basically the same as DCM-0
with some minor changes.
I also contains 5 bin resources, thus is a DCM-Δ
.
82304a0a2ab419f657a4e9d8319c1e99
Report: https://totalhash.cymru.com/analysis/?6f31aa2d01c5a67744fa8688933ae31dfc5a9c0d
This sample is reported to create mutex named Global\I_AM_EXIST!!
,
which is an identifier of the DCM behaviour. However it lacks of any
other behaviour that a typical DCM virus should has. Therefore I think
it's actually an early or experimental version of DCM-0
. It even doesn't
encrypt its resource files.
1b2f0cbd3f048ee9f3e9885d4076ce8c
Report: https://home.mcafee.com/virusinfo/virusprofile.aspx?key=2236045
I believe it's an early version DCM virus due to the small file size
with only two bin resources, and lack of most of the behaviour
characteristics of DCM-0
. However, it does generate
%TEMP%\{E53B9A13-F4C6-4d78-9755-65C029E88F02}\soft.prog
and other
core files that we can be certain that it's a variation of DCM.
Unlike 82304a0a2ab419f657a4e9d8319c1e99
, this version uses XOR encryption
for its resource files, but is slightly different than the algorithm used
in DCM-0
in terms of parameters. Thus I think it's a development upgrade
of 82304a0a2ab419f657a4e9d8319c1e99
.
1c37bcd907b6d574d9b204bbe5d4e4f6
Yet another DCM-Δ
.
3e6aaf3e34ec2668c34c5ffe34b01b33
Yet another DCM-Δ
.
4e90773b7e4adc5ff16e31f5d4942452
Yet another DCM-Δ
.
8b32eef5829507e469f294999a28ff23
This one seems to be a further upgrade to 1b2f0cbd3f048ee9f3e9885d4076ce8c
since they has the same bin resource encryption algorithm, but this one
has one more bin resource file implementing LSP hijacking.
33c79e9a3cd9091f68de791fcf286a92
Yet another DCM-Δ
.
39adccebc7bb262731419128ec49f7bf
Yet another DCM-Δ
.
77f024dca6ce4401aa3f0c2fb293cbf6
Yet another DCM-Δ
.
305e64099e346cad595c08635a5558b6
This version is similar to 8b32eef5829507e469f294999a28ff23
since it
also contains 3 bin resources and uses the same encryption algorithm.
577b7462d16600e0715f55a06cec6fb5
This version is similar to 8b32eef5829507e469f294999a28ff23
and
305e64099e346cad595c08635a5558b6
since they both contain 3 bin
resources and use the same encryption algorithm.
586afb4c3d03bdbacbc20b5ba73dd0eb
Yet another DCM-Δ
.
646f1297891ae9003cf42a3d0f166e6a
Yet another DCM-Δ
.
784c48011e6ce2a62c10542f99490768
Yet another DCM-Δ
.
95721afdb66fb239d95f7a9da3716bf0
Yet another DCM-Δ
.
148948adfea89ccbc4833c35147450bb
Yet another DCM-Δ
.
c86dde45c416c717d2b12bfb3f37b44f
Yet another DCM-Δ
.
ca67c7a1fa9f4ac51062ef34263b0a89
This version is a bit strange since it lack of one x64 core DLL bin
resource file (bin/146) but contains other bin resources of DCM-0
,
but it uses the encryption algorithm from 1b2f0cbd3f048ee9f3e9885d4076ce8c
.
d30f83a62304eae90a152f96eed1eba1
Yet another DCM-Δ
.
dfd5efb790877d1edf459b95036b88fe
Yet another DCM-Δ
.
fd9270e095f9efca801d839bfa6b5a11
Yet another DCM-Δ
.