SonicWALL UTM Research team received reports of a new PS3 Jailbreak Trojan being distributed in the wild. This Trojan is actually a new variant of Trojan Spatet packaged together with a PS3 Jailbreak Tool. This tool purportedly will allow gamers to use their PS3 console without the games original disc. However, users who download this tool get infected by a Trojan Backdoor that steals information from their system.

The release of this Trojan comes after a real PS3 Jailbreak USB Stick has been released and is currently gaining popularity among PS3 gamers.

Arrival & Installation:

This trojan may arrive in the system after being downloaded from the following URL:

• http://www.fol{REMOVED}8e3979fb14

The installer of this Trojan looks like this:

The PS3 Jailbreak tool looks like this:

As the user installs the PS3 Jailbreak tool, it will also install the following:

• %Temp%hahahaha.exe (282 KB) – [ detected as GAV: Rebhip.A (Virus) ]
• %Temp%abc2.exe (563 KB)- [ detected as GAV: Spatet.B (Trojan) ]
• %System%temptempp.exe – [ detected as GAV: Spatet.B (Trojan) ]

It will create Mutex to ensure that only one instance of the application runs in the system:

• {UserName}{Random Number}

(Note: %Temp% is the Temporary Folder, which is usally C:Documents and Settings{User}Local SettingsTemp%System% is the Windows System folder, which is usually C:WindowsSystem32)

Registry Changes:

It adds the following registry entries to ensure that the dropped copy of the malware starts on every system reboot:

• Key: [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun] Value: “Policies”
  Data: “”C:WINDOWSsystem32temptempp.exe””
• Key: [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun] Value: “Policies”
  Data: “”C:WINDOWSsystem32temptempp.exe””
• Key: [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] Value: “HKCU”
  Data: “”C:WINDOWSsystem32temptempp.exe””
• Key: [HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun] Value: “HKLM”
  Data: “”C:WINDOWSsystem32temptempp.exe””

It adds the following registry entries as part of its installation:

• Key: [HKEY_CURRENT_USERSoftwareps3] Value: “FirstExecution”
  Value: “NewGroup”
  Value: “NewIdentification”

Anti-Debugging Technique:

This Trojan employs the following Anti-Debugging/Anti-Analysis technique before it proceeds execution:

• Checks if its running inside a Virtual machine
• Checks if its running inside a Debugger
• Checks if its running under the following Automated Analysis Tools:
  • Anubis
  • CWSandbox
  • JoeBox

Information Stealing:

It collects information from the following:

• Stored IE Account Information
• Stored Mozilla Firefox Account Information
• RAS Accounts
• Browser Autocomplete Forms Content
• Windows Live Account Information
• Current User Name
• Computer Name and IP Address

After it collects information, it will send them to a remote server through HTTP protocol.

Command & Control (C&C) Server connection:
It tries to connect to a remote server to receive further instruction and to send collected information:

• ownedbynob{REMOVED}biz:35578
• hackfre{REMOVED}.com
• steamgi{REMOVED}.at

SonicWALL Gateway AntiVirus provides protection against this worm via the following signatures:

• GAV: Rebhip.A
• GAV: Rebhip.A_2
• GAV: Spatet.B (Trojan)

SonicWALL UTM Research team received reports of a new variant of Yahos worm spreading in the wild. It propagates through Instant Messaging application such as Yahoo Messenger, AOL, Skype and MSN as well as in Social Networking site- Facebook. It also includes IRC-based backdoor capability to receive instructions from remote server.

Installation:

Drops a copy of itself:

• %Windows%jusched.exe – [ detected as GAV: Yahos.BA (Worm) ]

Drops the following files:

• C:sssA1234567890.exe – [ detected as GAV: Yahos.BA_2 (Trojan) ]
• C:WINDOWSsystem32rrrc.yeo – [ detected as GAV: Oficla_14 (Trojan) ]

Downloads related Malware:

• C:WINDOWSsystem328c.html – [ detected as GAV: Kryptik.EVL (Trojan) ]
• %User Profile%fow.exe – [ detected as GAV: Kryptik.CLM (Trojan) ]
• %User Profile%secupdat.dat – [ detected as GAV: Cetorp.P_3 (Backdoor) ]
• C:WINDOWSsystem32secupdat.dat – [ detected as GAV: Cetorp.P_3 (Backdoor) ]

Creates Mutex to ensure that only one instance of the application runs in the system:

• Micro Upe

(Note: %Windows% is the Windows folder, which is usually C:Windows or C:WINNT. %User Profile% is the User folder, which is usually C:Documents and Settings{Current User})

Registry Changes:

It adds the following registry entries to ensure that the dropped copy of the malware starts on every system reboot:

• Key: [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] Value: “Java developer Script Browse”
  Data: “”C:WINDOWSjusched.exe””
• Key: [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun] Value: “Java developer Script Browse”
  Data: “”C:WINDOWSjusched.exe””
• Key: [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionTerminal ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun] Value: “Java developer Script Browse”
  Data: “”C:WINDOWSjusched.exe””

Adds following registry entry to bypass firewall restrictions:

• Key: [HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList] Value: “C:WINDOWSjusched.exe”
  Data: “C:WINDOWSjusched.exe:*:Enabled:Java developer Script Browse”

Command & Control (C&C) Server connection:

Upon successful installation, it tries to connect to a remote server to receive further instruction:
Remote Server: ptf.messenger-update.su





This worm will also join the following IRC Channel to receive instruction:

• #!gf!

The screenshot below shows the IRC communication:

Backdoor Functionality:

• Spread via instant messaging
• Update itself
• Remove itself
• Download and execute files

Network Activity:

This worm may download files and updates from the following addresses:

• 95.211.130.132
• 212.95.32.52
• rgtryhbgddtyh.biz
• wertdghbyrukl.ch

Propagation:

This worm propagates via the following platforms:

Instant Messaging Application:
• AOL
• MSN
• Skype
• Yahoo Messenger





Social Networking site:

• Facebook

Other System Modification:

Terminates the following services:

• Microsoft Malware Protection Service – MsMpSvc
• Windows AutoUpdate Service – wuauserv

SonicWALL Gateway AntiVirus provides protection against this worm via the following signatures:

• GAV: Yahos.BA (Worm)
• GAV: Yahos.BA_2 (Trojan)
• GAV: Oficla_14 (Trojan
• GAV: Kryptik.EVL (Trojan)
• GAV: Kryptik.CLM (Trojan)
• GAV: Cetorp.P_3 (Backdoor)

SonicWALL UTM Research team discovered a wave of YouSendIt spam campaign involving newer variant of Bredolab Trojan in the last 24 hours. The spam emails arrive with a zip archived attachment which contains the Bredolab Trojan executable.

The e-mail pretends to be arriving from YouSendIt which is an online file sharing service. YouSendIt lets users send, receive and track files on-demand. This is the first time SonicWALL has observed YouSendIt storage service provider being used to spoof emails by Bredolab authors while spamming the newer variant of the Trojan.

Attachment: YouSendIt_reader.zip (contains YouSendIt_reader.exe)

Subject: You have received a file from [removed]@[removed].com via YouSendIt. (The subject varies based on the from email address)

Email Body:
————————

Katelyn Goodman has sent you the following via YouSendIt

File attached to this letter.

YouSendIt, Inc. | Privacy Policy
1919 S. Bascom Ave., Campbell, CA 95008
————————

A sample email message looks like:

The executable files inside the attachment looks like this:

If the user opens the malicious attachment then it performs following activities on the victim’s machine:

• Network Activity:
  • It downloads a file from 188.65.74.161 and renames it to _ex-68.exe

  

  • It sends a request to 77.78.249.2

  

  • It send a SYN to 85.234.191.111:80 which is acknowledged by an ACK possibly reporting infected IP
• It creates the following files
  • C:WINDOWSTemp_ex-08.exe – Detected as GAV: Bredolab.SI (Trojan)
  • C:WINDOWSTemp_ex-68.exe – Detected as GAV: FakeAlert.P (Trojan)

  

• It creates the following process in memory
  • C:WINDOWSTemp_ex-08.exe
  • C:WINDOWSTemp_ex-68.exe

  (The process name is a randomized number in memory)

• It creates following registry keys to ensure infection on every system restart under the name “sniffer” :
  • HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun: C:WINDOWSTemp_ex-08.exe
• As part of the infection process it downloads and launches the file _ex-68.exe which is a fake AntiVirus product
  • It launches and displays fake infections

  

  • When the user attempts to remove infections an activation screen is displayed

    

  • When the user clicks “Activate Security Tool” a screen is displayed asking for credit card and personal information

    

SonicWALL Gateway AntiVirus provides protection against this Bredolab Trojan variant with GAV: Bredolab.SI (Trojan) signature. [2,759,497 hits recorded in last 24 hours]