Michael Jackson Video Trojan
SonicWALL UTM Research team observed a new Trojan Downloader - Adload.LI (Trojan) being spammed in the wild starting June 26, 2009. The spammed emails pretend to contain links to unseen videos and pictures of late Michael Jackson.
The link in the spammed e-mail points to a well-known radio broadcasting station website hosted in Australia. At the time of writing this alert, the link was still alive fetching the malicious file:
The file gets downloaded as Michael.Jackson.videos.scr and has an icon disguised as a MPEG video file as seen below:
Screenshot of a download prompt from the well-known website is shown below:
When executed the Trojan Downloader performs following activity:
- Creates a Mutex Object _!SHMSFTHISTORY!_ to marks its presence in the system
- Opens up a legitimate website showing a news article related to Michael Jackson in Internet Explorer as seen below:
- Attempts to download malicious files from anella2009.dominiotemporario.com domain:
- GET /ba/foto.dll - saved as (Windows)Dynamic.dll (GAV: Banker.N (Trojan))
- GET /ba/michael.gif - saved as (System)fotos.exe (GAV: Banspy.F (Trojan))
- GET /ba/kproces.gif - saved as (System)kproces.exe (GAV: Banbra.NOR (Trojan))
- Runs the files downloaded above.
This Trojan is also known as TrojanDownloader:Win32/VB.LI [Microsoft] and Trojan-Downloader.Win32.Adload [Ikarus]
SonicWALL Gateway AntiVirus provides protection against this malware via GAV: Adload.LI (Trojan) signature.