Spammed banking malware masquerading as Symantec software

Filed Under: Malware, SophosLabs, Spam

Earlier this morning, we noticed Portuguese spam messages attempting to dupe victims into downloading and installing a fake Symantec product. The spam messages were constructed using two images hosted on the popular imageshack.us site.

symspoof.png

As usual for spammed links, despite the text shown in the message, the link actually points to a rogue URL, not a Symantec site. In this case it points to malware hosted on a compromised Czech site :

www.[legit-domain].cz/[www.symantec.com.br]vacina.exe

The file is a Trojan, written in Delphi. Mmm - Portuguese, Delphi, so surely banking Trojan related? Sure enough, the file is a downloader Trojan (proactively detected as Mal/DelpDldr-C), that downloads two additional Trojans from the same compromised site. It also displays a fake error message when run.

symspoof2.png

The first of the downloaded executables (spool.exe) is proactively detected (as Mal/Behav-103). The second file (ashsert.exe) is an installer, which drops a banking Trojan proactively detected as Mal/DelpBanc-A. Detection for the installer itself will be added shortly.

This is just another illustration of the importance in effective proactive detection. Even if users fall for the social engineering and click on the link in the spam, proactively detecting the downloader and other Trojans used in the attack can significantly reduce the potential impact of the attack on the victim. In this case, to nil.

You might like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s