Re: [Prelude Hybrid IDS] #217: new row for relation "prelude_checksum" violates check constraint "prelude_checksum_algorithm_check"

#217: new row for relation "prelude_checksum" violates check constraint
"prelude_checksum_algorithm_check"
--------------------------+-------------------------------------------------
 Reporter:  bjou          |        Owner:  yoann   
     Type:  defect        |       Status:  assigned
 Priority:  normal        |    Milestone:          
Component:  libpreludedb  |      Version:  0.9     
 Severity:  normal        |   Resolution:          
 Keywords:                |  
--------------------------+-------------------------------------------------
Old description:

> I am using nepenthes 0.2.0 in combination with prelude-manager 0.9.7.2,
> libprelude 0.9.13.2 and libpreludedb 0.9.12. Every time nepenthes
> downloads malware, it can not be logged into the prelude db (pgsql):
>
> [ info handler event module ] LogPrelude EVENT EV_SOCK_TCP_ACCEPT
>
> [ crit sc handler ] MATCH linkxor::link  matchCount 5 map_items 5
>
> [ info sc handler ]  i = 1 map_items 5 , map = size
>
> [ info sc handler ]  i = 2 map_items 5 , map = size
>
> [ info sc handler ]  i = 3 map_items 5 , map = key
>
> [ info sc handler ]  i = 4 map_items 5 , map = post
>
> [ info sc handler ] Found linkbot XOR decoder, key 0x17, payload is
> 0x00b2 bytes long.
>
> [ info sc handler ] connectbackfiletransfer::linktransfer ->
> 129.13.x.x:50391
>
> [ info sc handler ] connectbackfiletransfer::linktransfer ->
> 129.13.x.x:50391, key 0x63f635d0.
>
> [ info handler event module ] LogPrelude EVENT EV_DOWNLOAD
> link://129.13.x.x:50391/Y/Y10A==  0
>
> [ info down mgr ] Handler link download handler will download
> link://129.13.x.x:50391/Y/Y10A==
>
> [ info handler event module ] LogPrelude EVENT EV_SHELLCODE_DONE
>
> [ info handler event module ] LogPrelude EVENT EV_ASSIGN_AND_DONE
>
> [ info handler event module ] LogPrelude EVENT EV_SOCK_TCP_CLOSE
>
> [ info handler dia ] Download via linkbot filetransferr done! ( download
> is 37888 bytes)
>
> [ info mgr submit ] File ed82850exxxxxxxxxxxxxxxxxxx has type MS-DOS
> executable, MZ for MS-DOS
>
> [ info handler event module ] LogPrelude EVENT EV_SUBMISSION
>
> link://129.13.x.x:50391/Y/Y10A== ed82850exxxxxxxxxxxxxxxxxxx 37888
>

> And that's what prelude-manager says:
>
> could not insert message into database: ERROR:  new row for relation
> "prelude_checksum" violates check constraint
> "prelude_checksum_algorithm_check".
>
> The only thing that is presented via prewikka is:
>
> 7 x Shellcode detected: connectbackfiletransfer::linktransfer
>
> 7 x possible Malware offered: link://129.13.x.x:50391/Y/Y10A==
>
> but NOT the message about the successful download of the malware

New description:

 I am using nepenthes 0.2.0 in combination with prelude-manager 0.9.7.2,
 libprelude 0.9.13.2 and libpreludedb 0.9.12. Every time nepenthes
 downloads malware, it can not be logged into the prelude db (pgsql):

 {{{
 [ info handler event module ] LogPrelude EVENT EV_SOCK_TCP_ACCEPT

 [ crit sc handler ] MATCH linkxor::link  matchCount 5 map_items 5

 [ info sc handler ]  i = 1 map_items 5 , map = size

 [ info sc handler ]  i = 2 map_items 5 , map = size

 [ info sc handler ]  i = 3 map_items 5 , map = key

 [ info sc handler ]  i = 4 map_items 5 , map = post

 [ info sc handler ] Found linkbot XOR decoder, key 0x17, payload is 0x00b2
 bytes long.

 [ info sc handler ] connectbackfiletransfer::linktransfer ->
 129.13.x.x:50391

 [ info sc handler ] connectbackfiletransfer::linktransfer ->
 129.13.x.x:50391, key 0x63f635d0.

 [ info handler event module ] LogPrelude EVENT EV_DOWNLOAD
 link://129.13.x.x:50391/Y/Y10A==  0

 [ info down mgr ] Handler link download handler will download
 link://129.13.x.x:50391/Y/Y10A==

 [ info handler event module ] LogPrelude EVENT EV_SHELLCODE_DONE

 [ info handler event module ] LogPrelude EVENT EV_ASSIGN_AND_DONE

 [ info handler event module ] LogPrelude EVENT EV_SOCK_TCP_CLOSE

 [ info handler dia ] Download via linkbot filetransferr done! ( download
 is 37888 bytes)

 [ info mgr submit ] File ed82850exxxxxxxxxxxxxxxxxxx has type MS-DOS
 executable, MZ for MS-DOS

 [ info handler event module ] LogPrelude EVENT EV_SUBMISSION

 link://129.13.x.x:50391/Y/Y10A== ed82850exxxxxxxxxxxxxxxxxxx 37888
 }}}

 And that's what prelude-manager says:

 {{{
 could not insert message into database: ERROR:  new row for relation
 "prelude_checksum" violates check constraint
 "prelude_checksum_algorithm_check".
 }}}

 The only thing that is presented via prewikka is:
 {{{
 7 x Shellcode detected: connectbackfiletransfer::linktransfer
 7 x possible Malware offered: link://129.13.x.x:50391/Y/Y10A==
 }}}

 but NOT the message about the successful download of the malware

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/217#comment:4>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel