The Sonicwall UTM research team received reports of a new Banking Trojan in the wild. Banking Trojans steal logon credentials and target specific banks. This Banking Trojan targets users of ITAU bank based in Brazil. The Trojan steals bank logon credentials by redirecting traffic through a remote webserver.

The Trojan adds the following files to the filesystem:

• {run location}abcde.txt [Detected as GAV: Banker.ITC (Trojan)]
• C:Documents and SettingsAll UsersApplication Databola7.txt [Detected as GAV: Banload.QLO_2 (Trojan)]
• C:Documents and SettingsAll UsersApplication Dataclear.exe [Detected as GAV: Banker.SMY_4 (Trojan)]
• C:Documents and SettingsAll UsersApplication Datacrsrc.exe [Detected as GAV: Banker.SMY_5 (Trojan)]
• C:Documents and SettingsAll UsersApplication Dataiexplore.exe [Detected as GAV: Banker.SMY_6 (Trojan)]
• C:Documents and SettingsAll UsersApplication Datambservice.exe [Detected as GAV: Banker.SMY_7 (Trojan)]
• C:Documents and SettingsAll UsersApplication Datah4714log.txt

h4714log.txt contains the following data:

tipo=inf
nomepc={USERNAME}
mac=08-00-27-{removed}

The Trojan adds the following key to the Windows registry to enable startup after reboot:

• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun mbservice.exe “C:Documents and SettingsAll UsersApplication Datambservice.exe”

Upon infection the Trojan replaces itself with {run location}abcde.txt and then runs mbservice.exe. mbservice.exe runs in the background inspecting window title strings. It contains code that looks for a specific window title string “BANCO ITAU – FEITO PARA VOCE” running in Internet Explorer.

The Trojan targets users of ITAU bank. Below is a screenshot of their main page:

The Trojan redirects all traffic through a remote webserver and was observed leaking the following data from h4714log.txt:

The Trojan also leaks data typed into the “Agency” and “Account” boxes and passwords using the virtual keyboard:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Banload.QLO_2 (Trojan)
• GAV: Banker.SMY_4 (Trojan)
• GAV: Banker.SMY_5 (Trojan)
• GAV: Banker.SMY_6 (Trojan)
• GAV: Banker.SMY_7 (Trojan)

SonicWALL UTM Research team received reports of a new spam campaign pretending to be arriving from US Postal Service spreading in the wild. It contains the new variant of Dofoil Trojan that SonicWALL blocks as GAV: Dofoil.L. This worm also downloads other malware components including trojans and FakeAV malware.

The sample e-mail format of the spam campaign includes the following:

Subject:

• USPS Shipment Status IDxxxxxxxx
• USPS service. Get your parcel IDxxxxxxxx
• USPS Invoice copy IDxxxxxxxx
• USPS Tracking number IDxxxxxxxx

Attachment: Post_Label#id{Random Numbers}.zip

The ZIP file attachment contains the malicious executable that disguises itself with the use of Microsoft Word icon as shown below:

Example of the email spam:

If the user downloads and executes the malicious executable inside the zip attachment, it performs the following activity:

• Creates the process SVCHOST.EXE and injects its code.
• Creates a copy of itself as %application data%csrss.exe and deletes the original executable file

Downloads other malware:

• %windir%system32msrepl40A.exe – [ detected as GAV: Swisyn.JYB (Trojan) ]
• %windir%system32wbcache8.exe – [ detected as GAV: Swisyn.JYB (Trojan) ]
• sl20.exe – [ detected as GAV: EncPk.WX_3 (Trojan) ]
• setup.exe – [ detected as GAV: Pirminay.ANW (Trojan) ]
• 574-01.exe – [ detected as GAV: FakeAlert.BHX (Trojan) ]
• sssss.exe – [ detected as GAV: Danmec.L (Trojan) ]

Added Registry:

• Key: HKEY_CURRENT_USERSoftwaregtwbetugt
  
• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
  Value: Epsilon Squared
  Data:”%Application Data%csrss.exe”
• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
  Value: TKYDMYTE
  Data:”C:WINDOWSSystem32wbcache8.exe”
• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
  Value: Dbft
  Data:”C:WINDOWSSystem32msrepl40A.exe”

Network Activity:

HTTP GET Requests:

• http://live{REMOVED}128.ru/m07/index.php
• http://suteki{REMOVED}disc.jp/walking-diet/
• http://image{REMOVED}ing.be/

DNS Requests:

• http://live{REMOVED}128.ru

Hosts File Modification:

This malware added the following entries to block access to torrent websites.

• 127.0.0.1 thepiratebay.org
• 127.0.0.1 www.thepiratebay.org
• 127.0.0.1 mininova.org
• 127.0.0.1 www.mininova.org
• 127.0.0.1 forum.mininova.org
• 127.0.0.1 blog.mininova.org
• 127.0.0.1 suprbay.org
• 127.0.0.1 www.suprbay.org

FakeAV

After Installing the FakeAV application, it will show a Fake Windows Error Alert as seen below:

Clicking the “Scan and fix” Button will scan for errors and show a fake result:

Clicking the “Fix Errors” button prompts the user to buy the fake security software.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: Dofoil.L#email (Trojan)
• GAV: Dofoil.L (Trojan)
• GAV: Swisyn.JYB (Trojan)
• GAV: EncPk.WX_3 (Trojan)
• GAV: FakeAlert.BHX (Trojan)
• GAV: Danmec.L (Trojan)