Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    October 2013
    S M T W T F S
    « Sep   Nov »
  • Email Subscription

  • About Us

    Archive for October, 2013

    CryptoLocker, the latest strain of ransomware, is best known for trying to force users into paying a fee by encrypting certain files and then later offering a $300 decrypting tool. In this entry, we discuss how it arrives and how it is connected with other malware, most notably ZBOT/ZeuS.

    We reported earlier that CryptoLocker malware not only blocks access to the infected system, but also forces users to buy a $300 decrypting tool by encrypting certain files. Recently, we were alerted to a spam campaign that we determined to be responsible for CryptoLocker infections. The spammed messages contain malicious attachments belonging to TROJ_UPATRE, a malware family characterized by its having small file size and a simple downloading function.

    Using feedback provided by the Trend Micro Smart Protection Network, we searched for information linking CryptoLocker ransomware to this downloader and found a sample email containing a malicious attachment (detected as TROJ_UPATRE.VNA):

    Figure 1. Screenshot of spam with malicious attachment

    Once this attachment is executed, it downloads another file which is saved as cjkienn.exe (detected as  TSPY_ZBOT.VNA). This malware then downloads the actual CryptoLocker malware (detected as TROJ_CRILOCK.NS).

    Figure 2. CryptoLocker infection chain

    This threat is particularly troublesome for several reasons. First, ZeuS/ZBOT variants are known to steal information related to online banking credentials. The attackers can use the stolen information to start unauthorized banking transactions. Furthermore, because of the CryptoLocker malware, users will be unable to access their personal or important documents.

    Notes on CryptoLocker Encryption

    Although the ransom note in CryptoLocker only specifies “RSA-2048” as the encryption used, our analysis shows that the malware uses AES + RSA encryption.

    RSA is asymmetric key cryptography, which means it uses two keys. One key is used to encrypt the data and another is used to decrypt the data. (One key is made available to any outside party and is called the public key; the other is kept by the user and is called the private key.) AES uses symmetric keys (i.e., the same key is used to encrypt and decrypt information.)

    The malware uses an AES key to encrypt files.  The AES key for decryption is written in the files encrypted by the malware. However, this key is encrypted with an RSA public key embedded in the malware, which means that a private key is needed to decrypt it. Unfortunately, the said private key is not available.

    For information on which files are encrypted, users can check their system’s autostart registry.


    Figure 3. List of encrypted files as seen on system’s registry

    Trend Micro Solutions for CryptoLocker

    Trend Micro’s web reputation service detects the DGA-created URLs. If the malware is unable to connect to these URLs, it will not receive the public key, thus preventing the malware from encrypting files. In addition, Trend Micro’s behavior-based detection monitors the system for CryptoLocker infection. If configured properly, it prevents the malware from executing.

    Trend Micro Protection-Cryptolocker

    Figure 4. Trend Micro detects the related malware

    It is also important for users to be cautious when opening any attachments from email messages coming from unknown sources. Our existing email reputation service also blocks spam messages related to this threat.

    Update as of 5:15 PM PST, Nov. 12, 2013:

    It seems that the cybercriminals responsible for the spate of UPATRE attacks have now set their sights on security vendors. Earlier today, we received a spammed email sample with a malicious attachment, one that comes in the form of a password-protected archive. The password itself is provided in the email body text, along with instructions on how to use the supposed contents.

    Figure 5. Screenshot of spam with malicious attachment

    What made this latest attack noteworthy is how the password is included with the message, making it look and read more legitimate and non-malicious. Of course, the attachment is verified as malware and detected as TROJ_UPATRE.CI.

    With additional insights from Benson Sy and Erika Mendoza. 


    About two weeks ago, it was reported that “Paunch”, the author of the Blackhole Exploit Kit (BHEK), had been arrested by Russian law enforcement. (In addition to his work on BHEK, Paunch is also suspected of working on the Cool Exploit Kit.) Some reports suggested that associates of Paunch had been arrested as well, although how exactly they were tied to BHEK remains unclear.

    What is clear is how cybercriminals have reacted so far. As part of our continuous monitoring of global spam activity, we routinely monitor spam campaigns that use BHEK to distribute various threats.

    Since the weekend of October 5-6 – when Paunch was arrested – we have not observed any major spam campaigns that used the BHEK to deliver malware. Let us be clear: in the two weeks since Paunch’s arrest, significant BHEK spam runs have ceased. Neither have we observed any other major campaigns that use similar exploit kits. The calendar below shows the major spam campaigns we have observed in the weeks leading to Paunch’s arrest:

    Table 1. BHEK spam campaigns identified

    Meanwhile, in underground forums, cybercriminals are still digesting the news of Paunch’s arrest and wondering what the long term impact will be, as well as what his ultimate fate will be.

    One particular area of concern in Russian underground forums is whether users of BHEK could face arrests themselves. In particular, users who purchased BHEK directly from Paunch or his authorized resellers would be in Paunch’s database of clients, which is now presumably in the hands of law enforcement.

    Figure 1. Underground forum post

    It is unclear what will happen to Paunch next. His real name has not been released by police, and neither have any details of his arrest – including what charges he faces – made public. Some believe that he could receive a suspended sentence in lieu of any jail time, and become an expert in the employ of the Russian Federal Security Service, the FSB.

    Figure 2. Underground forum post

    In the long term, the impact of BHEK’s apparent demise remains somewhat unclear. Other exploit kits are available, but these may not have the support structure that Paunch was able to build with BHEK. We will continue to monitor these developments as necessary in order to protect Trend Micro customers.

    Earlier this year we provided an overview of the current state of BHEK, as it was used by attackers earlier this year. Among the most high-profiles uses was in spam campaigns based around news reports of the birth of the British royal baby.

    Additional information provided by Jon Oliver and Max Goncharov

    Posted in Exploits, Spam | Comments Off on Blackhole Arrests – How Has The Underground Reacted?

    While most banking Trojans are indiscriminate in infecting users to gather as many victims/revenues as possible, some have chosen to go the regional route. For example, the Citadel incident in our previous blog post where the target was mainly Japanese users. This time, we are looking at another case that seems to target Eastern Europe.

    In the 1st quarter of 2013, we examined what initially looked like a targeted attack using spear phishing emails supposedly from the Ukrainian government. While the email itself and the payload are considered “spam material”, the attachment contains documents that are typically used in targeted attacks.

    Our investigation into this campaign revealed the following:

    • The operators are using a modified Zeus variant based on leaked source code
    • Additional modules that target certain banking systems
    • Aside from Zeus, the operators are also using several underground toolkits such as Bleeding Life Exploit Kit, Pony, and Ann Loader

    To get a glimpse of how widespread this campaign was, we sinkholed some of the C&C domains for a few days and as we have expected, Eastern Europe (particularly Ukraine and Russia) has the largest number of victim IPs.

    Figure 1. Distribution of Victim IPs by Region

    Figure 2. Distribution of Victim IPs in Europe

    Our research shows that while most banking Trojans target well-known banks (in the US, UK, etc), there are some that prefer a more regional and less conventional approach and by using several tools available underground, the operators were able to carry off their plans. Moreover, it also demonstrates that cybercriminals are always looking for alternative ways to adapt to defenses.

    Our full findings can be found in the research paper titles, The Apollo Campaign: A Gateway to Eastern European Banks.

    Posted in Malware | Comments Off on Regional Banking Threats: The Apollo Campaign

    Spam may be seen by the public as a minor nuisance now,  but this couldn’t be further from the truth. We recently encountered spam that triggers an infection chain with ZBOT malware as the end result.

    The spammed message is supposed to have come from Allergan Limited, the UK arm of the global health care company Allergan, Inc. The message informs the recipient that the attachment contains information about the recipient’s medical information. This attachment is actually malicious and is detected as TROJ_ARTIEF.PI. This malware takes advantage the MSCOMCTL.OCX RCE vulnerability (CVE-2012-0158), which affects versions of Microsoft Office (specifically 2003, 2007, and 2010). This vulnerability was also targeted in other threats that we documented, including the spoofed APEC 2013 email and the EvilGrab malware found in the Asia-Pacific region.

    Figure 1. Fake email from Allergan Limited

    This malware drops and executes BKDR_LIFTOH.AD. This backdoor often downloads ZBOT. In this instance, the backdoor leads to the download of TSPY_ZBOT.VHP. ZBOT malware are known for stealing user login credentials, account information etc., in particular targeting online banking users.

    One interesting detail in this particular attack is the use of BKDR_LIFTOH malware. Variants often propagate via social networking sites and multi-protocol instant messaging (IM) programs. Propagation through spam is quite rare.

    This isn’t the only spam that employs the same attack. We spotted other spam with the same malware attachment, but with different content. Content from these emails suggests that these messages target British users.

    Figures 2 and 3. Other similar spammed messages

    Users should always take extra precaution when dealing with e-mail attachments; in general these should not be opened unless  Email from unknown senders should be ignored or immediately deleted. Trend Micro protects users from this threat by blocking the spam messages and detecting the malware cited in this entry.

    With additional insights from Eruel Ramos and Alvin Bacani

    Posted in Malware, Spam | Comments Off on British Users Targeted By Health-Related ZBOT Spam

    Yesterday, Oracle recently released a new round of updates for Java. Two of these vulnerabilities (CVE-2013-5809 and CVE-20135778) and one in-depth defense issue were discovered by Trend Micro researchers and were privately reported to Oracle. All of these are now patched, and we do not believe they are in use or were earlier discovered by threat actors.

    All of these vulnerabilities were in Java’s native layer code, which could lead to remote code execution or information leakage. For example, one of the vulnerabilities we found was a heap overflow issue. An attacker could craft a malicious Java applet targeting this flaw on a malicious web site. When the user visits the malicious web site, if his browser has Java enabled, he may get infected by malware.

    Java native vulnerabilities, also known as “Java memory corruption vulnerabilities”, are vulnerabilities which exist in the JRE’s native code (C/C++ code). Other than the sandbox-bypassing vulnerabilities in the JRE’s Java code, native vulnerabilities can cause memory corruptions (e.g. buffer overflows) directly, which could lead to code execution.

    Earlier, my colleague Jack Tang talked about the trend of increasing Java native vulnerabilities. What I want to add here is that it is still possible to exploit Java native vulnerabilities, even with the latest exploit mitigation techniques such as DEP and ASLR.

    The vulnerabilities we reported also affect Java version 6, which Oracle already stopped supporting since early this year. This can be a problem, in particular to users who are still using the said version as Oracle will not be providing any security update for them. Thus, it is important for users to migrate to use the latest version of the software the soonest possible.

    Last month, as SyScan 360 in Beijing, I introduced several methods to exploit Java native vulnerabilities even when DEP and ASLR are both turned on. At the end of the presentation, I also demonstrated remote code execution vulnerability on a fully patched Java install on Windows 8, using a native zero-day vulnerability. (To protect our users, I did not publish the details of this security flaw.)

    We urge users to carefully evaluate their usage of Java as necessary and ensure that copies of Java that are used are up-to-date, to reduce exposure to present and future Java flaws.

    Trend Micro Deep Security protects users from the exploits targeting the vulnerabilities cited in this blog via the following rules:


    • 1005724 – Oracle JRE JPEG.DLL Heap Buffer Overflow Vulnerability
    • 1005722 – Oracle Java mlib_image!cvtCustomToDefault Array Out Of Bound Read Vulnerability
    • 1005723 – Oracle Java True Type Font Processing Vulnerability


    For more information on the other vulnerabilities and corresponding solution, users may also visit Oracle’s page.

    Posted in Vulnerabilities | Comments Off on Trend Micro Finds Vulnerabilities in Java, Patched in Latest Oracle Update


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice