Security News Collected by AWSODA-SYSTEMS: 2009-03-15

Here are the latest updates for security-news@awsoda.net

Aside from spamming our mailboxes with dire news of bombings in our local cities, WALEDAC is also very busy filling our mailboxes with more unwanted emails. This time, peddling various pills, meds, and male enhancements.

Here’s a gallery of pharma vendors advertised in Waledac spam mails.

Figure 1. Canadian Pharmacy, a known long time advertiser in spam.

Figure 2. Canadian Health & Care Mall

Figure 3.Pharmacy Express

Figure 4. ED Express.

Figure 5. Advanced Laboratories Inc., trying to convince men that they need an Enlarge Patch.

Figure 6. Waledac also peddles OEM Software too.

All of the shown spam messages above are already blocked by the Trend Micro Smart Protection Network. Other users are advised to delete any similar spam messages that may happen to land in their inbox.

Here are previous reports related to WALEDAC:

Post from: TrendLabs | Malware Blog - by Trend Micro

WALEDAC Spamming Madness

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'WALEDAC Spamming Madness'

Ichitaro Exploits Progress

On March 11, Regional TrendLabs in Japan found a zero-day exploit attack that targeted Just System's well-known Japanese word-processor, Ichitaro. The malware exploting the vulnerability was noticed to arrive via spam and via malicious websites using the Ichitaro file extension name, .JTD.

The malware ( TROJ_TARODROP.BA) drops a file {random letters}.tmp ( TROJ_DROPPER.PAO) that in turn drops another file named beer80.exe ( TROJ_AGENT.KLQW).

Notable of this scheme is that after TROJ_TARODROP.BA and TROJ_DROPPER.PAO have executed their routines, the last dropped Trojan (TROJ_DROPPER.PAO) creates non-malicious files using them to overwrite itself and the initial TROJ_TARODROP.BA. Thus, when the user checks the files after the infection is completed, all the user will see are legitimate Ichitaro files (this is considered to be a stealth technique applied by the malware).

Unknown to the user at that point is that the final payload TROJ_AGENT.KLQW is already and still in the system. This Trojan (TROJ_AGENT.KLQW) gathers the following information from the affected system then sends the data to a remote site:

Computer Name
IP Address
Process ID of (injected) legitimate process, svchost.exe
OS version
Locale Information

Figure 1. the sleight of hand is performed by the second malware in line, TROJ_DROPPER.PAO.

According to Trend Micro researchers, the initial attack on Ichitaro happened in August 2006. Since then, every time a new Ichitaro vulnerability is found, cybercriminals are expected to attempt to exploit it–and they do so with increasing social engineering savvy. Past attacks followed the same straightforward drill: the first malware exploits the vulnerability and the second one conducts the main routines such as autostart and dropping files, etc. It is only recently (in 2008) we have begun to see the additional overwriting trick meant to fool users.

Previous Ichitaro-related attacks include the following:

New Ichitaro zero-day exploit discovered
Ichitaro Exploited Anew
A Closer Look at Ichitaro

Information on this vulnerability, as well as the patch provided by Just System, can be found on their website.

Read the Japanese writeup of this attack from the Japanese Malware Blog.

Post from: TrendLabs | Malware Blog - by Trend Micro

Ichitaro Exploits Progress

• Email to a friend • Article Search • Related • View comments • Track comments •

•

Rate 'Ichitaro Exploits Progress'

Complex Malcode Behind ILOMO Reinfection

Last week, Trend Micro was alerted to the increasing number of ILOMO infections. ILOMO Trojans (some examples are TROJ_ILOMOB.,TROJ_ILOMO.F, and TROJ_ILOMO.L) arrive on systems via Web-based exploits and use different infection routines for the payload.

Notable with these variants is that even when users have deleted the malicious file from the hard disk, its code remains actively injected in system memory. In effect, users are continuously annoyed of the reinfection symptoms.

Analysis of TROJ_ILOMO’s spaghetti-like code reveal several things. Once running in an infected system, a variant updates its own Gates-List which is probably part of the infected nodes that forms its peer-to-peer botnet. This model is quite similar to the one used by the Storm botnet. The malware saves this list in the registry.

Figure 1. Registry list.

Entries on the list have the format {IP address}/{certain strings} and they are considered to be a list of compromised machines.

With an updated Gates-List, the ILOMO malware then attempts to access the sites and download binary encrypted data. It stores the values in the local registry in values named M00, M01, and M02. The ILOMO Trojan decrypts then the data, which in fact forms an malicious executable code that is later injected to certain Internet Explorer processes.

Figure 2. Injected code.

Once found, it injects the downloaded and now decrypted code and executes this remote thread. This said thread enables ILOMO to perform additional malicious activities on the infected system. TROJ_ILOMO variants have also been found to send and receive information from certain IP addresses, thereby compromising system security. Confidential or private information may find its way to cybercriminals in this attack too.

Trend Micro Smart Protection Network already detects and blocks TROJ_ILOMO and its adjacent droppers, preventing them from executing in systems.

Post from: TrendLabs | Malware Blog - by Trend Micro

Complex Malcode Behind ILOMO Reinfection