FakeAV.DBG: A Malware uses Windows Sysinternals name to avoid detection (Feb 2, 2016)
The Dell Sonicwall Threats Research team observed reports of a New Malware family named GAV: FakeAV.DBG actively spreading in the wild. This time attackers used fake name such as Sysinternals Debug Output Viewer for their malware to avoid detection by users. Sysinternals is a part of the Microsoft TechNet website which offers technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment.
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image001.png)
Infection Cycle:
The Malware uses the following icon:
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image002.png)
Md5:
-
b11f23f988d7e8ea3664ef292f8f6d2b
The Malware adds the following files to the system:
-
Malware.exe
-
C:Program FilesCommon Filessochvst.exe [Detected as GAV: FakeAV.DBG (Trojan)]
-
The Malware adds the files to Windows start-up folder to ensure persistence upon reboot:
-
%Userprofile%Start MenuXnz.url [ Auto Start-up file ]
-
%Userprofile%Start MenuXnv.url [ Auto Start-up file ]
Once the computer is compromised, the malware copies its own files to User and Startup folders.
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image003.png)
The Xnz.url and Xnv.url files dropped after malware launches on the target system, here is an example:
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image004.png)
The malware uses a DLL Injection to avoid detection by Anti-Virus programs. Here is an example:
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image005.png)
The Malware installs key Logger on the target machine and extracts valuable information such as pressed keys like following example:
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image006.png)
Command and Control (C&C) Traffic
FakeAV.DBG performs C&C communication over 5133 port. The malware sends your system information to its own C&C server via following format, here is an example:
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image007.png)
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image008.png)
![](http://software.sonicwall.com/gav/FakeAV.DBG_files/image009.png)
SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:
-
GAV: FakeAV.DBG (Trojan)