Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    October 2013
    S M T W T F S
    « Sep   Nov »
     12345
    6789101112
    13141516171819
    20212223242526
    2728293031  
  • About Us
    TrendLabs Security Intelligence Blog(breadcrumbs are unavailable)

    Archive for October 21st, 2013




    CryptoLocker, the latest strain of ransomware, is best known for trying to force users into paying a fee by encrypting certain files and then later offering a $300 decrypting tool. In this entry, we discuss how it arrives and how it is connected with other malware, most notably ZBOT/ZeuS.

    We reported earlier that CryptoLocker malware not only blocks access to the infected system, but also forces users to buy a $300 decrypting tool by encrypting certain files. Recently, we were alerted to a spam campaign that we determined to be responsible for CryptoLocker infections. The spammed messages contain malicious attachments belonging to TROJ_UPATRE, a malware family characterized by its having small file size and a simple downloading function.

    Using feedback provided by the Trend Micro Smart Protection Network, we searched for information linking CryptoLocker ransomware to this downloader and found a sample email containing a malicious attachment (detected as TROJ_UPATRE.VNA):

    Figure 1. Screenshot of spam with malicious attachment

    Once this attachment is executed, it downloads another file which is saved as cjkienn.exe (detected as  TSPY_ZBOT.VNA). This malware then downloads the actual CryptoLocker malware (detected as TROJ_CRILOCK.NS).

    Figure 2. CryptoLocker infection chain

    This threat is particularly troublesome for several reasons. First, ZeuS/ZBOT variants are known to steal information related to online banking credentials. The attackers can use the stolen information to start unauthorized banking transactions. Furthermore, because of the CryptoLocker malware, users will be unable to access their personal or important documents.

    Notes on CryptoLocker Encryption

    Although the ransom note in CryptoLocker only specifies “RSA-2048” as the encryption used, our analysis shows that the malware uses AES + RSA encryption.

    RSA is asymmetric key cryptography, which means it uses two keys. One key is used to encrypt the data and another is used to decrypt the data. (One key is made available to any outside party and is called the public key; the other is kept by the user and is called the private key.) AES uses symmetric keys (i.e., the same key is used to encrypt and decrypt information.)

    The malware uses an AES key to encrypt files.  The AES key for decryption is written in the files encrypted by the malware. However, this key is encrypted with an RSA public key embedded in the malware, which means that a private key is needed to decrypt it. Unfortunately, the said private key is not available.

    For information on which files are encrypted, users can check their system’s autostart registry.

    registry-editor-cryptolocker

    Figure 3. List of encrypted files as seen on system’s registry

    Trend Micro Solutions for CryptoLocker

    Trend Micro’s web reputation service detects the DGA-created URLs. If the malware is unable to connect to these URLs, it will not receive the public key, thus preventing the malware from encrypting files. In addition, Trend Micro’s behavior-based detection monitors the system for CryptoLocker infection. If configured properly, it prevents the malware from executing.

    Trend Micro Protection-Cryptolocker

    Figure 4. Trend Micro detects the related malware

    It is also important for users to be cautious when opening any attachments from email messages coming from unknown sources. Our existing email reputation service also blocks spam messages related to this threat.

    Update as of 5:15 PM PST, Nov. 12, 2013:

    It seems that the cybercriminals responsible for the spate of UPATRE attacks have now set their sights on security vendors. Earlier today, we received a spammed email sample with a malicious attachment, one that comes in the form of a password-protected archive. The password itself is provided in the email body text, along with instructions on how to use the supposed contents.

    Figure 5. Screenshot of spam with malicious attachment

    What made this latest attack noteworthy is how the password is included with the message, making it look and read more legitimate and non-malicious. Of course, the attachment is verified as malware and detected as TROJ_UPATRE.CI.

    With additional insights from Benson Sy and Erika Mendoza. 

     



    About two weeks ago, it was reported that “Paunch”, the author of the Blackhole Exploit Kit (BHEK), had been arrested by Russian law enforcement. (In addition to his work on BHEK, Paunch is also suspected of working on the Cool Exploit Kit.) Some reports suggested that associates of Paunch had been arrested as well, although how exactly they were tied to BHEK remains unclear.

    What is clear is how cybercriminals have reacted so far. As part of our continuous monitoring of global spam activity, we routinely monitor spam campaigns that use BHEK to distribute various threats.

    Since the weekend of October 5-6 – when Paunch was arrested – we have not observed any major spam campaigns that used the BHEK to deliver malware. Let us be clear: in the two weeks since Paunch’s arrest, significant BHEK spam runs have ceased. Neither have we observed any other major campaigns that use similar exploit kits. The calendar below shows the major spam campaigns we have observed in the weeks leading to Paunch’s arrest:

    Table 1. BHEK spam campaigns identified

    Meanwhile, in underground forums, cybercriminals are still digesting the news of Paunch’s arrest and wondering what the long term impact will be, as well as what his ultimate fate will be.

    One particular area of concern in Russian underground forums is whether users of BHEK could face arrests themselves. In particular, users who purchased BHEK directly from Paunch or his authorized resellers would be in Paunch’s database of clients, which is now presumably in the hands of law enforcement.

    Figure 1. Underground forum post

    It is unclear what will happen to Paunch next. His real name has not been released by police, and neither have any details of his arrest – including what charges he faces – made public. Some believe that he could receive a suspended sentence in lieu of any jail time, and become an expert in the employ of the Russian Federal Security Service, the FSB.

    Figure 2. Underground forum post

    In the long term, the impact of BHEK’s apparent demise remains somewhat unclear. Other exploit kits are available, but these may not have the support structure that Paunch was able to build with BHEK. We will continue to monitor these developments as necessary in order to protect Trend Micro customers.

    Earlier this year we provided an overview of the current state of BHEK, as it was used by attackers earlier this year. Among the most high-profiles uses was in spam campaigns based around news reports of the birth of the British royal baby.

    Additional information provided by Jon Oliver and Max Goncharov

     
    Posted in Exploits, Spam | Comments Off


     

    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice