Email Spam leads to Banking Trojan

July 21, 2011

Sonicwall UTM research team received reports of a new online banking Trojan seen in the wild. This Trojan steals security credentials used to manage various online banking accounts targeting South American Bank Caixa Group.

Users will receive an email similar to the screenshot below related to banking transaction. The email contains a link purportedly to be the proof or receipt of the transaction but otherwise leads to downloading of the banking trojan.

    screenshot

    Translated to English:

    Portuguese - detected to English translation
    --------------------------------------------------
    PROOF OF SCHEDULE
    --------------------------------------------------

    Please be advised that scheduling was made in Internal Transfer
    BPI service online, with the following data:

    Schedule Date - 07/18/2011 06:16
    Operation Type - Issuance of checks on foreign
    Nr Documento2342576678899 (9.12 kb)

The email link leads to a compromised website which serves the trojan: http://cla{REMOVED}ua/.../bpi23045.asp

Once the user clicks on the link, it will display the message below showing that the Adobe Reader is outdated and redirects it to the download page.

    screenshot

The Adobe Reader download page is fake and will actually serve the banking trojan.

    screenshot

    screenshot

In order to disguise the banking trojan as a legitimate installer, it uses Adobe Flash icon shown below:

After installation, the trojan will launch these pages to let the user think that it installed a legitimate Adobe Reader and will ultimately show the online banking transaction.

    screenshot

    screenshot

Installed files:

  • %systemdir%1kl1.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]
  • %systemdir%xservicex.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]
  • %temp%header_10.1.45.2.exe [ detected as GAV: VBKrypt.CQZR (Trojan) ]

Added Registry:

  • Key: HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
    Value: xservicex
    Data:"%systemdir%1kl1.exe"

Network Activity:

HTTP Requests:

  • http://www.ca{REMOVED}/lnkFloud.php
  • http://www.d{REMOVED}tyjytj/.../c.php
  • http://sch{REMOVED}/willkohead.png

SonicWALL Gateway AntiVirus provided proactive protection against this threat via the following existing signatures:

  • GAV: VBKrypt.CQZR (Trojan)
  • GAV: Banker.UTV (Trojan)

screenshot