Email Spam leads to Banking Trojan (July 21, 2011)

Sonicwall UTM research team received reports of a new online banking Trojan seen in the wild. This Trojan steals security credentials used to manage various online banking accounts targeting South American Bank Caixa Group.

Users will receive an email similar to the screenshot below related to banking transaction. The email contains a link purportedly to be the proof or receipt of the transaction but otherwise leads to downloading of the banking trojan.

Translated to English:

Portuguese – detected to English translation
————————————————–
PROOF OF SCHEDULE
————————————————–

Please be advised that scheduling was made in Internal Transfer
BPI service online, with the following data:

Schedule Date – 07/18/2011 06:16
Operation Type – Issuance of checks on foreign
Nr Documento2342576678899 (9.12 kb)

The email link leads to a compromised website which serves the trojan: http://cla{REMOVED}ua/…/bpi23045.asp

Once the user clicks on the link, it will display the message below showing that the Adobe Reader is outdated and redirects it to the download page.

The Adobe Reader download page is fake and will actually serve the banking trojan.

In order to disguise the banking trojan as a legitimate installer, it uses Adobe Flash icon shown below:

After installation, the trojan will launch these pages to let the user think that it installed a legitimate Adobe Reader and will ultimately show the online banking transaction.

Installed files:

• %systemdir%1kl1.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]
• %systemdir%xservicex.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]
• %temp%header_10.1.45.2.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]

Added Registry:

• Key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
  Value: xservicex
  Data:”%systemdir%1kl1.exe”

Network Activity:

HTTP Requests:

• http://www.ca{REMOVED}/lnkFloud.php
• http://www.d{REMOVED}tyjytj/…/c.php
• http://sch{REMOVED}/willkohead.png

SonicWALL Gateway AntiVirus provided proactive protection against this threat via the following existing signatures:

• GAV: VBKrypt.CQZR (Trojan)
• GAV: Banker.UTV (Trojan)

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.