The Dell SonicWALL Threats Research team came across a malicious executable that claims to be the recently discovered Heartbleed vulnerability test tool. The executable is a new variant of a Backdoor Trojan malware family Zacom. This is yet another example of how quickly Cybercriminals try to take advantage of a new popular topic to spread malware.

The Heartbleed vulnerability is a critical information disclosure bug in the TLS and DTLS implementations of OpenSSL that was discovered earlier this week. More information about the vulnerability and our analysis is available here.

Infection Cycle

The malware executable file looks like below:

The malware upon execution will generate a unique ID utilizing the infected ComputerName and UniqueID information as shown below:

It then registers the infection with a remote Command and Control server for which the IP address was found to be hardcoded in the malware. The command and control server responds back with a unique string starting with either su or sp followed by 9 digit numbers.

It further creates the following files on the system:

• %User Local Settings%Temphello032.txt [Temporary text file to check for write permission and bitness]
• %User Local Settings%Tempmsbridge.exe [Copy of itself detected as GAV: Zacom.A_2 (Trojan)]

It also creates a registry entry to ensure that the dropped malware executable runs on system reboot:

HKCUSoftwareMicrosoftWindowsCurrentVersionRun Msbridge = %User Local Settings%Tempmsbridge.exe

The original malware process terminates after creating a new process to start the dropped executable with the following arguments:

%User Local Settings%Tempmsbridge.exe %PATH TO THE ORIGINAL EXECUTABLE FILE% 4194304

The new process will utilize the path argument to delete the original malware executable file.

It then attempts to communicate with the hardcoded command and control server IP, waiting for further commands. The following network activity indicators were observed during our analysis:

As seen above, the malware has support for downloading updates and additional malware as well as upload stolen information from the infected machine. The malware also uses a custom generic User Agent string for its communication. The command and control server is hosted in Hong Kong and appears to be active at the time of analysis.

Dell SonicWALL UTM appliance provides protection against this threat with the following signatures:

• GAV: Zacom.A (Trojan)
• GAV: Zacom.A_2 (Trojan)
• IPS:3686 Zacom heartbleed malware activity 1
• IPS:3688 Zacom heartbleed malware activity 2

The Dell SonicWALL Threats Research team has observed a sharp increase in the number of spammed malware e-mails originating from Cutwail Botnet. We have captured a variety of spam campaigns over past two weeks that involved fake delivery notifications, voice messages, tax returns, pictures, fax messages, invoices, etc.

You can refer to our analysis of latest Cutwail variant here.

The following graph highlights our findings:

These emails have a common theme of trying to lure consumers to open the attachment which looks legitimate with the following subjects:

• ACH payment failure report
• CCL Computers – Order Despatched
• CIS Online submission received by HM Revenue and Customs
• Documents – WellsFargo
• FW: Loan docs
• Failure to deliver
• Notification of direct debit of fees
• PCI DSS Compliance Programme
• RE:Please open the attachment to view your payment slip for confirmation of order
• Some men commented on your status
• Statement of account
• You send new photo!
• message from your attorney

Below are some sample e-mails captured from these spam campaigns:

Some of the common files seen in these attachments are:

• ABSA certificate update.exe
• Annual _report.PDF.scr
• Avis_de_Paiement.scr
• B8582964793.scr
• Case_26032014.scr
• CBE_Form.scr
• Copy-04012014.scr
• Court_Notice_document_date_25-03-2014Y.exe
• DATA-204658-SCR89.scr
• PPs INvoice PROTECTED.exe
• PrivateImage_03312014.scr
• Returns Repot for march 2014.exe
• test result AF1T-2.exe
• WellsFargo_Docs_042014.scr

These files look like pdfs and word documents but with extensions .scr and .exe as shown:

Once the user tries to open these attachments, the malicious file is executed and their machine is compromised.

We urge our users to always be vigilant and cautious before opening attachments from any unsolicited email.

Dell SonicWALL Gateway AntiVirus provides protection against these threats with the following signatures:

The Dell SonicWall research team recently encountered a malicious spam e-mail. The sample contained in the email is another in the line of droppers known by the name Onkods. This malware family’s primary role is to gain execution on a victim’s machine in order to download and launch the next stage in the attack.

XML is extensively used in many web applications. Some of XML usages include: