Dell SonicWALL Threats Research team captured multiple spam campaigns serving newer variant of Tepfer Infostealer Trojan. The malware arrives in an e-mail attachment using themes shown below:

The malware executable inside the zip attachment uses Adobe PDF file icon and also uses official Microsoft Window’s application metadata to disguise itself as seen below:

Infection Cycle

The malware executable will perform following activities, if the user is tricked into opening the file:

• It looks for configuration files (.ini,.dat,.xml etc) of multiple applications to steal FTP and E-mail server information and user credentials:

  

• It contains a list of common passwords which is compressed inside the binary file using aPLib v1.01 compression library. The decompressed list is shown below:

  

• It attempts to connect to a list of predetermined servers to send the stolen information via HTTP request: /POST /forum/viewtopic.php:
  • 3.soundfactor.org
  • 3.ussana.net
• It further downloads and executes a new variant of P2P Zeus binary from multiple remote servers listed below. It appears to be exploiting the Pay-Per-Install scheme by downloading and installing multiple instances of same Zeus payload from different servers on the victim machine:
  • mjorart.com/{REMOVED}.exe
  • bestinsighttours.com/{REMOVED}.exe
  • rdquark.com/{REMOVED}.exe
  • quranaqiq.com/{REMOVED}.exe
  • westquimica.com/{REMOVED}.exe
  • superelectronico.com/{REMOVED}.exe
  • jagatoko.com/{REMOVED}.exe
  • muzikmeno.com/{REMOVED}.exe
  • eds-kurier.de/{REMOVED}.exe

  The downloaded Zeus payload is detected as GAV: Zbot.AAN_65 (Trojan).

• The Infostealer variants seen across different spam campaigns in last two weeks appears to be from the same author as seen by the project name extracted from the binary:

  

Dell SonicWALL Gateway AntiVirus has blocked close to 1 million instances of these spammed Infostealer variants in past one week. Below is the geographic distribution of this Infostealer spam campaign:

Dell SonicWALL Gateway AntiVirus provides protection against this threat with the following signatures:

• GAV: Tepfer.BVXJ (Trojan)
• GAV: Tepfer.CAVW (Trojan)

Ori Rejwan UMPlayer a multimedia player available for Microsoft Windows, Apple Mac OS/X, and GNU/Linux operating systems. With built-in Audio and Video codecs, UMPlayer can handle various media formats.

Windows applications can control the location from which a DLL is loaded by specifying a full path, using DLL redirection, or by using a manifest. If none of these methods are used, the system searches for the DLL in the following order if SafeDllSearchMode is enabled:

1. The directory from which the application loaded.

2. The system directory.

3. The 16-bit system directory.

4. The Windows directory.

5. The current directory.

6. The directories that are listed in the PATH environment variable.

A code execution vulnerability exists in UMPlayer for Windows. When a .mp3 or .mp4 file is loaded into UMPlayer, it tries to dynamically load a library file wintab32.dll. A vulnerable UMPlayer will try to load wintab32.dll from “current directory.” An attacker can place a malicious library named wintab32.dll in the same directory as the .mp3 or .mp4 file. When a victim accesses the .mp3 or .mp4 using SMB or WebDAV protocol, the malicious wintab32.dll will be loaded by UMPlayer. Successful exploitation of this flaw allows arbitrary command execution in the security context of the logged-in user.

Dell SonicWALL has released signatures to detect and block specific exploitation attempts targeting this vulnerability. The signatures are listed below:

• IPS sid:5726 “Binary Planting Attack 2”

• IPS sid:9218 “wintab32.dll Insecure Library Loading 2”

Dell SonicWALL Threats Research team discovered a new variant of info stealer Trojan in the wild that steals sensitive information from the users system. The malware arrives in the form of an email message claiming that your Income Tax refund appeal has been declined by IRS, the details of which can be found in the attached IRS letter.

A sample E-mail message from this campaign looks like below:

The zip attachment in the E-mail contains the malware executable.

Infection cycle

The infection begins when the user opens the malicious file inside the zip attachment. The malware drops a copy of itself and modifies system registry to ensure that the dropped copy runs each time on system reboot. The dropped filename uses the format KB%08d.exe i.e. KB(8 Digit Number).exe. Another malicious file is dropped by the name of exp.tmp.exe, this file injects malicious code in explorer.exe.

Following are the malicious files dropped on the system:

• C:Documents and SettingsOwnerApplication DataKB00654892.exe [Detected as GAV:Cridex.SRI_2(Trojan)]
• C:Documents and SettingsOwnerLocal SettingsTempexp.tmp.exe [Detected as GAV: Kryptik.ALRY (Trojan)]

Following entry was aded to the registry:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “C:Documents and SettingsxxxxApplication DataKB00654892.exe”

The malware also drops a batch file as C:Documents and SettingsOwnerLocal SettingsTempexp.tmp.bat that checks and deletes the original file. The infected instance of explorer.exe was found to be connecting to a number of domains on port 8080:

• rob.roboticwares.com
• recipe.devrich.com
• khtweb.sote.hu

We found a number of hardcoded C&C IP addresses in the executable:

• 148.208.216.70:8080
• 180.235.150.72:8080
• 200.169.13.84:8080
• 59.90.221.6:8080
• 61.7.235.35:8080
• 210.56.23.100:8080
• 195.111.72.46:8080
• 216.38.12.158:8080
• 50.22.102.132:8080

The following encrypted communication was observed between the Trojan and the C&C server:

A similar behavior was observed in a previous SonicALERT for eFax Spam.

Dell SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

GAV: Cridex.SRI_2 (Trojan)

GAV: Kryptik.ALRY (Trojan)

During Hurricane Sandy crisis, people want to help those in need. At the same time, unscrupulous criminals will try to take advantage of the disaster. They may ask you for bogus charitable donations or offer free dining coupons to those in need. Now is the time to use special scrutiny when you receive unsolicited emails. Below are screenshots of examples of fraudulent emails you may receive. Should you receive such an email and click on the URL in it, the link will take you to a fake website and attempt to infect your computer.

To protect our customers, we offer the most up-to-date protection against new spam attacks while ensuring delivery of legitimate email with real-time information from the Dell SonicWALL Global Response Intelligent Defense (GRID) Network. The GRID Network collects and analyzes millions of data points, performing rigorous testing and evaluation every day, establishing reputation scores for senders and content and identifying new threats in real-time.

Technology makes our lives easy, but it also gives criminals a possible avenue to deceive and bypass common sense. While the method may vary from email to text messages, tweets or cold calling, one thing remains the same: If you are planning to give to a nonprofit in the wake of any disaster, verify that it is legitimate. Charity evaluators like Guidestar and Charity Navigator are good ways to check that the organization you’re donating to is established and your funds will go where you intend.

If you are interested in testing your email expertise and detection skills, please check out our Dell SonicWALL phishing test .

Here are screenshots showing some of the spam e-mails we have captured using Hurricane Sandy theme:

Dell SonicWALL UTM Research team discovered a new info stealer Trojan in the wild that steals account information from FTP and Email configuration files. The Trojan also drops a variant of the Zbot Trojan on the system.

The Trojan arrives in the form of an email purporting to be a fax message delivered by eFax Corporate. The user is encouraged to download and execute the attachment to view the fax:

Upon infection the Trojan performs the following DNS queries:

• dechotheband.gr
• barisdogalurunler.com
• alpertarimurunleri.com
• oneglobalexchange.com
• rumanas.org
• www.10130138.wavelearn.de
• visiosofttechnologies.com
• sgisolution.com.br
• plusloinart.be
• marengoit.pl
• www.google.com

The Trojan adds the following files to the filesystem:

• %USERPROFILE%Local SettingsTemp215229.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %USERPROFILE%Local SettingsTemp220286.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %USERPROFILE%Local SettingsTemp224803.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %USERPROFILE%Local SettingsTemp227637.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %USERPROFILE%Local SettingsTemp230491.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %USERPROFILE%Local SettingsTemp231913.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %USERPROFILE%Local SettingsTemp233065.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %USERPROFILE%Local SettingsTemp249648.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %USERPROFILE%Local SettingsTemp252302.exe [Detected as GAV: Zbot.AAN_62 (Trojan)]
• %APPDATA%Ettohxiud.exe [Detected as GAV: Zbot.EQLN_2 (Trojan)]
• %USERPROFILE%Local SettingsTempabcd.bat

abcd.bat contains the following data. This is used to clean up parts of the infection process:

:ijk
del %1
if exist %1 goto
ijk
del %0

The Trojan adds the following key to the Windows registry to enable startup after reboot:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun {C05E9BBE-21ED-AD41-CB90-673CEB12442E} “%APPDATA%Ettohxiud.exe”

The Trojan downloads and runs the following files [All detected as GAV: Zbot.AAN_62 (Trojan)] from various remote webservers:

The following encrypted communication was observed between the Trojan and a remote C&C webserver:

The unencrypted form of the above “CRYPTED” data that is sent is as follows. It contains sensitive system information::

The Trojan was observed iterating through the Program Files directory looking for FTP and Email configuration files. It steals credentials from the following FTP and Email softwares if present.

BulletProof FTP
Smart FTP
Turbo FTP
Sota's FTP
FTP Navigator
FTP Commander
FlashFXP
FileZilla
Cute FTP
Core FTP
Ultra FXP
Frigate3
FTP Explorer
SecureFX
Classic FTP
FTPVoyager
Wise FTP
SeaMonkey
Leech FTP
FTPGetter
3D-FTP
Go FTP
BlazeFtp
FTPNow
Pocomail
The Bat!
Thunderbird

The Trojan contains the following common word password list:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Androm.EFX
• GAV: Tepfer.AIUQ
• GAV: Zbot.EQLN_2
• GAV: Zbot.AAN_62