By Dancho Danchev
We have just intercepted yet another currently ongoing malicious spam campaign, enticing users into executing a fake Export License/Payment Invoice. Once gullible and socially engineering users do so, their PCs automatically join the botnet operated by the cybercriminals.
More details:
Detection rate for the malicious executable: MD5: 4e7dc191117a6f30dd429cc619041552 – detected by 33 out of 47 antivirus scanners as Trojan.Win32.Inject.foiq; Trojan.Zbot.
Once executed, the sample starts listening on port 28723.
It then creates the following files on the affected hosts:
%AppData%Wyifdylo.exe
The following Registry Keys:
HKEY_CURRENT_USERSoftwareMicrosoftUfoda
The following Registry Values:
[HKEY_CURRENT_USERIdentities] -> Identity Login = 0x00098053
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun] -> {3DFA1AE4-115C-AD7B-A6BA-A75086AF8442} = “”%AppData%Wyifdylo.exe””
[HKEY_CURRENT_USERSoftwareMicrosoftUfoda] -> 298j5icj = 19 F6 D3 3E 87 FA CB 0A F4 B2; 25cdfb7h = 25 F6 B2 3E; 6hj5ac9 = CB C5 B2 3E D7 A1 F9 0A C4 B2 7D 39
The following Mutexes:
Global{CB561546-E774-D5EA-8F92-61FCBA8C42EE}
Local{744F300D-C23F-6AF3-8F92-61FCBA8C42EE}
Global{FD2CEE5F-1C6D-E390-0508-B06D3016937F}
Global{FD2CEE5F-1C6D-E390-7109-B06D4417937F}
Global{FD2CEE5F-1C6D-E390-490A-B06D7C14937F}
Global{FD2CEE5F-1C6D-E390-610A-B06D5414937F}
Global{FD2CEE5F-1C6D-E390-8D0A-B06DB814937F}
Global{FD2CEE5F-1C6D-E390-990A-B06DAC14937F}
Global{FD2CEE5F-1C6D-E390-350B-B06D0015937F}
Global{FD2CEE5F-1C6D-E390-610B-B06D5415937F}
Global{FD2CEE5F-1C6D-E390-B90B-B06D8C15937F}
Global{FD2CEE5F-1C6D-E390-190C-B06D2C12937F}
Global{FD2CEE5F-1C6D-E390-4D0C-B06D7812937F}
Global{FD2CEE5F-1C6D-E390-650C-B06D5012937F}
Global{FD2CEE5F-1C6D-E390-B50D-B06D8013937F}
Global{FD2CEE5F-1C6D-E390-310E-B06D0410937F}
Global{FD2CEE5F-1C6D-E390-610E-B06D5410937F}
Global{FD2CEE5F-1C6D-E390-E90F-B06DDC11937F}
Global{FD2CEE5F-1C6D-E390-ED0B-B06DD815937F}
Global{FD2CEE5F-1C6D-E390-ED0C-B06DD812937F}
Global{FD2CEE5F-1C6D-E390-B10E-B06D8410937F}
Global{FD2CEE5F-1C6D-E390-6D0F-B06D5811937F}
Global{5E370004-F236-408B-8F92-61FCBA8C42EE}
Local{55E9553C-A70E-4B55-8F92-61FCBA8C42EE}
Local{55E9553D-A70F-4B55-8F92-61FCBA8C42EE}
Global{FD2CEE5F-1C6D-E390-D10F-B06DE411937F}
Global{EEE5022F-F01D-F059-8F92-61FCBA8C42EE}
Global{38E3341C-C62E-265F-8F92-61FCBA8C42EE}
Global{340FE32E-111C-2AB3-8F92-61FCBA8C42EE}
Global{340FE329-111B-2AB3-8F92-61FCBA8C42EE}
MidiMapper_modLongMessage_RefCnt
MidiMapper_Configure
MPSWabDataAccessMutex
MPSWABOlkStoreNotifyMutex
MSIdent Logon
It then phones back to the following C&C servers:
213.230.101.174:11137
87.203.65.0:12721
180.241.97.79:16114
83.7.104.50:13647
84.59.222.81:10378
194.94.127.98:25549
98.201.143.22:19595
78.139.187.6:14384
180.183.178.134:20898
We’ve also seen the following C&C server IP (194.94.127.98) in previously profiled malicious campaigns:
- Fake ‘FedEx Online Billing – Invoice Prepared to be Paid’ themed emails lead to Black Hole Exploit Kit
- Cybercriminals impersonate Bank of America (BofA), serve malware
- Citibank ‘Merchant Billing Statement’ themed emails lead to malware
As well as 78.139.187.6, in the following previously profiled malicious campaign:
We’re aware of more MD5s that phoned back to the same IPs over the last couple of days. For instance:
MD5: f55412ecb47cd64528dc1942d46331bf
MD5: 9d96157b5ae4e0546b7f510bcc1ac174
MD5: 9ea0a3efe62e175046048ca812c87158
MD5: 2b1657cee8dfec489b7fd00113b9bb4c
MD5: 28b8ad5e84f8541c716abbdb8f575c7d
MD5: 03ce491d25b68597d06cdcfe316431c6
MD5: 70768ea3273f360781f2e1d5f00eb715
MD5: ccabfea47b6d2bddf8a2090a641e5b75
MD5: 94ca03ab7c414ed347be34618804dc25
MD5: 3eaecc4bac464708d64c621b62b707e2
MD5: 3fbcd1bd6452877d883245d09b7768ea
MD5: 9f027af381bf757ba9d506e82a770bff
MD5: 8f7bfa8f1b7652d0f4f1fab93a7c63b0
MD5: a6815e3d2e53117c738f7a5370daafcc
MD5: cc2eaf9df2608e07aa2ba39fa1c2912e
MD5: fb1e76fbc43753912a4937f32d5f9c58
MD5: 4e7dc191117a6f30dd429cc619041552
MD5: d1c4179ea3b9af795e5169c244ff8c31
MD5: 694a6783866f5d43b85e93e70caaa37c
MD5: 73f85a49c2a7f1b71a087018307146c1
MD5: 8f9599e3989cc19e19fa4971b1386520
MD5: c012f6646b801a916c0b1a5235688a7a
MD5: 379ee5b9d022b13d3c919d11999b7dff
MD5: e2c18303bfca70692f85181d4a86a954
MD5: 289049f65a85cbe02d3ed6fa7e0008f6
MD5: ee3f8e7d94b801d635cbc2575ff3b3dc
MD5: 42b4d077ff3e7a9077b14f762cd2063f
MD5: a9e2f26d5e4456710f608b1f37ad2c0d
MD5: 7d7307d32e8711a2c6a261e5870a77bc
MD5: a36c2fd0a1e9d572ba030b6cc9b949b6
MD5: 27e9f62fed24ad0b93f3576f480e2644
MD5: 474d8729340789ba1722d9b82e646d8c
MD5: 1d369383ea55d81b4bcd3169bebb2772
MD5: 2fdeaa5ae2559f62a65d928d175da2c9
MD5: 496fb7da08a09c2f1d7b460bb7a24c01
MD5: 90114fd9fef19d0fc2c84bb1ee5d9bb9
MD5: 7e98cd68a4622c54f7fcb575c75cf79b
MD5: 1429ce41f54265d426c067a86e47f35a
MD5: 7c6c7c207a968bbf34f47213d91e618d
MD5: dee3f33ca9ece80871b6ab0591051c24
MD5: 91be7a17cb07c50afdf551a3e76d35c6
MD5: b6ed1bd88f36d80bf68d338620ed25c3
MD5: ef501d09c80be9aff5158c52b5986239
MD5: 5eac6806950b4fa497cfd0aab5e8ea43
MD5: e3e41e242998097b2f448990a951b467
MD5: 003167511de5d42626c665fadc7d9e32
Webroot SecureAnywhere users are proactively protected from these threats.
You can find more about Dancho Danchev at his LinkedIn Profile. You can also follow him on Twitter.
