Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Mobile Vulnerabilities

  • Zero-Day Alerts

  • Recent Posts

  • Calendar

    August 2015
    S M T W T F S
    « Jul    
  • Email Subscription

  • About Us

    A few weeks ago, we received a rather unusual malicious attachment, which we detect as TROJ_UPATRE.SMAI. This particular attachment, when uncompressed and executed, displays the following error message:

    Figure 1. Error message

    At first glance, this may lead users to think it is not malicious. However, if we look into its code, one item stands out: it checks for the system time.

    Figure 2. Malware code

    Looking further, what we found was interesting: the value of the month has been added to a specific memory location, which is in turn contains the memory address and decryption key of code this malware needs to proceed. However, this will only return correct results when it is January.

    Figure 3. Code for decryption

    Figure 4. Incorrect result

    Figure 5. Correct result

    The images above show the decryption routine of this malware and the possible results. The decrypted string in Figure 4 is unreadable, since the system time of the machine is incorrect. This causes the error message to be displayed.

    However, in Figure 5, when the system’s clock has been set to January, the correct address is retrieved and execution proceeds as normal, leading to its payload (a ZBOT variant, detected as TSPY_ZBOT.ADXK).

    Beyond this date-checking routine, this spam run and payload is not particularly unusual. It arrives either as a fake fax or document submission message. All other behavior of TROJ_UPATRE.SMAI is consistent with UPATRE malware, which has become a very common threat to arrive via email since September 2013.

    Both the spam messages and the malicious attachments used in this attack are now blocked by the appropriate Trend Micro products.

    Additional information by Merianne Polintan.

    Share this article
    Get the latest on malware protection from TrendLabs
    Email this story to a friend   Technorati   NewsVine   MySpace   Google   Live   StumbleUpon

    Comments are closed.


    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice