Threat Spotlight

For the week of 22 Feb 2010
Threat 1

Fake Conficker alert hides malware

Threat Name:

Mal/EncPk-KW

Users at Risk:

Windows users

Also Known As:

  • Kaspersky: Packed.Win32.Krap.ai
  • PCTools: Trojan.FakeAV
  • Symantec: Trojan.FakeAV

Removal Instructions:

Please use these instructions for removing generically detected files to delete the file from your computer.

About:

This week, Mal/EncPk-KW arrived as an attachment in a Fake Confickerb Infection alert.

Subject: Conflicker.B Infection Alert
Attached file: open.zip
Message body:

Dear Microsoft Customer,
Starting 12/11/2009 the 'Conficker' worm began infecting Microsoft customers unusually rapidly.
Microsoft has been advised by your Internet provider that your network is infected. To counteract further spread we advise removing the infection using an antispyware program.We are supplying all effected Windows Users with a free system scan in order to clean any files infected by the virus.
Please install attached file to start the scan. The process takes under a minute and will prevent your files from being compromised. We appreciate your prompt cooperation.
Regards,
Microsoft Windows Agent #2 (Hollis)
Microsoft Windows Computer Safety Division

Inside open.zip is the file open.exe that will install a fake anti-virus program when executed. Mal/EncPk-KW is part of the Bredo family of malware, which is commonly spread in mass-email campaigns.

Email should not be used for transmitting applications and installable files. A comprehensive gateway security policy should prevent emails such as this from arriving by using True File Type technology to block both executables and archives that contain executable files.

While it may seem to be a giveaway that the subject contains "Conflicker.B" instead of Conficker, many people make this mistake. Conflicker is one of the most used search terms on the Sophos website.

Threat 2

Russian spam campaign

Users at Risk:

All email users, especially those that understand Russian

About:

Spam arrives in people's inboxes not just in English but in a variety of languages, such as Chinese, French, Russian, Spanish et cetera. One special kind of these spam varieties is a short, text-only Russian message—except they are not written in traditional Cyrillic character sets, but rather encoded in UTF-8.

These messages are normally straight to the point with a call-to-action (CTA) being a phone number in Russia for people to call, followed by their set prices for sending bulk mail advertisements within Moscow as well as delivering to all regions within the Russian Federation.

This kind of email arrives from all types of bot-controlled/compromised networks, from many different geographical regions around the world, but mostly outside of Russian networks.

Of course, the spammers are most interested in the "pay" part; they cycle through a variety of phone numbers and employ numerous tricks to obfuscate the phone number itself, such as substituting numeric one (1) with capital I or lowercase L. The other unique and often-employed trick is to replace numeric 3 and 4 with two Russian letters З and Ч respectively.

Users at risk are all email users with a decent email client and/or webmail interface, especially those who understand Russian. These clients don't have to be the "latest and greatest" technology, since Unicode support has long been enabled in email delivery.

  

  

This threat does not pose a great risk to users outside of Russia, but is a great example of how spam is considered a socially-acceptable marketing technique within the Russian market.

Threat 3

DHL delivery notice drops malicious .exe file instead

Threat Name:

Mal/Resdro-A

Users at Risk:

Windows users

Also Known As:

  • Ikarus: Trojan.Win32.Bredolab
  • Kaspersky: Trojan-Spy.Win32.Zbot.aflg
  • Microsoft: Trojan:Win32/Oficla.L
  • PCTools: Trojan.Bredolab
  • Symantec: Trojan.Bredolab

Removal Instructions:

Please use these instructions for removing generically detected files to delete the file from your computer.

About:

This infection is distributed through spam messages similar to Mal/EncPK-KW.

From: "Director Leonel Carmichael" <shipping@dhl.com>
To: censored
Date: Mon, 15 Feb 2010 12:37:57 +0100
Subject: DHL Office. Get your parcel NR.2498
Message body:

Hello!
The courier service was not able to deliver your parcel at your address.
Cause: Mistake in address
You may pickup the parcel at our post office personally.
The delivery advice is attached to this e-mail.
Print this label to get this package at our post office.
Please do not reply to this e-mail, it is an unmonitored mailbox!
Thank you,
DHL Global Forwarding Services.

Mal/Resdro-A is a malicious executable that attempts to drop and run one or more additional executable files.

The malware may arrive as part of the spam campaign relating to BredoZip family of malware such as Mal/BredoZp-B.

The spam may have the attachment with the following filenames:

report.zip
settings.zip
Postal_label_Nr<random number>.zip
Print_label_Nr<random number>.zip
Facebook_password _<random number>.zip
DHL_label_<random number>.zip

The dropped executable files that the malware drops can be related to the Bredo and Zbot family of malware.

When run, the malware may trigger the following HIPS rules: HIPS/FileMod-001.