A few weeks ago, we received a rather unusual malicious attachment, which we detect as TROJ_UPATRE.SMAI. This particular attachment, when uncompressed and executed, displays the following error message:
Figure 1. Error message
At first glance, this may lead users to think it is not malicious. However, if we look into its code, one item stands out: it checks for the system time.
Figure 2. Malware code
Looking further, what we found was interesting: the value of the month has been added to a specific memory location, which is in turn contains the memory address and decryption key of code this malware needs to proceed. However, this will only return correct results when it is January.
Figure 3. Code for decryption
Figure 4. Incorrect result
Figure 5. Correct result
The images above show the decryption routine of this malware and the possible results. The decrypted string in Figure 4 is unreadable, since the system time of the machine is incorrect. This causes the error message to be displayed.
However, in Figure 5, when the system’s clock has been set to January, the correct address is retrieved and execution proceeds as normal, leading to its payload (a ZBOT variant, detected as TSPY_ZBOT.ADXK).
Beyond this date-checking routine, this spam run and payload is not particularly unusual. It arrives either as a fake fax or document submission message. All other behavior of TROJ_UPATRE.SMAI is consistent with UPATRE malware, which has become a very common threat to arrive via email since September 2013.
Both the spam messages and the malicious attachments used in this attack are now blocked by the appropriate Trend Micro products.
Additional information by Merianne Polintan.
