MX Lab intercepted a new variant of a trojan named Trojan.Win32.Buzus (Ikarus), Trojan.Win32.Buzus.anee (Kaspersky), W32.Ackantta.B@mm (Symantec).
The messages is sent from<e-cards@americangreetings.com> and has the subject “You have got a new E-Card from your friend!”. The attached ZIP file is named e-card.zip.
And here is where the fun begins. This is a malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment.
The trojan has the capability to send out emails, email addresses harvested from the local computer, with the built-in SMTP engine or communicates with a remote SMTP server.
It will create a startup registry in the Windows system and registers a Winlogon notification package so that the installed module is loaded into the address space of winlogon.exe.
Following files are created:
%Temp%\qoMcdExV.bat
%System%\cbXQiFwT.dll
%System%\javale.exe
%System%\javame1.1.exe
%System%\javase1.1.exe.
New processes are created: javase1.1.exe, javale.exe, javame1.1.exe and javaee1.1.exe. The modules %System%\cbXQiFwT.dll and %System%\cbXQiFwT.dll are loaded into the address space of other processes.
Windows registry is being edited and the TCP ports 1033, 1035, 1062, 1063, 1064, 1065, 1118, 1119, 1120 will be used by javale.exe. Some host names are being requested and americangreetings.com is one of them. A connection to the port number 1049 is being established.
A new connection with ak.imgag.com is being made and several GIFs and CSS files are being downloaded from this host. A connection to the host hxxp://childhe.com/***/apstpldr.dll.html?affid=***&uid=&guid=*** is made to download %System%\urqOFwxx.dll.
The build in SMTP engine will send out mass mailings and generates emails coming from e-cards@hallmark.com or e-cards@americangreetings.com with the subjects “You have received A Hallmark E-Card!” or “You have got a new E-Card from your friend!”. It will attach one of the ZIP files postcard.zip, e-card.zip or e-card.zip. The content of the message is similar to the screenshot above.
Once it has a new computer infected it will start this whole process again and tries to distibute itself to other computers.
