Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    April 2014
    S M T W T F S
    « Mar   May »
  • Email Subscription

  • About Us

    Archive for April 29th, 2014

    The promise of easy money remains the biggest motivation for cybercrime today. Cybercriminals thus make it their main objective to steal information that would lead them to the money, like online banking information. Once stolen, the information can be used to transfer funds illegally from victims’ accounts.

    In 2013, the total amount of money stolen through this exact method in Japan has amounted to 1.4 billion yen. This is purportedly the biggest amount to date, and it seems 2014 is well on its way to catching up, with 600 million yen already stolen, according the publication of the National Police Agency (NPA). We have reason to believe that those numbers will continue to climb, which poses a challenge on how to stop cybercrime once and for all.

    As part of our efforts to stop cybercrime, our dedicated team of researchers, the Forward-Looking Threat Research Team have been doing research about what it takes to prevent financial losses from online account theft by cybercriminals. Moreover, we have identified some methods to track down and identify these cybercriminals responsible, such as command-and-control (C&C) server analysis, analyzing stolen information, and malware analysis.

    For instance, cybercriminals behind the recent popular banking Trojan called Citadel (TSPY_ZBOT) use WebInjects to display fake screen displays needed to carry out online banking logging theft. By analyzing the WebInject modules, it is possible to find out more about the server where the stolen information has been sent to.

    Because any information from victims which victims input in the fake screen will be stored in the server, we can immediately pinpoint the existence of victims by monitoring the server’s stored information. As a result, we can quickly prevent actual financial loss through reactionary methods, such as freezing the compromised bank accounts before the money is transferred to the cybercriminals.

    Figure_banking _trojan_140415


    Figure 1. Webinject Banking Trojan’s Infection Chain

    These kind of measures, of course, can’t be pulled by just a security vendor such as TrendMicro. It is absolutely necessary to collaborate with concerned organizations such as the police and the bank involved. Trend Micro’s TM-SIRT, which is a contact point of cooperation for security-raising activities in Japan, provides concerned organizations with information obtained from internal research groups such as the FTR (forward-looking threat research) team in order to help combat this kind of theft by cybercriminals.

    Taking down the server involved in the financial theft is another method of combating such cybercriminal activity, but it is a temporary solution at best. This is because it may not affect the cybercriminal’s efforts as much as we would like it to be, and it may even motivate them to more sophisticated attacks.

    Server monitoring is a more preferable. It allows security experts to grasp the picture of attack and control the situation better. Moreover, it may help to identify the cybercriminals by simply waiting for them to log into the server to obtain their stolen information. Server monitoring can then be expected to prevent new attacks by the same cybercriminals and also to prevent other attacks.

    On April 28, Trend Micro received a certificate of appreciation from the Japan Metropolitan Police Department. This commendation was awarded for providing useful information in combating online financial theft in Japan. Trend Micro will continue to study and provide a holistic and fundamental approach to security, as well as cooperate with law enforcements around the globe for our company vision: a world safe for exchanging digital information.

    Posted in Malware | 1 TrackBack »

    Sometime near the start of the year, we noticed that the old malware family TSPY_USTEAL resurfaced. This information stealing malware now includes new routines including malicious packers, obfuscation, and bundling ransomware.

    TSPY_USTEAL variants were seen in the wild as early as 2009, and is known to steal sensitive information like machine details and passwords stored in browsers. It can act as a dropper, dropping plugins or binaries in its resource section. The stolen information is stored in an encrypted .bin file, which is uploaded to a C&C server via FTP. This was part of the behavior of the previous variants, and continues on in newer variants.

    A newer variant that we detect as TSPY_USTEAL.USRJ, drops ransomware—detected as TROJ_RANSOM.SMAR—on affected systems. These ransomware files are created by a new toolkit builder that gives the attacker full control over the ransomware’s behavior, from the types of files it will encrypt to the ransom note to be displayed.

    We detect this toolkit as TROJ_TOOLKIT.WRN. Below are the features translated from Russian to English. Included are the file types to be encrypted, the ransom note, the appended extension to encrypted file, and the name of the dropped copy of the encoder.

    Figure 1. Translated ransomware toolkit
    (Click image above to enlarge)

    The ransomware, TROJ_RANSOM.SMAR, drops a copy of itself in the user’s machine. It then encrypts certain files with the same icon and extension name. For example, it can add the extension .EnCiPhErEd on selected extension names like .LNK, .ZIP, etc., as marker. Next, it drops an image file containing the ransom details.

    Figure 2. Ransom note

    When encrypted files are accessed, it shows the ransom note along with the contact details to retrieve the password. The retrieval method may either be through a text message or an email. Next, it displays a message asking for the password. If password given is correct, it decrypts and restores the encrypted files to its original form. Consequently, the ransomware file deletes itself. On the other hand, if the password is incorrect and the number of attempts has reached the pre-set limit, it displays the error message shown below. It then searches for files to encrypt (besides the already-encrypted files) and deletes itself afterward.

    Figure 3. Error message

    This particular combination of threats is worrisome because it steals your credentials and information while the ransomware extorts additional money from the victim by encrypting their files. It’s highly probable that the malware author wanted to wring a fortune out of the victim, extorting any leftover funds from the same victim with the use of ransomware.

    Feedback from the Trend Micro Smart Protection Network shows that there was a spike mid-April for TROJ_RANSOM.SMAR, with the United States as the affected country . Trend Micro protects users from all threats releated to this attack.

    With additional analysis from Adremel Redondo and Nazario Tolentino II

    Posted in Malware | Comments Off on Old Infostealer Resurfaces, Now Delivers Ransomware


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice