Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    September 2014
    S M T W T F S
    « Aug    
  • About Us
    TrendLabs Security Intelligence Blog(breadcrumbs are unavailable)

    Author Archive - Rika Joi Gregorio (Threat Response Engineer)

    As more countries join in the search for the missing Malaysia Airlines Flight 370, we are seeing cybercriminals use this highly talked-about topic to unleash different online threats.

    One involves a fake video about this flight, which we believe is spreading via email. The video is supposedly a five-minute clip about MH70 named Malaysian Airlines MH370 5m Video.exe. In reality, it is a backdoor detected as detected as BKDR_OTOPROXY.WR. As is the case with most backdoors, this malware allows a remote attacker to execute various commands on the system, including downloading and running files from its servers  and collect various system information.

    There is one unusual aspect to this backdoor. Its command-and-control (C&C) server at www-dpmc-dynssl-com (replace dashes with dots) was noted by other security researchers in October of last year as being related to a targeted attack. It is unusual for a targeted attack to share the same infrastructure as a more “conventional” cybercrime campaign, yet that appears to be the case here. We currently have no information that this particular backdoor is being used in targeted attacks.

    We also saw survey scams that took advantage of this tragedy. One such incident actually uses the fake breaking news that the missing aircraft has been found at sea. Users who click the link will be directed to a website that closely mimics the layout of Facebook. This site has an embedded video, supposedly of the discovery of the missing plane. Clicking anywhere on the page actually opens another page with a fake video about the sequel of the movie Avatar.

    Figure 1. Malicious site with embedded “video”

    When the user clicks on any of these videos, they will be prompted to share it to their social media followers before viewing.  is restricted unless it is shared. After sharing, the user is required to verify their age by completing a test. These tests are actually nothing more than a survey scam. These scams prompt users to answer multiple surveys in exchange for something (in this case, a supposed video) which doesn’t actually exist. Feedback from the Smart Protection Network indicates that 32% of users accessing this page are in North America; more than 40% are from the Asia-Pacific region.

    Another survey scam incident involves one site mimicking the layout of YouTube to present yet another video of the “discovery” of the missing plane. Like the previous incident, it requires users to share the video and take a “test” before they can watch it. Once again, this test leads to a survey scam site.

    Figure 2. Another site promoting a late-breaking “video”

    Current events and news updates have become go-to social engineering bait of cybercriminals. This has become an unfortunately frequent occurrence – events like the Tohoku earthquake, Boston marathon and Typhoon Haiyan were all abused to spread various threats.

    We advise users to rely on reputable and trusted news sites to get information on current events, rather than through emails or social networking sites. Trend Micro detects and blocks all threats related to these incidents.

    With additional insights from Maela Angeles, Ruby Santos, and Isaac Velasquez. 

    Posted in Bad Sites, Malware, Spam | Comments Off

    A few weeks ago, we received a rather unusual malicious attachment, which we detect as TROJ_UPATRE.SMAI. This particular attachment, when uncompressed and executed, displays the following error message:

    Figure 1. Error message

    At first glance, this may lead users to think it is not malicious. However, if we look into its code, one item stands out: it checks for the system time.

    Figure 2. Malware code

    Looking further, what we found was interesting: the value of the month has been added to a specific memory location, which is in turn contains the memory address and decryption key of code this malware needs to proceed. However, this will only return correct results when it is January.

    Figure 3. Code for decryption

    Figure 4. Incorrect result

    Figure 5. Correct result

    The images above show the decryption routine of this malware and the possible results. The decrypted string in Figure 4 is unreadable, since the system time of the machine is incorrect. This causes the error message to be displayed.

    However, in Figure 5, when the system’s clock has been set to January, the correct address is retrieved and execution proceeds as normal, leading to its payload (a ZBOT variant, detected as TSPY_ZBOT.ADXK).

    Beyond this date-checking routine, this spam run and payload is not particularly unusual. It arrives either as a fake fax or document submission message. All other behavior of TROJ_UPATRE.SMAI is consistent with UPATRE malware, which has become a very common threat to arrive via email since September 2013.

    Both the spam messages and the malicious attachments used in this attack are now blocked by the appropriate Trend Micro products.

    Additional information by Merianne Polintan.

    Posted in Malware, Spam | Comments Off


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice