VIRUS \ Spyware ALERTS - October 27, 2008

27 October 2008

For the last couple of weeks, I have been watching a series of new, related web attack sites surfacing. All follow a similar modus operandi, with an attack site exploiting a bundle of client-side vulnerabilities, some of which are pretty old:

MDAC (MS06-014)
NCTAudioFile2.AudioFile ActiveX control (CVE-2007-001
Snapshot Viewer (MS08-041)
MSDDS (MS05-052)
Visual Studio MSMask32 (CVE-2008-3704)
Adobe Acrobat Reader (CVE-2007-5659)
Nothing hugely interesting or novel then, just another batch of attack sites popping up, most likely thanks to the creation and sale of some new attack toolkit. At this point I have not identified the specific kit that has been used to construct the attack sites we are seeing. There is a pretty diverse range of malware being installed from these sites, ranging from banking Trojans to stealthing backdoors (including Troj/Agent-IAT, Troj/Ambler-F and Mal/EncPk-BU). An example attack is illustrated below (click to view larger image with details):

More: http://www.sophos.com/security/blog/2008/10/1885.html

27 October 2008 17:05 GMT

HIPS HIPS Hooray for proactive detection
This morning looking through the customer submissions to Sophos (how to submit samples). I saw a sample with the ?Rule or identity name triggered by this file (if applicable)? form filled in as HIPS/RegMon-009.

Looking at SophosLabs automated scans of this sample it was a malicious AutoIT file. Running the file through the automated replication rigs here in SophosLabs it also hit the following HIPS rules:

HIPS/RegMod-001
HIPS/RegMod-002
HIPS/RegMod-009
HIPS/RegMod-012
HIPS/FileMod-004

More: http://www.sophos.com/security/blog/2008/10/1884.html

Category Viruses and Spyware

Type Worm

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/w32imautd.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibj.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibi.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/Fanbot-L is a Trojan for the Windows platform.

Troj/Fanbot-L includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Fanbot-L copies itself to <System>\llwzjy081027.exe and creates the following files:

<User>\jjjydf16.ini
<Root>\dfDelmlljy.bat
<System>\mvjaj32dla.dll

The file mvjaj32dla.dll is detected as Mal/Behav-236.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfanbotl.html?_log_from=rss

Aliases Application-ErrorKiller

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojfakeavfl.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Troj/DwnLdr-HJS is a Trojan for the Windows platform.

Troj/DwnLdr-HJS includes functionality to access the internet and communicate with a remote server via HTTP.

When first run, Troj/DwnLdr-HJS copies itself to:

<All Users>\Application Data\<random>
<random>.exe

The Trojan will also copy itself to ihidebox.exe.bak in the location where it was executed.

Troj/DwnLdr-HJS creates the following registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
<random>
<path to Trojan>

HKCU\Uninstall
<random>
1226588034

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdwnldrhjs.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

When first run, Troj/Drop-BF creates the following files:

<System>\siemens.dll
<System>\sfl.txt
<Windows>\inform.dat

The file siemens.dll, which is already detected as Mal/Generic-A, is installed as a Browser Helper Object, and made to start when Windows is started with the following registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Browser Helper Objects
{47D92EB6-E52C-4cda-92A6-2369963F4913}

HKCR\CLSID\{47D92EB6-E52C-4cda-92A6-2369963F4913}
InprocServer32
siemens32.dll

The files sfl.txt and inform.dat are related to the keylogging activities of the siemens.dll file and can be safely deleted.

http://www.sophos.com/security/analyses/viruses-and-spyware/trojdropbf.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibl.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibk.html?_log_from=rss

Category Viruses and Spyware

Type Trojan

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/trojagentibe.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/malveneba.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Affected operating systems Windows

http://www.sophos.com/security/analyses/viruses-and-spyware/maldelfp.html?_log_from=rss

Category Viruses and Spyware

Type Malicious Behavior

Mal/Behav-302 is a malicious program for the Windows platform.

Detection for members of Mal/Behav-302 is behavior based. It is extremely important that customers report detections of Mal/Behav-302 to Sophos and send a sample for analysis.

http://www.sophos.com/security/analyses/viruses-and-spyware/malbehav302.html?_log_from=rss

Alert ID : FrSIRT/ALRT-2008-06467
Aliases : N/A
Size : 33792 bytes
Rated as : Moderate Risk
Release Date : 2008-10-27


Description

This worm arrives as attachment to email messages spammed by another malware or a malicious user. It may be dropped by other malware.

References

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AUTORUN.PB

Credits

Reported by Trend Micro

Alert ID : FrSIRT/ALRT-2008-06466
Aliases : N/A
Size : Varies
Rated as : Low Risk
Release Date : 2008-10-27


Description

Trojan.Fakeavalert.B is a Trojan horse that registers itself as a Browser Helper Object on the compromised computer.

References

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-102416-5319-99

Credits

Reported by Symantec

Alert ID : FrSIRT/ALRT-2008-06463
Aliases : N/A
Size : N/A
Rated as : Low Risk
Release Date : 2008-10-27


Description

W32.Patched!gen is a generic detection for system files infected or modified by a virus.

References

http://www.symantec.com/business/security_response/writeup.jsp?docid=2008-102719-2540-99

Credits

Reported by Symantec