The Dell SonicWALL UTM Research team received reports of a new variant of the Tepfer Trojan. The Trojan originates through an email purporting to be from Bank of America CashPro Online. It asks the user to replace their digital certificate with one provided in the malicious attachment. The Trojan also downloads and executes various other malwares such as Zeus during the infection process. Another variant of this malware has been covered recently in a previous sonicalert

Infection Cycle:

The email has an attachment with a zip file containing the Trojan executable:

The executable file in the attachment uses the following icon:

The Trojan performs the following DNS queries:

• blog.ritual.ca
• ftp.tecnoazar.com.ar
• preservationsolutionsplus.com
• omarpage.com
• www.google.com
• ceregypt.com
• cuatrofm.es
• two.really-good-books.com
• three.shell4pets.com
• dontgetcaught.ca

The Trojan adds the following files to the filesystem:

• %USERPROFILE%qyzozcewagje.exe [Detected as GAV: Pushdo.PKQ (Trojan)]
• %APPDATA%Aqripazyykej.exe [Detected as GAV: Sality.AM.gen (Virus)]
• %APPDATA%Aqripa9trZaHw9.exe [Detected as GAV: Sality.AM.gen (Virus)]
• %APPDATA%AqripaaL5DZn.exe [Detected as GAV: ZBot.EB_4 (Trojan)]
• %APPDATA%Aqripa4PsxF.exe (empty file)
• %TEMP%tmp0c9b3e815365.exe (empty file)
• %TEMP%tmpa6dcb566load50.exe [Detected as GAV: Kryptik.AUWV_2 (Trojan)]
• %TEMP%tmpd5e04e47a3.exe [Detected as GAV: Pushdo.PKQ (Trojan)]

The Trojan adds the following keys to the Windows registry:

• HKEY_CURRENT_USERSoftwareMicrosoftFuith 2a33b827 “bAkSC4m6SY/fyYlkHb0=”
• HKEY_CURRENT_USERSoftwareMicrosoftFuith 25bd6f75 “Xwl9Cw==”
• HKEY_CURRENT_USERSoftwareMicrosoftFuith 6e9ddg5 “1l99C9j3KI+5ybtk”
• HKEY_CURRENT_USERSoftwareMicrosoftFuith 1h1ci1jg hex:0e,09,7d,0b,3f,df,0d,de,7f,7d,93,dc,19,eb,4f, …
• HKEY_CURRENT_USERSoftwareMicrosoftFuith 2c6dd9ac “Dgl9C++6KI+
• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun {C05E9BBE-21ED-AD41-CB90-673CEB12442E} “%APPDATA%Aqripazyykej.exe”
• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun qyzozcewagje “%USERPROFILE%qyzozcewagje.exe”

The Trojan injects code into the currently running instance of explorer.exe and exits:

The injected code causes explorer to download and run the following malicious executable files:

The Trojan was observed sending the following encrypted information to a remote webserver:

The code that is injected into explorer.exe contains the following data referencing various banking URL’s:

!https://*.lphbs.com/*
@https://*.onlineaccess*AccountOverview.aspx
@https://www.mercantilcbonline.com/secure/banking/protected/gridcard/*
@https://bancopostaimpresaonline.poste.it/bpiol/lastFortyMovementsBalance.do?method=loadLastFortyMovementList
@https://www3.csebo.it/*
@https://qweb.quercia.com/*
@https://www.sparkasse.it/*
@https://dbonline.deutsche-bank.it/*
@https://*.cedacri.it/*
@https://www.bancagenerali.it/*
@https://www.csebo.it/*
@https://*.deutsche-bank.it/*
@https://hbclassic.bpergroup.net/*/login
@https://nowbankingpiccoleimprese*
@https://www.inbiz.intesasanpaolo.com/*

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Tepfer.EB_2 (Trojan)
• GAV: Pushdo.PKQ (Trojan)
• GAV: Sality.AM.gen (Virus)
• GAV: Kryptik.AUWV_2 (Trojan)
• GAV: ZBot.EB_4 (Trojan)

Dell SonicWALL Threats Research Team received reports of SuperClean Android Malware that can execute a host of commands once it infects the device, but this Malware has a more sinister purpose that makes it unique. This Malware is one of the first of its kind to have capabilities to infect Windows machine if the infected mobile device is connected to it via USB. The Malware on the phone downloads and drops a different Malware on the Windows machine and infects it, thus effectively converting the phone into a Malware Dropper. Additionally both the Malwares have a huge arsenal of commands which they can receive from the Command & Control (C&C) server and execute.

Infection Cycle

The Malware disguises itself in the form of a ‘useful’ app and has been reported to be present on Google Play in the past with the name ‘Superclean’ made by Smart.Apps. Strangely enough it received good reviews for the time it was available for download. The app claims to clean up the system and make the device run faster, there is an abundance of such cleaner apps on Google Play indicating a cleverly chosen disguise.

In an ideal case the first stage of infection is when the malicious app gets installed on the users mobile device through Google Play. The second stage of infection is when the user connects the infected mobile device to his home/business computer and a new Malware gets dropped on the connected machine thereby infecting it. During installation the following permissions are requested:

• Receive_Boot_Completed
• Internet
• Read_SMS
• Receive_SMS
• Send_SMS
• Write_SMS
• Call_Phone
• Get_Accounts
• Access_Wifi_State
• Change_Wifi_State
• Access_Network_State
• Reboot
• Read_Contacts
• Kill_Background_Processes
• Write_External_Storage
• Read_Phone_State
• Access_Fine_Location

The fact that a simple memory cleaner requires permissions to read contacts, access location and SMS should raise suspicion in the minds of users before granting these permissions. Upon installation the app appears in the App drawer as:

When the app is clicked the user sees the following screen:

This indicates that the memory has been optimized to improve the phones performance but in reality the app just lists the processes which are currently active on the device and simply restarts them. The app then tries to connect to claco.kicks-ass.net and announces the successful installation on a device. The app sends this announcement in the following format:

|NEW_HELLOW| app version + Google account registered to the device + port|/NEW_HELLOW/|

The attacker can now execute a host of commands on the device through this Malware. We found the Malware to be equipped with nearly 25 different commands, few of the more intrusive ones are listed below:

• get_packages – Get a list of installed packages on the device
• wifi – Toggle WiFi on or off
• get_sms – Retrieve and forward all SMS’s on the device to the attacker
• ringer – Set the ringer to ‘normal’ or ‘silent’
• get_pics – Retrieve all pictures on the device and forward to the attacker
• get_contacts – Retrieve all contacts on the device and forward to the attacker
• forward – Enable call forwarding to a number specified by the attacker
• start_track and stop_track – Track the location of the device via GPS
• device – Reboot the device

The command and functionality that distinguishes this Malware from the rest of Android Malwares is usb_autorun_attack. Upon receiving this command the Malware tries to download three files from claco.hopto.org:

These three files are stored on /mnt/sdcard/ of the device. Android users connect their phones to computers for many reasons, primary being transferring media files like photos, music and movies from the phone to the computer and vice versa. When the mobile device is connected to the computer in USB drive emulation mode svchosts.exe is automatically executed on the computer via autorun.inf provided AutoRun feature on the machine is enabled.

The dropped executable svchosts.exe [detected as GAV:MSIL.RCD (Trojan)] is capable of receiving and executing commands from the C&C. Upon execution it drops the following file on the system:

• %WINDOWS%system32svchost.exe (copy of itself)

It makes the following changes to the registry to ensure that it runs each time the machine starts :

• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun “%WINDOWS%system32svchost.exe”

It makes the following changes to the registry in order to bypass firewalls:

• HKCUSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZonemapProxyBypass=”1″
• HKCUSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZonemapIntranetName=”1″
• HKCUSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZonemapUNCAsIntranet=”1″

Once executed this Malware announces its presence to the same server and uses almost the same format:

|NEW_HELLOW| username + machine name + port + build |/NEW_HELLOW/|

This Malware, similar to the Android malware that downloaded it, is capable of executing a number of commands on the infected machines. Again we list a few commands from the entire roster of around 36 commands coded into the executable:

• |GET_DRIVES| – Get information about all the drives on the system
• |GET_FILES| – Get specified files from the system
• |_EXE_CUTE_| – Execute a specific command on the system
• |CR_ACCOUNT| – Create a user account on the system
• |SCREEN_CAP| – Take a screenshot of the Desktop
• |FIREFOXDAT| & |CHROMEDATA| – Get user data saved by these browsers on the system
• |RECORD_STR| & |RECORD_STP| – Record from the microphone of the users system

The information collected by both the Malwares is sent to the attacker over FTP to claco.hopto.org. We observed a good chunk of the Windows Malware to have modules from NAudio which is an open source audio library. These modules are useful for the recording functionality of the Malware.

As we saw, both the Malwares involved here have significant capabilities to gather sensitive information about the user through his phone as well as his computer thereby exposing a wealth of information for the attacker.

Dell SonicWALL Gateway AntiVirus provides protection against these threats with the following signatures:

GAV: AndroidOS.Sucl.A (Trojan)

GAV: AndroidOS.Sucl.A_2 (Trojan)

GAV: AndroidOS.Sucl.A_3 (Trojan)

GAV: MSIL.RCD (Trojan)

The SonicWALL Threat Research team discovered a new variant of the Dorkbot Trojan (also known as NGRBot). This Trojan was covered in a previous Sonicalert where it was targeting Skype users. The features in this variant are similar to the previous variant with the exception of spreading via Skype.

Infection Cycle:

The sample we analysed makes no changes to the file system or windows registry. It does however have the ability to do that by downloading further payloads as we have seen in previous variants.

The Trojan uses the following icon:

The Trojan makes the following DNS requests:

• api.wipmania.com
• webingenial.com
• interactua.edu30.com
• haztuwebsite.com

Upon execution the Trojan injects code into the current running instance of explorer.exe [Detected as GAV: Dorkbot.B_67 (Trojan)]:

The Trojan determines its IP address by making a request to wipmania.com. It then proceeds to join channel #main on a private IRC server. The IRC server does not allow various commands such as channel and user listing:

It also downloads a text file from a remote webserver containing a list of subdomains of a banking website. This list can be either for DDoS attacks or bank site redirection via editing the hosts file:

The Bots idle on IRC awaiting further instructions from its operators. They are given names according to geographical location and operating system version.

During analysis we discovered that the Trojan contains a suite of malicious capabilities. The malicious modules can be utilized by issuing commands via the IRC channel that the bot has joined. The modules are listed as follows:

• UDP/SYN Flood
• Visit HTTP URL (for Pay-per-click schemes)
• Log into and download files from FTP and POP3 email servers
• Update bot/download file from remote webserver with MD5 verification
• Execute file on system
• Start a Socks4 proxy server
• Spread via MSN Messenger Service
• Spread via connected USB drives

At the time of analysis it was determined that the botnet operators are actively monitoring connections to their IRC server. We were promptly banned from the IRC server due to performing activity not conforming to the bots typical behavior.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Ruskill.QCE (Trojan)
• GAV: Dorkbot.B_67 (Trojan)

Snort is a free and open source network intrusion prevention system (IPS) and network intrusion detection system (IDS) created by Martin Roesch in 1998. Snort is now developed by Sourcefire, of which Roesch is the founder and CTO. Snort has the ability to perform real-time traffic analysis and packet logging on Internet Protocol (IP) networks. Snort performs protocol analysis, content searching, and content matching. The program can also be used to detect probes or attacks, including, but not limited to, operating system fingerprinting attempts, common gateway interface, buffer overflows, server message block probes, and stealth port scans.

Snort can be configured in three main modes: sniffer, packet logger, and network intrusion detection. In intrusion detection mode, the program will monitor network traffic and analyze it against a rule set defined by the user. Sourcefire Vulnerability Research Team distributes official rules for Snort. While most of these rules are written in the typical rule description language, some rules are written in C, compiled and distributed as shared libraries. As Snort performs protocol analysis, the Snort rules are capable of processing various network protocols such Server Message Block (SMB).

Server Message Block (SMB), also known as Common Internet File System (CIFS) operates as an application-layer network protocol mainly used for providing shared access to files, printers, serial ports, and miscellaneous communications between nodes on a network. SMB connections can either be directly sent over TCP or be encapsulated as NetBIOS payload. An SMB (Server Message Block) packet contains an SMB Header which has the following structure:

 SMB Header Offset Size Field ------------------------------------------------------------------------ 0x00   4    Server Component (xff SMB) 0x04   1    SMB Command: Trans (0x25) 0x05   4    NT Status 0x09   1    Flags (bit:0 = Request/Response) 0x0A   2    Flags2 0x0C   2    PID High 0x0E   8    Signature 0x16   2    Reserved 0x18   2    Tree ID 0x1A   2    Process ID 0x1C   2    User ID 0x1D   2    Multiplex ID 

There is an Snort rule 3:20257 distributed as a precompiled binary netbios.so by Sourcefire. A stack based buffer overflow vulnerability has been identified in this rule. An attacker can exploit this vulnerability to cause a stack buffer overflow which would allow for arbitrary code injection and execution with the privileges of Snort, by default administrative.

Dell SonicWALL UTM team has researched this vulnerability and released the following signature addressing it:

• 9563 Sourcefire Snort DCE-RPC Preprocessor Buffer Overflow 6

This vulnerability has not been assigned a Common Vulnerabilities and Exposures (CVE) identifier.