UPS Invoice Spam (Nov 21, 2008)

SonicWALL UTM Research team observed a new wave of the on-going UPS invoice spam campaign starting Thursday, November 20, 2008. The email has a zip archived attachment which contains the new ZBot Trojan variant.

SonicWALL has received more than 1,000 e-mail copies of this malware till date. The e-mail looks like following:

Attachment: UPSInfo.zip (contains UPSInfo.exe)

Subject: Your Tracking # [12-digit number]

Email Body:
————————
Sorry, we were not able to deliver postal package you sent on November the 1st in time because the recipient?s address is not correct.

Please print out the invoice copy attached and collect the package at our office. If you do not receive package in ten days you will have to pay 36$ per day.

Your UPS
————————

The executable file inside the zip attachment has an icon disguised as a Adobe PDF file and it looks like following:

The Trojan when executed performs following host level activity:

• Creates a directory twain_32 in C:Documents and SettingsLocalServiceApplication Data and C:WINDOWSsystem32
• Drops a copy of itself as C:WINDOWSsystem32twext.exe
• Creates two files C:WINDOWSsystem32twain_32local.ds and C:WINDOWSsystem32twain_32user.ds

It modifies the following Registry key for running twext.exe:

• HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit: “C:WINDOWSsystem32userinit.exe,C:WINDOWSsystem32twext.exe,”

It also tries connect and download an encrypted configuration file from the following URL:

• pavelmoous.ru/pavel/conf.bin

The Trojan is also known as Trojan-Spy.Win32.Zbot.gsv [Kaspersky], W32/Trojan3.LA [F-Prot], and TR/Spy.ZBot.gsv [AntiVir]

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Zbot.GSV (Trojan) signature.

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.