Following the footsteps of TROJ_ARTIEF.A– aka the Better Business Bureau-spoofing Trojan that reportedly “duped” more than a thousand business executives in the US — TrendLabs has recently detected not one, but two new malware attempting to employ similar routines and social engineering techniques…plus more. The first copycat, TROJ_ARTIEF.B, also arrives embedded in an RTF document. The said document is pointed to by a link included in spammed messages posing as email from Criminal Investigation department. The said message has the following deatils:

Dear XXXXX, We regret to inform you that your company is currently being investigated by our CI department for criminal tax fraud due to a complaint that was filled by a {supposed complainant} on 02/05/2007 Complaint Case Number: MT529057251 Complaint made by: {supposed complainant} Complaint registered against :{company} Date: 02/05/2007 You are being investigated for submiting false income tax returns with the California Franchise Tax Board. Instructions on how to resolve this issue aswell as a copy of the original complaint can be found on the link bellow. {link here} Complaint Documents Criminal Investigation (CI) serves the American public by investigating potential criminal violations of the Internal Revenue Code and related financial crimes in a manner that fosters confidence in the tax system and compliance with the law. Criminal Investigation department resides at: {CI office address} Please note that you are required to review the complaint and fill out the document from the above link and mail it to the CI address.

It seems Italy is fast becoming the hub of malware authors. I still remember the nasty days when the Linkoptim also known as Gromozon malware was spreading like wildfire throughout the net. And now typo-squatters have followed the lead of LinkOptim to again plague the Italian surfers. For those unfamiliar with typo-squatting, you can read more about it here. Internet users in Italy are currently under attack by a massive typo-squatting made by malware authors. Some of the URLs used by this attack are listed below.

• 3bay.it
  
• 4repubblica.it
  
• aklitalia.it
  
• corrieere.it
  
• eba6y.it
  
• eba7y.it
  
• fgazzetta.it
  
• fgoogle.it
  
• gazzetra.it
  
• gazzettaa.it
  
• katsaweb.it
  
• mnsn.it
  
• tyiscali.it
  
• tyttogratis.it

For a full list of URLs used in the attack, download the pdf file here. (Courtesy of Sunbelt-Software.) The page shown below is loaded upon visiting these URLs.

Here is a babelfish translation of the words on the page. Impossible to find the page demanded In order to visualize the demanded page the modernization of Internet Explorer (direct link to a malware file) is necessary. In alternative, it finds on Extra Search the tried page.

Status: ACTIVE
Created: 2005-08-24 00:00:00
Last Update: 2007-05-08 16:43:56
Expire Date: 2007-08-24

Registrant
Name: PROLAT
ContactID: PROL20-ITNIC
Address: zip: LV-5400
DE
Created: 2007-03-01 10:27:17
Last Update: 2007-03-01 10:27:17

Admin Contact
Name: Bojarovs Aleksejs
ContactID: BA3396-ITNIC
Address: street: Grodnas 42/72
zip: LV-5400
city: Daugavpils
DE
Created: 2005-06-13 00:00:00
Last Update: 2007-03-01 07:48:12

Technical Contacts
Name: Bojarovs Aleksejs
ContactID: BA3396-ITNIC
Address: street: Grodnas 42/72
zip: LV-5400
city: Daugavpils
DE
Created: 2005-06-13 00:00:00
Last Update: 2007-03-01 07:48:12

Registrar
Organization: FROG
Name: PROLAT-MNT

Nameservers
ns1.metallichosting.com
ns2.metallichosting.com

I’m pretty sure most, if not all, of us have already heard about the phenomenal pay-to-play MMORPG called “World of Warcraft”. With over 8 million subscribers worldwide and more than 2 million in just the United states alone. Well, upon seeing these numbers it wouldn’t be a surprise to learn that Malware authors have taken advantage of the games popularity to spread some other malware cheer.

Just recently another set of websites have been found to contain variants of TSPY_WOW and TROJ_ANICMOO.AX. TSPY_WOW variants are basically known to monitor users internet browsing activities as well as steal information related to the online game World of Warcraft such as usernames and passwords.

Users should be wary of the sites they visit as they may often look like the official WOW site. Below is a list of domains that were recently verified to host malicious files:

• http://world0fwarcraft.net
  
• http://www.wor1dofwarcraft.com

Early this month, news of the disappearance of 4-year old Madeleine McCann struck the interest of the public all over the world, as various efforts from different communities are put into action to help find the missing child.
One of these is the setting up of the Official Web site, which has been launched to help the search campaign. A fund-raising effort, called “Madeleine’s Fund: Leaving No Stone Unturned” was also started to help finance Madeiline’s search, as well as to aid in the search for other abducted children.

As usual, scammers are not leaving any stone unturned as well when it comes to exploiting for profit. Banking on the public’s curiosity and emotions, these scammers are using this tragic event to lure victims into giving out their credit card and bank account numbers.
These malicious users have created a series of fake Web sites that pose as the official bringmadeleinehome.com site, asking for donations from unsuspecting donors.

Recently, Belgian IT security professional, Didier Stevens, discovered that clicking one of the links in the News items of bringmadeleinehome.com site led to the downloading of a malicious JavaScript, which is already included in the generic Trend Micro detection JS_EXCEPTION.GEN. He noted, however, that “the Trojan was not hosted on or linked to from the findmadeleine.com site.”

Over the weekend, we intercepted one particularly typical sample via our honeypots. The file we received was a Rich Text Format (RTF) document. Nothing new you might think and upon initial inspection nothing seemed out of the ordinary. However, further analysis of the file revealed that it actually contained a malicious executable file embedded within the document itslef.

Trend Micro already detects this as TROJ_ARTIEF.A

Upon execution of the said file, it drops an HTML component in the Windows TEMP folder. The HTML file is then injected into the process IEXPLORE.EXE so that it is opened in a hidden Internet Explorer window each time the user runs IE.

It also downloads a file from:

http://66.116.{BLOCKED}.202/cp/scripts/scripts/updater.exe

and saves it to your Windows TEMP folder using the filename UPDATE.EXE. As is uses the Adobe PDF icon, it tricks the user into thinking it is a non-malicious file. It even displays the following error message as part of its ploy.

Below is a screenshot of the email containing the said attachment: