Malware Reversing: Insomnia

Sample SHA256:
0d2df9914ff16053817a2d31b4ccdb0e2113dc96d1c499465c0be65444cd3538

Tools Used:
Cuckoo Sandbox
Ollydbg
JetBrains DotPeek
Visual Studio 2013


Notable Strings:
$: strings 0d2df9914ff16053817a2d31b4ccdb0e2113dc96d1c499465c0be65444cd3538  | grep 'CorExeMain'
 _CorExeMain
"When a .NET executable loads, its entry point is usually a tiny stub of code. That stub just jumps to an exported function in MSCOREE.DLL (_CorExeMain or _CorDllMain)" (http://a5.tf/Dbg)

 $: strings 0d2df9914ff16053817a2d31b4ccdb0e2113dc96d1c499465c0be65444cd3538  | grep -i 'channel'
channel
_mainChannel
mainChannel
mainChannelKey

$: strings 0d2df9914ff16053817a2d31b4ccdb0e2113dc96d1c499465c0be65444cd3538  | grep -i 'botnick'
botNick
BotNick

The mainChannel and botNick strings were enough to give away it was joining an IRC server.


Because of the indicator that the executable was .NET framework. I switched over to DotPeak,

Insomnia Functions

DotPeek was very informative because it was able to disassemble the sample. The source code became cleartext, and I was able to fully understand what the sample was doing. The code was extremely well written compared to other samples I have seen.


I was able to export the sample from DotPeek into Visual Studio 2013, and begin to start debugging and reversing.












There is a snippet of code in Config.cs with all of the customizable configurations :

    public static string currentPath = Process.GetCurrentProcess().MainModule.FileName;
    public static string randomID = Functions.RandomString(7);
    public static string botNick = Functions.BotNick();
    public static string botMD5 = Functions.GetMD5Hash(Config.currentPath);
    public static string version = "2.2.0";
    public static string regLocation = "HKCU";
    public static string socksUser = Config.randomID;
    public static string socksPass = Convert.ToBase64String(Encoding.UTF8.GetBytes(Config.randomID)).Substring(0, 5);
    public static bool topicAct = false;
    private static string enc = "[Redacted Base64 String]";
    private static string toParse = Encoding.UTF8.GetString(Convert.FromBase64String(Config.enc));
    public static string customerID = Config.toParse.Substring(0, 8);
    private static string[] nfo = Functions.Chk(new Data().decrypt(Config.toParse.Remove(0, 8)), Convert.ToInt32(Config.customerID)).Split(new char[1]
    {
      '/'
    }); 

The problem is that all of the configurations stem from the string "enc". This is an encrypted string that needs to be reversed before we can figure out who the attacker is.

Decryption Algorithm: