Threat Spotlight

For the week of 18 Aug 2011
Threat 1

Package, credit card spam carries Trojan

Threat Name:

Troj/Agent-TAB

Users at Risk:

Windows users

Also Known As:

a-squared Trojan.Win32.Yakes!IK
AntiVir TR/Dldr.FakeAV.KC
AVP Trojan.Win32.Yakes.bss
F-Secure Trojan:W32/Agent.DTFO
Kaspersky Trojan.Win32.Yakes.bss
NOD32 Win32/TrojanDownloader.Agent.QVB

Removal Instructions:

Please follow the instructions for removing Trojans.

About:

Troj/Agent-TAB is a Trojan for the Windows platform.

We've seen Troj/Agent-TAB distributed in attachments to emails that claim to come from USPS warning recipients of a failed or future parcel delivery. The spammers ask recipients, in various badly-phrased messages, to open the attached zip file containing the malware.

Subject:
USPS: DELIVER CONFIRMATION - FAILED 55110467

Content:
GOOD AFTERNOON!
Dear Customer,
RECIPIENT'S ADDRESS IS WRONG
Please fill in attached file with right address and resend to your personal manager.
Best Regards,
Your UPS TEAM

Subject:
USPS ATTENTION 452963

Content:
HELLO!
Dear Client,
DELIVERY CONFIRMATION: FAILED
Please print out the invoice copy attached and collect the package at our department.
With respect,
USPS Team

Subject:
UPS notification

Content:
Dear customer.
The parcel was sent your home address. And it will arrive within 3 business day.
More information and the tracking number are attached in document below.
Thank you.
Copyright @ 1994-2011 United Parcel Service of America, Inc. All rights reserved.

We've also seen Troj/Agent-TAB in emails purporting to come from credit card providers. In this instance the recipient is informed that their account has been compromised and subsequently blocked. The attachment, again a zip file, is said to contain information which will assist in resolving the problem.

Subject:
Your credit card is blocked

Content:
Dear Consumer,
Your credit card has been blocked!
From your credit card has been removed $ 430,5
Possibly illegal transaction!
More detailed information in the attached file.
Instantly contact your bank.
Best wishes,
MC Customer Services.

Sophos detects the zip attachment as Troj/Invo-Zip.

When run Troj/Agent-TAB starts a process and establishes an Internet connection to download further malicious files before deleting itself.

Threat 2

Spammer ASCII art may trick filters

About:

Spammers are certainly not fools. They are aware that their messages are blocked. So they have become innovative in an effort to evade spam filters.

Nowadays they either send the spam messages in pictures with the contents blank (while attaching the spam body as a JPEG in an enclosure), or resort to some very basic ASCII art, as can be seen in the following screen capture.

18082011ASCIIart

In contrast to enclosed JPEGs, ASCII messages are much smaller in body size—very often under 1 kb—versus 1MB for static JPEGs or animated GIFs. These messages are not limited to Russian girl dating services, but include pill campaigns as well.

When enlarged from the source view, we see these messages primarily consist of a single letter or number repeated many times to generate visual effects.

18082011ASCIIartenlarged 

Spammers are attempting to sneak past email filters hunting for phrases commonly used in spam. It's a crafty trick because normal spam engines would not filter out just one single letter or number.

If there are any clickable parts in the message, they normally go directly to large free web hosting servers.

These email messages normally originate from East European networks, and are typically delivered to Italy, Germany and North America.

This "art work" may offer users something iteresting to look at, but you should still be wary of visting any sites pushed by these crafty spammers.

Threat 3

Fake Firefox update steals passwords

Threat Name:

Troj/PWS-BSF

Users at Risk:

Windows users

Also Known As:

Avira TR/Spy.ZBot.aoqb.5
AVP Trojan-Spy.Win32.Zbot.bbei
McAfee PWS-Zbot.gen.ds trojan
Microsoft PWS:Win32/Zbot
Trend TSPY_ZBOT.SMIG

About:

Troj/PWS-BSF is a Trojan for the Windows platform.

We've seen this Trojan attached to spam disguised as a fake security update to the popular Firefox web browser. Users who open the attached file download the password-stealing Trojan.

Troj/PWS-BSF includes functionality to create batch scripts and inject threads into running system processes in an effort to hide itself.

When Troj/PWS-BSF is installed it usually copies itself to:

<user>\Application Data\<random name>\<name>.exe

Registry entries are created under:

HKCU\Software\Microsoft\<random name> 

Troj/PWS-BSF communicates via HTTP with a remote location.