SonicWALL UTM Research team discovered a new Banker Trojan spam theme involving fake McAfee E-mail Protection alerts. The e-mail for the instance we saw is in Portuguese and it warns the user about a computer virus infection.

The e-mail pretends to arrive from McAfee E-Mail Protection and informs the user about his computer being infected with a virus – Worm/Delf.JBH that is sending out malicious emails to all the contacts found on the computer. It further warns the user that the e-mail account will be permanently blocked if the virus is not removed and offers the user to download a fake cleanup tool from McAfee E-mail protection via a URL in the email. If the user clicks on the URL it leads to the download of the new Banker Trojan variant.

The e-mail message looks like:

The downloaded fake McAfee E-mail protection cleanup tool looks like:

If the user runs the malicious executable file, it performs the following activities:

• Downloads and executes two malicious executables files which are also Information stealing Trojan variants:
  • www.te(REMOVED)di.com/union/u6.jpg => C:sshs.exe [Detected as GAV: Delf_150 (Trojan)]
  • www.te(REMOVED)di.com/union/u7.jpg => C:ksso.exe [Detected as GAV: Hupigon_804 (Trojan)]

  Both the files are compressed with PECompact v2 packer. The site hosting these files appears to be compromised as shown below:

  

• The above executable files harvests e-mail addresses and logs other sensitive information on the victim machine and sends the stolen data via POST requests to a malicious domain.

SonicWALL Gateway AntiVirus provides protection against this Trojan via GAV: Banker.BXQ_3 (Trojan) signature.

SonicWALL UTM Research continues to observe the same social engineering tactic being used to spam new variants of Bredolab.

This new variant uses a similar DHL undelivered parcel email spam campaign that we have covered in SonicAlert – Multiple Spam Waves – Bredolab.X This new DHL undelivered parcel spam campaign which started since December 7, 2009 involves a fake e-mail message pretending to have come from DHL Delivery Services. The email informs the user that DHL was not able to deliver their parcel due to error in shipping address. It further instructs the user to pickup the parcel at their post office and print the attached shipping label. This attachment however, is an executable file which is this new variant of Bredolab Trojan.

Another campaign that the authors of this Trojan use is the Facebook password reset spam campaign as it still continues its wave since we covered it in SonicAlert – New social engineering tactics by Bredolab and ZBot. It still involves a fake e-mail message pretending to arrive from Facebook. It informs the users that Facebook have taken measures to provide safety to their clients that include resetting their password. It instructed the users to retrieve their new password from the attached document which is the new variant of Bredolab Trojan.

Campaign #1 – DHL parcel service

Subject:

• DHL Express Services. You need to get a parcel NR.[4-digit numeric number]
• DHL Office. Please get your parcel NR.[4-digit numeric number]
• DHL services. Please get your parcel NR.[5-digit numeric number]
• DHL International. Get your parcel NR.[4-digit numeric number]
• DHL Customer Services. Please get your parcel NR.[4-digit numeric number]

Attachment: DHL_Print_label_12454.zip (contains DHL_Print_label_12454.exe)

Email Body:
————————
Dear customer!

The courier company was not able to deliver your parcel by your address.
Cause: Error in shipping address.

You may pickup the parcel at our post office personaly.

Please attention!
The shipping label is attached to this e-mail.
Print this label to get this package at our post office.

Please do not reply to this e-mail, it is an unmonitored mailbox!

Thank you,
DHL Delivery Services.
————————

The e-mail message looks like below:

Campaign #2 – Facebook Password Reset spam

Subject:

• Facebook Password Reset Confirmation! Customer Message
• Facebook Password Reset Confirmation! Your Support
• Facebook Password Reset Confirmation! Important Message
• Facebook Password Reset Confirmation! Customer Support

Attachment: Facebook_Password_10493.zip (contains Facebook_Password_10493.exe)

Email Body:
————————
Hey [Facebook User]!

Because of the measures taken to provide safety to our clients, your password has been changed
You can find your new password in attached document.

Thank,
Your facebook.
————————

The e-mail message looks like below:

The executable file inside the zip attachment has an icon disguised as a Microsoft Excel sheet file:

The Trojan when executed performs the following host level activity:

• Drops a copy of itself as (Windows System Folder)Startuprarype32.exe (~36KB)
• Deletes the original file
• Injects its code to winlogon.exe process in the memory where it tries to connect to dollardream.ru domain and downloads an encrypted configuration file.

The Trojan is also known as trojan Mal/Bredo-A [Sophos] and TrojanDownloader:Win32/Bredolab.AB [Microsoft].

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Bredolab.AA_6 (Trojan) signature. [13,428,256 hits recorded starting December 10, 2009].

New spammed wave of Storm emails was discovered. The email arrives with the subject: Re: Delivery Protection. The body of the message contains a link pointing to hxxp://www.slowinscy.pl/xxx/index1.php

Details in the alert PDF format

SonicWALL UTM Research team observed reports of a new Trojan targeting Vietnamese speakers reported by Google here. Authors of this malware repackaged the binary together with Vietnamese keyboard driver VPSKeys. VPSKeys is a legitimate application that provides Vietnamese keyboard support to Windows users.

Users who downloaded this keyboard driver may not be aware that it is a tampered version since both the VPSKeys installer and the malicious binary looks the same except for the file size discrepancy.

Screenshot of VPSKeys

Installation

• Copies and runs itself at %User%Application Data folder.

Files Installed

• %User%Application DataJavajre6binjucheck.exe – [Detected as GAV: VBbot.V (Trojan)]
• %User%Application DataJavajre6binzf32.dll
• %User%Application DataVpskeys43.exe – [Detected as GAV: VulcanBot (Trojan)]
• Program FilesAdobeAdobeUpdateManager.exe – [Detected as GAV: VBbot.V (Trojan)]]
• Program FilesAdobezf32.dll
• Program FilesMicrosoft OfficeOffice11OSA.exe – [Detected as GAV: VBbot.V (Trojan)]
• Program FilesWindows DefenderMPClient.exe – [Detected as GAV: Dosvine_2 (Trojan) ]
• Program FilesWindows DefenderMPSvc.exe – [Detected as GAV: Dosvine_3 (Trojan) ]
• Program FilesJavajre6binjucheck.exe – [Detected as GAV: VBbot.V (Trojan)]
• Program FilesJavajre6binzf32.dll
• Program FilesWindows NTWindows Updatewuauclt.exe – [Detected as GAV: VBbot.V (Trojan)]
• Program FilesWindows NTWindows Updatezf32.dll
• %Windir%system32mscommon.inf
• %Windir%system32msconfig32.sys
• %Windir%system32zf32.dll
• %Windir%system32SetupAdobeUpdateManager.exe – [Detected as GAV: VBbot.V (Trojan)]
• %Windir%system32Setupjucheck.exe – [Detected as GAV: VBbot.V (Trojan)]
• %Windir%system32SetupMPClient.exe – [Detected as GAV: Dosvine_2 (Trojan) ]
• %Windir%system32SetupMPSvc.exe – [Detected as GAV: Dosvine_3 (Trojan) ]
• %Windir%system32SetupOSA.exe – [Detected as GAV: VBbot.V (Trojan)]
• %Windir%system32Setupwuauclt.exe – [Detected as GAV: VBbot.V (Trojan)]
• %Windir%system32Setupzf32.dll

Registry Changes

Added Registry
• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon
  Value: Userinit
  Data: “C:WINDOWSSystem32userinit.exe,C:Program FilesAdobeAdobeUpdateManager.exe”

Added to run the binary as a service

• Key: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesjucheck
  Value: ImagePath
  Data: C:Program FilesJavajre6binjucheck.exe

Added to run the binary on every Windows startup

• Key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
  Value: Adobe Update Manager
  Data: “C:Program FilesAdobeAdobeUpdateManager.exe”
• Key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
  Value: Microsoft Office quick launch
  Data: “C:Program FilesMicrosoft OfficeOffice11OSA.exe”
• Key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
  Value: Windows Update Automatic Updates
  Data: “C:Program FilesWindows NTWindows Updatewuauclt.exe”
• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
  Value: Adobe Update Manager
  Data: “C:Program FilesAdobeAdobeUpdateManager.exe”
• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
  Value: Microsoft Office quick launch
  Data: “C:Program FilesMicrosoft OfficeOffice11OSA.exe”
• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
  Value: Windows Update Automatic Updates
  Data: “C:Program FilesWindows NTWindows Updatewuauclt.exe”

  Added to run the binary on Windows Safemode

• Key: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootMinimaljucheck
  Value: @
  Data: “Service”
• Key: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSafeBootNetworkjucheck
  Value: @
  Data: “Service”

Modified Registry
• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon
  Value: Userinit
  Original Data: “C:WINDOWSSystem32userinit.exe,
  Modified Data: “C:WINDOWSSystem32userinit.exe,C:Program FilesAdobeAdobeUpdateManager.exe”

Process Created

• jucheck.exe
• AdobeUpdateManager.exe
• MPsvc.exe
• wuauclt.exe
• OSA.exe

Network Activity

It tries to connect to the following domain:

• adobe.ath.cx
• blogspot.blogsite.org
• google.homeunix.com
• tyuqwer.dyndns.org
• update-adobe.com
• voanews.ath.cx
• ymail.ath.cx

This malware is also known as W32/Vulcanbot [Mcafee], Win32/VBbot.V [Microsoft], and VBbot.A [Eset]

SonicWALL Gateway AntiVirus provides protection against this Trojan via GAV: Vulcanbot (Trojan), GAV: Dosvine (Trojan), GAV: Dosvine_2 (Trojan), GAV: Dosvine_3 (Trojan) and GAV: VBBot.V (Trojan) signatures.

SonicWALL UTM Research team observed a new wave of the previously seen Fake IRS notice spam campaign starting yesterday – March 25, 2010, which takes advantage of the Tax period to target users. US-CERT issued an alert related to it today morning.

The email pretends to arrive from an irs.gov e-mail address and contains a URL to the fake notice. If the user clicks on this URL, it leads to a fake IRS page which prompts the user to download the new ZBot Trojan variant.

The e-mail looks like:

Subject: Notice of Underreported Income

Email Body:
————————
Taxpayer ID: [email handle-(14 digit random number)US] Tax Type: INCOME TAX
Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below):

review tax statement for taxpayer id: [email handle-(14 digit random number)US] (<-- Malicious URL)

Internal Revenue Service
————————

The e-mail message looks like below:

The site that opens up when user clicks on the URL inside the e-mail is shown below:

As seen in the screenshot the malicious site prompts the user to download and execute the IRS notice which in reality is the malware executable file as seen here:

The new ZBot variant performs following activities upon execution:

• It creates MUTEX objects _AVIRA_2108, _AVIRA_2109 to mark its presence on the system.
• It attempts to download an encrypted configuration file via following GET request:
  GET /cnf/shopinf.jpg HTTP/1.1
  …
  Host: shopinfmaster.com
  
• Creates following files:
  • (Windows_System)lowseclocal.ds
  • (Windows_System)lowsecuser.ds
  • (Windows_System)lowsecuser.ds.lll
  • (Windows_System)sdra64.exe

  (Copy of itself)

• Ensures that it runs every time Windows restart by modifying following registry entry:
  • HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogonUserinit: “(Windows_System)userinit.exe,(Windows_System)sdra64.exe,”

The Trojan is also known as PWS:Win32/Zbot.gen!R [Microsoft] and Packed.Win32.Krap.ae [Kaspersky].

SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Zbot.YP_7 (Trojan) signature.