Threat Spotlight

For the week of 31 Jan 2011
Threat 1

Fake Facebook password change notifications

Threat Name:

Troj/Agent-QAY

Users at Risk:

Windows users

Also Known As:

  • McAfee: Generic.dx!vqg trojan
  • Symantec: Trojan.Sasfis
  • Trend Micro: PAK_Generic.001

Removal Instructions:

Please follow the instructions for removing Trojans.

About:

Troj/Agent-QAY is part of a malware campaign targeting Facebook users. The campaign sends emails with the following subject lines:

Facebook Service. Personal data has been changed! ID[random number]

Facebook Office. Your login details changed! ID[random number]

--and has the following attachment:

Facebook_details_ID[random number].zip

The zip file is detected as Mal/BredoZp-B.

In general, the message body of the email has variations of the following:

Good afternoon

A Spam is sent from your FaceBook account.

Your password has been changed for safety.

Information regarding your account and a new password is attached to the letter.
Read this information thoroughly and change the password to complicated one.
Please do not reply to this email, it's automatic mail notification!

Thank you.
FaceBook Service.

When a user executes the email attachment, the Trojan attempts to contact interviewbuy.ru and download additional files. One of the files the Trojan downloads is a document with the fake parcel delivery information.

In addition to the standard detection provided for Troj/Agent-QAY, the proactive HIPS technology in Sophos Endpoint Security can prevent the action of this malware and the additional malware it attempts to install. When Troj/Agent-QAY runs, it will fire the following HIPS rules:

HIPS/ProcMod-004
HIPS/ProcMod-007
Threat 2

Spike in Russian dating spam

About:

For the past few weeks, the traps at SophosLabs have seen a resurgence of the so-called "Russian Dating" spam. While these campaigns are not new, we are seeing them use new tactics. Here is a sample of four different styles of campaign that we have seen in the past week.

The first style of campaign has used the old-fashioned ASCII art messages:

These messages typically advertise a dating website, which is often also spelled out in ASCII art, to make parsing out the domain impossible.

The second style of campaign has spammed out messages linking to dating posts made on legitimate (non-dating) forums. Here is a sample message:

Since January 27, we have seen over 125,000 of these messages on our traps, with the links pointing at posts made on hundreds of forums.

The third style reverts back to a simpler time, being just a "heart-felt" message from a lonely lady, asking you to reply to her webmail address should you be interested in a serious relationship:

The text of these messages changes very frequently, as do the email addresses, which are usually Yahoo-based.

The last style of campaign also advertises dating websites, but uses the lure of messages already waiting for you to lure in traffic:

It also turns out that the ladies are also not restricting themselves to English speaking bachelors, either:

All of these campaigns are being sent through networks of infected hosts around the world. This campaign aims to target single men who may be persuaded into parting with some of their money for the chance at a relationship with an exotic stranger. However, they are all scams, and Sophos blocks all of the above campaigns.

Threat 3

Trojan takes advantage of Java vulnerability

Threat Name:

Mal/JavaDldr-B

Users at Risk:

Windows users

Also Known As:

  • Avira: TR/Java.StartPage.J.2
  • AVP: Trojan.Java.StartPage.j
  • McAfee: Exploit-ByteVerify trojan
  • Microsoft: Exploit:Java/ByteVerify.HL
  • Symantec: Java.StartPage

Removal Instructions:

Use the instructions for removing generically detected files to delete the file from your computer.

About:

Mal/JavaDldr-B is a malicious Java class file that attempts download code from the Internet. The Trojan may have the following payload:

- Exploit getSoundBank() Remote Heap Buffer Overflow vulnerability to execute arbitrary code.
- Drop downloaded code onto disk and attempt to run the downloaded code