Rango Antivirus FakeAV makes a surge
The Dell Sonicwall Threats Research team has observed a huge wave of spam that is spreading FakeAV software called Rango Antivirus 2014. FakeAV software was a big trend 2 years ago but had since died down following a rise of infostealer trojans and ransomware such as Cryptolocker. This FakeAV Trojan arrives as an email with an attachment masquerading as a court notice document.
The Trojan adds the following files to the filesystem:
- %APPDATA%ipcsxnep.exe [Detected as GAV: Zbot.CH_4 (Trojan)]
- %APPDATA%upoosook.exe [Detected as GAV: Inject.C_2 (Trojan)]
The Trojan adds the following keys to the Windows registry:
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun rqvobwcf "%APPDATA%ipcsxnep.exe"
- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun xwpdlhad "%APPDATA%upoosook.exe"
The Trojan runs an instance of svchost.exe and injects malicious code into it. The malicious code causes it to download an encrypted copy of ipcsxnep.exe from a remote webserver:
The following strings where seen in the svchost memory space. Some of this system information is sent encrypted in the initial POST request:
The Trojan then sleeps for a variable period of time. We observed a period of around 10-15 minutes before FakeAV dialogs were shown. The following is a sample of the dialogs that are shown to the user:
As seen in the screenshots, the Trojan uses the usual FakeAV scare tactics to entice the user into paying for the software. The payment page shows 3 license packages:
SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:
- GAV: Zbot.CH_3 (Trojan)
- GAV: Zbot.CH_4 (Trojan)
- GAV: Inject.C_2 (Trojan)