Spammed banking malware masquerading as Symantec software

Earlier this morning, we noticed Portuguese spam messages attempting to dupe victims into downloading and installing a fake Symantec product. The spam messages were constructed using two images hosted on the popular site.


As usual for spammed links, despite the text shown in the message, the link actually points to a rogue URL, not a Symantec site. In this case it points to malware hosted on a compromised Czech site :


The file is a Trojan, written in Delphi. Mmm – Portuguese, Delphi, so surely banking Trojan related? Sure enough, the file is a downloader Trojan (proactively detected as Mal/DelpDldr-C), that downloads two additional Trojans from the same compromised site. It also displays a fake error message when run.


The first of the downloaded executables (spool.exe) is proactively detected (as Mal/Behav-103). The second file (ashsert.exe) is an installer, which drops a banking Trojan proactively detected as Mal/DelpBanc-A. Detection for the installer itself will be added shortly.

This is just another illustration of the importance in effective proactive detection. Even if users fall for the social engineering and click on the link in the spam, proactively detecting the downloader and other Trojans used in the attack can significantly reduce the potential impact of the attack on the victim. In this case, to nil.