Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    September 2015
    S M T W T F S
    « Aug    
  • Email Subscription

  • About Us

    Author Archive - Rika Joi Gregorio (Threat Response Engineer)

    Cybercriminals and threat actors often use tried-and-tested vulnerabilities in order to infect user systems and consequently, penetrate an enterprise network. This highlights the importance of patching systems and keeping software and applications up-to-date.

    We recently spotted DYREZA malware leveraging an old vulnerability found existing in Adobe Reader and Acrobat and covered under CVE-2013-2729. Accordingly, once this vulnerability is successfully exploited it could lead to the execution of arbitrary code on the affected system.



    Figures 1-2. Screenshots of spam emails

    DYREZA malware uses spammed message that purports to be an invoice notification as its infection vector. It has a malicious .PDF file attachment, detected by Trend Micro as TROJ_PIDIEF.YYJU. When executed, it exploits the CVE-2013-2729 vulnerability, which leads to the download of TSPY_DYRE.EKW, a variant of DYREZA (also known as DYRE and DYRANGES).

    DYREZA is a malware known for stealing banking credentials and associated with parcel mule scams. We recently wrote a blog post detailing the role that this malware plays in the threat landscape ecosystem and some of its notable behavior, including its capability to perform man-in-the-middle (MITM) attacks via browser injections, monitoring online banking sessions of targeted banks, and stealing other information such as browser versions, snapshots, and personal certificates.

    Users and enterprises are at risk since DYREZA can get other types of data such as personal identifiable information (PII) and credentials via browser snapshots. Aside from this, we also reported that the CUTWAIL botnet leads to the download of both UPATRE and DYRE malware.

    What makes TSPY_DYRE.EKW notable is its ability to steal crucial information via injecting malicious codes onto certain banking and bitcoin login webpages.  Some of the bitcoin pages it monitors are:


    Apart from its information stealing routines, TSPY_DYRE.EKW has the capability to connect to certain malicious websites to send and receive information. Moreover, it can connect to specific STUN (Session Traversal Utilities for NAT) servers to determine the public IP address of the compromised computer. As such, cybercriminals can find out the location of the malware or possibly determine the affected users’ and organizations’ locations. The top country victims are Ireland, United States, Canada, Great Britain, and Netherlands.

    Bitcoin is a digital currency that has real world value. Cybercriminals often go after bitcoins since it presents a new venue for them to generate profit. While this is not the first instance that scammers and cybercriminals target bitcoins, this new attack highlights how traditional threats like exploits and banking malware remain to be a relevant means for cybercriminals to steal both user credentials and hit a relatively new platform – bitcoins.  It also teaches us an important lesson about keeping systems and software applications updated to its latest version.

    Trend Micro protects users from this threat via its Smart Protection Network that detects the spammed message and all related malware.

    With additional analysis from Rhena Inocencio, Karla Agregada, and Michael Casayuran

    Posted in Malware, Vulnerabilities | Comments Off on Old Adobe Vulnerability Used in Dyreza Attack, Targets Bitcoin Sites

    As more countries join in the search for the missing Malaysia Airlines Flight 370, we are seeing cybercriminals use this highly talked-about topic to unleash different online threats.

    One involves a fake video about this flight, which we believe is spreading via email. The video is supposedly a five-minute clip about MH70 named Malaysian Airlines MH370 5m Video.exe. In reality, it is a backdoor detected as detected as BKDR_OTOPROXY.WR. As is the case with most backdoors, this malware allows a remote attacker to execute various commands on the system, including downloading and running files from its servers  and collect various system information.

    There is one unusual aspect to this backdoor. Its command-and-control (C&C) server at www-dpmc-dynssl-com (replace dashes with dots) was noted by other security researchers in October of last year as being related to a targeted attack. It is unusual for a targeted attack to share the same infrastructure as a more “conventional” cybercrime campaign, yet that appears to be the case here. We currently have no information that this particular backdoor is being used in targeted attacks.

    We also saw survey scams that took advantage of this tragedy. One such incident actually uses the fake breaking news that the missing aircraft has been found at sea. Users who click the link will be directed to a website that closely mimics the layout of Facebook. This site has an embedded video, supposedly of the discovery of the missing plane. Clicking anywhere on the page actually opens another page with a fake video about the sequel of the movie Avatar.

    Figure 1. Malicious site with embedded “video”

    When the user clicks on any of these videos, they will be prompted to share it to their social media followers before viewing.  is restricted unless it is shared. After sharing, the user is required to verify their age by completing a test. These tests are actually nothing more than a survey scam. These scams prompt users to answer multiple surveys in exchange for something (in this case, a supposed video) which doesn’t actually exist. Feedback from the Smart Protection Network indicates that 32% of users accessing this page are in North America; more than 40% are from the Asia-Pacific region.

    Another survey scam incident involves one site mimicking the layout of YouTube to present yet another video of the “discovery” of the missing plane. Like the previous incident, it requires users to share the video and take a “test” before they can watch it. Once again, this test leads to a survey scam site.

    Figure 2. Another site promoting a late-breaking “video”

    Current events and news updates have become go-to social engineering bait of cybercriminals. This has become an unfortunately frequent occurrence – events like the Tohoku earthquake, Boston marathon and Typhoon Haiyan were all abused to spread various threats.

    We advise users to rely on reputable and trusted news sites to get information on current events, rather than through emails or social networking sites. Trend Micro detects and blocks all threats related to these incidents.

    With additional insights from Maela Angeles, Ruby Santos, and Isaac Velasquez. 

    Posted in Bad Sites, Malware, Spam | Comments Off on Malaysia Airlines Flight 370 News Used To Spread Online Threats

    A few weeks ago, we received a rather unusual malicious attachment, which we detect as TROJ_UPATRE.SMAI. This particular attachment, when uncompressed and executed, displays the following error message:

    Figure 1. Error message

    At first glance, this may lead users to think it is not malicious. However, if we look into its code, one item stands out: it checks for the system time.

    Figure 2. Malware code

    Looking further, what we found was interesting: the value of the month has been added to a specific memory location, which is in turn contains the memory address and decryption key of code this malware needs to proceed. However, this will only return correct results when it is January.

    Figure 3. Code for decryption

    Figure 4. Incorrect result

    Figure 5. Correct result

    The images above show the decryption routine of this malware and the possible results. The decrypted string in Figure 4 is unreadable, since the system time of the machine is incorrect. This causes the error message to be displayed.

    However, in Figure 5, when the system’s clock has been set to January, the correct address is retrieved and execution proceeds as normal, leading to its payload (a ZBOT variant, detected as TSPY_ZBOT.ADXK).

    Beyond this date-checking routine, this spam run and payload is not particularly unusual. It arrives either as a fake fax or document submission message. All other behavior of TROJ_UPATRE.SMAI is consistent with UPATRE malware, which has become a very common threat to arrive via email since September 2013.

    Both the spam messages and the malicious attachments used in this attack are now blocked by the appropriate Trend Micro products.

    Additional information by Merianne Polintan.

    Posted in Malware, Spam | Comments Off on ZeuS Downloader Runs in January, Crashes Rest of the Year


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice