Dell SonicWALL Threats Research team discovered a new German Ransomware Trojan being spammed in the wild. The spammed e-mail contains a fake premium membership order confirmation at a partner agency and informs the user to open the attachment for elite account cancellation policy details. The attachment contains the new Ransomware Trojan. A sample e-mail message looks like below:

Translated e-mail: (Credit: Google Translate)

Sincerely, Mary Moeller
Support Team

The attached zip file contains the new Ransomware Trojan with an icon disguised as a MS-DOS shortcut file:

If the user opens the file, it will perform following activity on the victim’s machine:

• It drops multiple copies of itself as:
  • (Application Data)(Random foldername)(Random alphanumeric 20 characters).exe
  • (Windows System)(Random alphanumeric 20 characters).exe
• Creates a new instance of system program ctfmon.exe and injects it with the malicious code.
• It modifies the windows registry to ensure that the dropped copies get executed on system reboot and also disables some system tools:
  • HKU(USERID)SoftwareMicrosoftWindowsCurrentVersionRun8A54A84: “(Application Data)Jvreanqxgf16E41E5F08A54A8497CF.exe”
  • HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit: “C:WINDOWSsystem32userinit.exe ,C:WINDOWSsystem32D268837808A54A8476D4.exe,”
  • HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciessystemDisableRegedit: 0x00000001
  • HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciessystemDisableTaskMgr: 0x00000001
  • HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsmsconfig.exeDebugger: “P9KDMF.EXE”
  • HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsregedit.exeDebugger: “P9KDMF.EXE”
  • HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionstaskmgr.exeDebugger: “P9KDMF.EXE”
• Disables the Windows Safe Mode by deleting the relevant registry keys.
• It communicates with a remote server hosted in Beijing, China to register the infection and receive further instructions. The communication data between the malware and control server is encrypted. Below are some of the requests that we saw in our analysis:
  
• Complete list of control server URLs that we found in the code analysis:
  
• Complete list of commands that the server can send based on our code analysis:
  • IMAGES
  • GEO
  • LOCK
  • UNLOCK
  • URLS
  • EXECUTE
  • KILL
  • UPGRADE
  • UPGRADEURL
  • LOAD
  • WAIT
  • MESSAGE
• The first GET request causes the control server to return a Microsoft CAB file containing images that will be displayed by the Ransomware when it locks the system:
  
• The second GET request fetches the Ransomware message in German from the control server.

  Translated Message (Credit: Google Translate)

  Ladies and Gentlemen,
  apparently the update program has been completely disrupted. Now the virus can only be removed manually. This you need to use your files to. So if you need the locked data, please send us 200 euros Ukash code to the email: security-center@inbox.lt so soon, this code has been tested, you will receive an update program. If you need your data, we strongly advise you to reformat your computer to completely remove the virus. Ukash can be purchased at any gas station and in several Internet cafes in your area.
  mfG Your Security Team

• The Ransomware will lock the system with the following image once it receives the LOCK command from the control server asking the user to pay 200 euros:
  

Dell SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Ransom.GA (Trojan)

SonicWALL UTM Research team discovered a new variant of Zbot Trojan being spammed in the wild. The spam campaign in this email exploits the timing of the Chinese new year. The spammed email contains an attached PDF with wishes for the Chinese new year along with a link. The link appears to point to the website of the Ministry of Foreign Affairs of the People’s Republic of China but it in fact leads to a malicious domain hosting a newer variant of the Zbot Trojan.

The contents of the attached PDF file is shown below:

The contents of the PDF file translates to:

Brother, Happy Dragon year, and I give you my best wishes!
Thank you for sending me your greetings. I feel the warmth inside.
Long time no contact, I’m not sure if you are still working in China?
[MALICIOUS LINK] Chaili

It performs the following activities when executed:

• It injects code in to winlogon.exe and svchost.exe
• It creates the following files:
  
  • %windir%system32sdra64.exe (Copy of itself) [Detected as GAV: “Zbot.DRGN (Trojan)]
  • %windir%system32lowseclocal.ds (Encrypted config file)
  • %windir%system32lowsecuser.ds (Collected user information)
• It modifies the created and accessed timestamp of %windir%system32sdra64.exe to an older date in 2002 in order to avoid suspicion. It also modifies the files attributes to be read only and hidden.
• It download an encrypted configuration file from a remote domain:
  
  • GET /libraries/joomla/spm.bin HTTP/1.1
    The configuration file when decrypted was found to contain the remote C&C sever, custom hosts file and a list of banking and e-commerce sites to monitor and intercept credentials from along with the HTML pages to be injected
• It contacts a remote C&C server and uploads scrounged cookies and stolen credentials:
  
  • POST /tmp_m/hwnehj/gate.php HTTP/1.1
• It replaces the hosts file in order to be prevent AntiVirus updates:
  
  • 
• It modifies the following registry key to ensure infection on reboot:
  
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon:Userinit “%windir%system32userinit.exe,%windir%system32sdra64.exe,”

This newer Zbot variant has very low AV detection at the time of writing this alert.

SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

• GAV: Zbot.DRGN (Trojan)

SonicWALL UTM Research team observed an increase in spam emails employing hotel reservation spam themes. The emails pretending to be from booking.com informs the recipient that their hotel reservation has been confirmed and that the reservation information is attached. The zipped attachment in the email is a variant of Trustezeb Trojan. This Trojan is specifically crafted to target Trusteer’s security products by attaching itself to run with the execution of some of Trusteer’s processes.

The spam campaign is shown below:

It performs the following activities when executed:

• It injects code in to svchost.exe
• It creates the following files:
  
  • %windir%system32A37C0BC49C3B4DC6F27C.exe (Copy of itself) [Detected as GAV: Trustezeb.A_2 (Trojan)]
  • Program FilesTrusteerRapportbinRapportService.exe [Detected as GAV: FakeTruste.A (Trojan) (Trojan)]
  • %windir%RPService.exe [Detected as GAV: FakeTrusteer.A (Trojan) (Trojan)]
• It modifies the following registry entry to ensure infection on reboot:
  
  • HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit: “%windirsystem32userinit.exe,%windir%System32A37C0BC49C3B4DC6F27C.exe,”
• It creates to following registry entries to add itself as a debugger for Trusteer processes. This ensures it is executed in the execution sequence of these Trusteer products:
  
  • HKLMSOFTWAREClassesMyEze.1shellopencommand: “%SystemRoot%system32RPService.exe %0 %1 %2”
  • HKLMSOFTWAREClassesMyEze.1shelleditcommand: “%SystemRoot%system32RPService.exe %0 %1 %2”
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRapportMgmtService.exe Debugger “RPService.exe”
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRapportService.exe Debugger “RPService.exe”
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRapportSetup-Full.exe Debugger “RPXService.exe”
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution OptionsRapportSetup.exe Debugger “RPXService.exe”
• The following commands were found during analysis
  
  • IMAGES
  • GEO
  • LOCK
  • UNLOCK
  • URLS
  • EXECUTE
  • KILL
  • UPGRADE
  • WAIT
• It contacts a remote command and control server for further instructions:
  
  • {removed}/asdfasdgfs/Fiur5sDzx2col.php

SonicWALL Gateway AntiVirus provides protection against this threat with the following signatures:

• GAV: Trustezeb.A (Trojan)
• GAV: Trustezeb.A_2 (Trojan)
• GAV: FakeTruste.A (Trojan)