Threat Spotlight

For the week of 08 Sep 2011
Threat 1

JavaScript hack pushes fake antivirus

Threat Name:

JS/ScrLd-C

Users at Risk:

Windows users

Also Known As:

Avira JS/Clicker.CA
Kaspersky Trojan-Clicker.JS.Agent.ma
McAfee JS/Wonka
Microsoft TrojanClicker:HTML/Iframe.J
Trend Micro JS_WONKA.SM

Removal Instructions:

Please follow the instructions for removing Trojans

About:

JS/ScrLd-C is a generic detection for a malicious JavaScript injected into legitimate webpages.

JS/ScrLd-C is a general-purpose script used in web-based attacks, but we've seen cybercriminals use it to break into sites running Wordpress to redirect users to sites selling fake antivirus software.

The scams work by loading a second script from a remote command-and-control (C&C) server, which attempts to redirect the visitor to a payload site. This lets the hackers change the final payload site at the first level C&C without the need to change every hacked site.

The referrer and keyword parameters pass through from the compromised site, allowing the hackers to track how victims arrive at the payload site.

Threat 2

Spammers exploit 9/11 anniversary

About:

In recent days we've begun seeing a spam campaign seeking to exploit interest in the 10th anniversary of the events of September 11, 2001.

The spam attempts to lure users into participating in a survey in exchange for prizes. But taking the survey only increases the odds of receiving more spam.

In one such sample, the spam survey asks users if they feel that America's safer now than on 9/11. For participating, users are enticed with a free $250 VISA gift card.

090811threatspotlight9-11

The spam message body includes a large section of hidden random text to elude scanners. The links point to a .info domain that is a preferred top level domain of these spammers recently.

Reading the fine print reveals that the spammers are not affiliated with the brands inside the message. The spammers also claim to be "Can-Spam compliant." Clicking on the link redirects you to the spam survey site.

090811threatspotlight9-11survey

Instead of a $250 VISA gift card, the landing site now offers prizes like an iPad 2 and $1,000 gift cards. You have to fill out a form answering questions about your gender, computer use and favorite food before you get to a page where you can supposedly get one of the prizes.

Not surprisingly, filling out the form takes you to yet another site that asks for your email address and participation in a new survey.

090811threatspotlight9-11survey2

Your prize? Just more spam.

Threat 3

Trojan tries to cover its tracks

Threat Name:

Troj/Bredo-JG

Users at Risk:

Windows users

Also Known As:

AVP Trojan-Downloader.Win32.Small.cdar
F-Prot W32/Bredolab.AM.gen!Eldorado
Fortinet W32/FraudLoad.OR!tr.dldr
Ikarus Trojan-Downloader.Win32.Chepvil
K7 Trojan-Downloader ( 77fa77b40 )
Kaspersky Trojan-Downloader.Win32.Small.cdar
McAfee Downloader-CNU
Microsoft TrojanDownloader:Win32/Chepvil.N
NOD32 Win32/TrojanDownloader.Chepvil.A
Norman W32/Kryptik.WV

Removal Instructions:

Please follow the instructions for removing Trojans

About:

Troj/Bredo-JG is a Trojan downloader for the Windows platform.

The downloader uses a fake .PDF icon with a document filename in the attempt to have an unwary user run the executable.

Once executed, the file launches a new copy of the svchost process for itself to download a malicious payload. It then removes the original downloader executable from disk.

The malicious payload saves to the folder

%user%\Local Settings\Temp\

The downloaded payload is detected as Mal/EncPk-WX.

We also detect Troj/Bredo-JG as

Mal/ChepVil-A
Mal/Bredo-K