Beware of spammed email messages claiming to be from Trend Micro but come from a bogus email address, include a subject line totally unrelated to Trend Micro’s business, and include within the grammatically flawed message a link to a domain name that is not an official Trend Micro URL. Phishing attacks like these are not unusual and rogue anti-spyware is common.

TrendLabs received reports today of this spammed email message, which entices users to download a supposedly free trial version of Trend Micro Anti-Spyware software by clicking on a link. The said link opens a fake Trend Micro Web site, as seen below:

Clicking on the links found on these pages eventually leads to the downloading of a Trojan detected as TROJ_DROPPER.CNH. This Trojan, in turn, downloads a spyware detected as TSPY_AGENT.YZR.

Trend Micro already blocks the malicious Web page with its In-the-cloud URL Filtering Service, and detects the malware files with the latest pattern file 4.695.00. Trend Micro users who may have been affected by this phishing attempt can also automatically remove the malware files and restore their systems using GeneriClean.

TrendLabs advises users and customers to be wary of all spammed messages like this because they could contain Web threats. If you wish to download any Trend Micro software, we highly recommend that you type in directly the correct URL, http://www.trendmicro.com, in the address bar of your browser instead of clicking links from unsolicited email messages.

UPDATE: The said phishing Web site has since been taken down.

August was a spam-filled month, riddled with unsolicited email messages that employed techniques to bypass traditional filtering methods. A lot of malware actually rely on spammed email to get around, notably WORM_NUWAR, known infamously this month for using e-card greetings. Let’s have a recap on what happened last month.

---

Notable Malware:

WORM_NUWAR.MV. Similar to its predecessors, this latest WORM_NUWAR variant employs wave after wave of spammed email to attract users into downloading a copy of the worm into their systems. It comes with a couple of twists though. For one thing, the spammed email message is filled with extra characters and symbols, combined with some strikethroughs. Our antispam experts here tell us that this is a way of avoiding filtering techniques used by security applications.
The spammed message contains a link that leads to a webpage where the malware can be downloaded automatically, thanks to a malicious Javascript component (JS_DLOADER.PCT).

TROJ_GPCODE.AB and TROJGPCODE.AC. Following the footsteps of TSPY_KOLLAH.F, these two Trojans are the latest ransomware to date, encrypting valuable data on the users system using the RSA-4096 algortihm. Unlike the attacks made with TSPY_KOLLAH.F however, the perpetrators behind these two Trojans demanded less payment ($150 only as compared to the $300 demanded by TSPY_KOLLAH.F).

TSPY_MAMAW.A. This information-stealing Trojan apparently logs in to monster.com (a popular job search website) using a compromised account that is meant for employers who want to review resumes. Once it has gained access, the Trojan harvests the information contained within monster.com’s resume database, siphoning off names, home and mobile phone numbers, home addresses and email addresses into a remote server. It is possible that the Trojan was created to harvest email addresses for the use of spammers. There’s that spam connection again…

WORM_ZHELATI.MAB. Another malware utilizing spammed email, this latest variant of WORM_ZHELATI takes advantage of the popularity of YouTube. An unsuspecting user receives spammed email containing a link that supposedly leads to a YouTube video. Of course the link does not lead to any video, but instead redirects the user to a mimic of the YouTube site, where the user is eventually tricked into downloading the worm.


Web Threats:

UN Website Defaced. The United Nations website was defaced by a hacktivist group calling themselves the “Turkish Defacers”. Originally, the website contained statements posted by the UN Secretary General. The hacktivists eventually replaced them with pacifist messages. An exploit was used to take advantage of an SQL injection vulnerability in order to gain access to the the server hosting the site. As of now, the website has been patched and restored.

Compromise of a Taiwanese Private High School Website. DaHua High School, a private educational institution in Taiwan, also suffered from having its website compromised. An IFRAME tag found in the website’s initial page loads a malicious webpage that is completely unaffiliated with the high school. This leads to another malware download and in this case, TSPY_DELF.GMN is downloaded.

Fake Google Page. Towards the end of August, a fake Google page was discovered. Whoever created the page did a fairly good job of imitating the real thing, because ordinary users wouldn’t spot any difference between the fake and the original, unless they happened to notice the obfuscated pieces of JavaScript code residing in the page’s HTML source. Clicking on any of the links present on the page downloads a variant of WORM_SOHANAD on the user’s system.

Vulnerabilities:

Yahoo widgets. It has just been a month after the disclosure of Yahoo’s webcam vulnerability and another vulnerability has been uncovered, this time regarding Yahoo’s widget applications. A vulnerability exists in the implementation of the ActiveX control used in the widgets which allows remote malicious users to execute code on affected machines. Yahoo has already issued a security advisory to address this issue, advising users to download an update for the widgets.

New Ichitaro Exploit. TROJ_TARODROP.Q was responsible for exploiting the vulnerabilities found in Ichitaro last August. For those unfamiliar with it yet, Ichitaro is a popular word-processing application used in Japan. In depth analysis reveals that the exploit is based on a stack-based overflow that takes advantage of a certain wrapper function contained in one of the DLLs used by the application. It seems that there was no validation done on the wrapper function, so a buffer overflow overwrites the return value found on the stack, thus leading to control of the execution.

ServerProtect. Yes, even our own security products do get their share of vulnerabilities. Thanks to SANS Internet Storm Center (ISC) we were made aware of vulnerabilities in ServerProtect. The guys at ISC noticed an increase in scans of port 5168, which happens to be a communication port used by ServerProtect. The incident may indicate that some perpetrators may be looking for ways to exploit the vulnerability. Fortunately, we’ve just issued a security patch for ServerProtect to address this vulnerability.

---

So that’s it for the month of August. September has come along, which means that Halloween, Thanksgiving and Christmas are just around the corner. We’re pretty sure that at least a single malware will capitalize on these events. Lets just see and wait what happens until next months malware roundup.

Anyone who shares his or her name with a famous celebrity would probably feel happy. Similarly, those who have the same name as that of some criminal in the news would feel upset. But how would they feel if they have malware namesakes spreading in the wild?

Yamada-san of Japan TrendLabs must have had a hard time when the Yamada malware — which Trend Micro detects as TROJ_MELLPON.A was discovered in the spring of 2005. Yamada-san was not the only one though, as a number of similar malware and spyware have sprung out since then, such as the following:

• The Yamada Alternative (which Trend Micro detects as BKDR_AGENT.BOG)
• Koizumi (TROJ_DELF.AXE)
• Harada (TSPY_HARADONG.A)
• Kameda (TSPY_SUFIAGE.G)

Recently, a Trojan known as Taniguchi was discovered spreading in Japan. Reports indicate that this Trojan usually arrives with illegal or pirated copies of certain applications that are shared via Winny, a popular peer-to-peer (P2P) file sharing application in the said country. Trend Micro detects this malware as TROJ_TANIGU.A.

Note that TROJ_TANIGU.A is not the first malware that comes with pirated software. Thus, it is always recommended that users install legitimate software copies on their systems to avoid possible infection.

TrendLabs has received a sample of a malicious MS Data Access (.MDB) file that spreads via spammed email messages and exploits a vulnerability in Microsoft Access. Trend Micro detects the said MDB file as TROJ_ACDROPPER.K. It takes advantage of the Microsoft vulnerability to drop and execute another Trojan detected by Trend Micro as TROJ_AGENT.PXT. This attack appears to be regionally targeted as the spammed messages that carry TROJ_ACDROPPER.K have been reported to be disguised as email from a Japanese government agency. Note that this Trojan has also been reported to arrive as a PDF file. As of this writing, this Trojan’s MDB exploit affects fully patched English and Japanese OS that use Office 2000, XP, and 2003. It does not affect Office 2007. Trend Micro has already informed Microsoft regarding this particular vulnerability and has since received a hotfix from the company intended for Windows XP Service Pack 2. The exploit did not work anymore when the fix was tested using Office 2003. Sources for this entry:

• http://blog.trendmicro.co.jp/archives/1208
  
• Analysis and updates from Senior Analyst Edgardo Diaz, Jr.