The Dell SonicWall Threats Research team has observed multiple variants of a new FakeAV downloader Trojan being actively spammed in the wild. The FakeAV downloader also known as Onkods arrives as an e-mail attachment pretending to be a JPEG image. It downloads and installs a new FakeAV Trojan Antivirus Security Pro when an unsuspecting user opens the e-mail attachment. The Downloader and FakeAV Trojan utilizes multiple anti-debugging and anti-detection techniques to prevent heuristic detection and automated analysis.

Here is a list of e-mail subjects and attachment names from various spam e-mails that were captured over the last week involving Onkods Trojan:

Sample e-mail messages look like below:

Infection Cycle:

A closer look at the Onkods Downloader Trojan binary revealed that certain API calls and Windows Library names were encrypted to deter heuristic detection. These are network activity and filesystem activity related API calls that are decrypted on runtime.

• Encrypted API Calls

Encrypted	Decrypted
JHo@pNEE]dGoY	InternetOpenA
JHo@pNEE]dGoMe{^	InternetOpenUrlA
JHo@pNEEQxMr}_vqwqf	InternetCloseHandle
JHo@pNEE@qCe^~{z	InternetReadFile
@T~DvEpC}wGrkV	CreateProcess
@T~DvEfX~qc	CreateFileA
TTrQgfI]w	WriteFile
@JtVghA_vxG	CloseHandle

• Encrypted Windows Library name

Encrypted	Decrypted
tOuLlET.vxn	wininet.dll
HCiKgL.pNm	Kernel32.dll

If the user opens the attachment, it connects to a predetermined remote server to download the FakeAV Trojan. The downloader uses a custom User-Agent string as seen below:

The server hosting these FakeAV Trojan binaries are located in Lithuania. It then runs the downloaded executable which will begin the FakeAV infection cycle.

Antivirus Security Pro

The FakeAV Trojan checks for the presence of any of these two files c:sd.dbg and c:sd2.dbg and terminates itself if found. It also checks for the presence of Virtual environments like Virtual Box, Virtual PC, VMWare, and Qemu before starting the infection cycle. While we have seen many other malware families that are VM-aware, this is unique as it uses more discreet API calls – SetupDiGetClassDevs, SetupDiEnumDeviceInfo, and SetupDiGetDeviceRegistryProperty to enumerate hardware and detect the Virtual Environment as seen below:

It disables the Microsoft Windows security and update processes by running these commands:

It then displays a fake Windows Security Center alert searching for a solution to fix virus activity which is followed by Antivirus Security Pro scanning:

The following screens show the usual Fake Antivirus scareware tactics:

• Fake scanning and infection alerts.



• Blocks legitimate programs from running.



• Prompts user to buy upgrade to cleanup infection.

We were able to extract the following affiliate ID, payment gateway, and support URLs during our analysis:

Dell SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Onkods.S (Trojan)
• GAV: Kryptik.BLMB (Trojan)
• GAV: FakeAV.BLMB (Trojan)

The Dell SonicWALL Threats Research team has received reports of a backdoor Trojan posing as an Excel spreadsheet. This Trojan targets the Windows platform and is being distributed through compromised legitimate websites. It overwrites a legitimate windows system file and connects to a remote server waiting for further instructions.

Infection Cycle:

Upon execution it creates the following files:

• %TEMP%*chinese characters*.xls
• %TEMP%InstallServer.exe [Detected as GAV: Laproy_2 (Trojan)]

It opens the .xls file to display its content:

InstallServer.exe then creates the following files:

• %SYSTEM%netman.dll [Detected as GAV: Laproy_3 (Trojan)]
• %SYSTEM%dllcachenetman.dll [Detected as GAV: Laproy_3 (Trojan)]

These copies of netman.dll will overwrite the legitimate Network Connections Manager library (netman.dll) from the user’s system. The malicious copy even shares the same export functions as the real windows DLL with the addition of two extra functions to install and uninstall the malware.

The malware then communicates to a remote server, sending identifiable information that marks its presence in the victim machine. Upon confirmation, it receives the address of another remote server:

During our analysis, we have only observed this trojan constantly sending SYN to the server awaiting for further instructions:

Dell SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Laproy (Trojan)
• GAV: Laproy_2 (Trojan)
• GAV: Laproy_3 (Trojan)

The Dell SonicWALL Threats Research Team received reports of a Visual Basic based Malware that uses a simple but relatively new trick to steal the victims money by misusing the traditional copy-paste mechanism. Whenever a bank account number is copied by the victim onto the clipboard (ctrl + c) it replaces the copied account number with a hard-coded account number belonging to the attacker. So when the victim pastes (ctrl + v) the content, it would be the attackers account number. It is possible that some people might easily overlook the account switch and end up transferring money to the attacker.

Infection Cycle

The malware spreads as part of a spam campaign wherein the following files are dropped onto the victims machine when the malicious mail attachment is opened:

• taskmgr.exe [Detected as GAV: VBTroj.TAS (Trojan)]
• explore.exe [Detected as GAV: VBTroj.EXP (Trojan)]
• svchost.exe [Detected as GAV: VBTroj.SV (Trojan)]
• acs.exe [Detected as GAV: VBTroj.ACS (Trojan)]

We observed different tasks performed by each of the dropped files, some of them are highlighted below:

• taskmgr.exe gets a text file from adfc4s2ky.biz.ly/score970.txt which appears to be dead at the time of writing.

  It increments a counter maintained by the attacker to provide statistics about the number of infections. At the time of writing this blog the count is at 3811. It uses the following URL to achieve this:
  simplehitcounter.com/hit.php?uid=1555750&f=16777215&b=0

  It then registers itself to the attacker by sending a mail through SMTP, this mode of notification is not common.

  

• explore.exe performs the trick of replacing the 26 digit account number copied by the victim to a hard-coded account number stored in the Malware. The following figure shows the dummy account number in the first image that was copied before the malware was executed. Upon execution, the malware changes the contents of the clipboard to the account number stored in the code. It should be noted that only 26 digits that are pertaining to the account number are changed.

  
  We observed names of a number of banks in the executable whose users may possibly be targeted by this Malware:

  • Multibank
  • Getin Bank
  • Eurobank
  • Ing Bank
  • Mbank
  • Pekao24

• acs.exe tries to download a resource named file1.pdf from adfc4s2ky.biz.ly but it has been moved/removed from that location.

Overall this threat aims at misusing one of the most used feature in modern computing to carry out malicious activity. As the case with most banking malwares it targets the victims sensitive banking information, Bank Account number in this case, to get monetary benefit.

Dell SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

The Dell SonicWall Threats Research team have received reports of a recent wave of the Zortob Trojan in the wild. Trojans of this nature may have no particular objective upon infection but give an attacker a back-door into the infected systems through which any other malware can be installed. This Trojan is reported to arrive as an email attachment masquerading as a voicemail message.

The Dell SonicWall Threats Research team has observed a recent wave of IRC bots posing as legitimate applications. The bot installer may arrive with file names such as, chrome.exe or facebook-images.exe on the victim machine. It attempts to masquerade itself as Google Chrome by using the following icon and file properties: