MX Lab, http://www.mxlab.eu, started to intercept a new trojan distribution campaign by email with the subject “DHL Express Services”
The email is send from the spoofed address “DHL Global” with the email:
supportmop@dhl.com
supportmop1@dhl.com
…
We expect that more new spoofed email addresses will appear in the format like the examples, based on the previous campaigns, with a number before the @-sign.
The message has the following body:
Dear customer.
The parcel was sent your home address.
And it will arrive within 3 business day.
More information and the tracking number are attached in document below.
Thank you.
© 1994-2011 DHL Express Services, Inc.
The attached ZIP file has the name dhl.zip and contains the 20 kB large file dhl.exe.
The trojan is known as Gen:Variant.Kazy.17907 (Bitdefender), Backdoor:Win32/Hostil.gen!A (Microsoft) or Trj/Sasfis.A (Panda).
The following files will be created:
%CommonAppData%\lpd2lf503886
%AppData%\lpd2lf503886
%Temp%\lpd2lf503886
%Templates%\lpd2lf503886
%AppData%\fip.exe
A new process is created:
fip.exe —> %AppData%\fip.exe
Several Windows registry changes will be exectued and the trojan can establish connection with the following IPs on port 80:
216.155.130.214
46.161.20.66
Data can be obtained from following URLs:
- hxxp://tazejutyhyfu.com/1017000312
- hxxp://puskovayaustanovka.ru/pusk2.exe
At the time of writing, only 4 of the 43 AV engines did detect the trojan at Virus Total.
Virus Total permalink and MD5: 87d778169ae14d934b92ce628b5cfde4.
Analysis of the file pusk.exe:
The trojan is known as Gen: Mal/Behav-321 (Sophos), TrojanDropper.Mudrop.ozh (VBA32), FraudTool.Win32.FakeRean.b (v) (VIPRE)
This malware will create the files:
%CommonAppData%\lpd2lf503886
%AppData%\lpd2lf503886
%Temp%\lpd2lf503886
%Templates%\lpd2lf503886
A new process will be created:
jfe.exe —-> %AppData%\jfe.exe
It will modify the Windows registry and the trojan can establish connection 216.155.130.214 op port 80.
it will request data from hxxp://tazejutyhyfu.com/1017000312.
At the time of writing, only 4 of the 43 AV engines did detect the trojan at Virus Total.
Virus Total permalink and MD5: 2ac3a5bb8e7eb81cb306f869207eb69b.
