Security Response

Following the Trojan.Koredos incident, we stumbled upon a very interesting back door Trojan—Backdoor.Prioxer. We received this Trojan from a source that was also infected by Trojan.Koredos, and although we cannot prove a direct link between the two, we believe it is likely that both threats derive from the same source.

You can read more details about Trojan.Koredos in our previous blog entry. Briefly, Koredos is a threat that was used in a targeted attack against several Korean websites. The Trojan shows a modular architecture and a level of sophistication that suggests the attack is coming from a well-established malware source.

Why is Prioxer interesting? Well, at first glance...

We have recently found samples of a new C&C (command-and-control) engine, named Dream Loader, and detected as Trojan.Karagany by Symantec products, that is being used in the wild. The engine comes in a pack that contains both a builder to build your own executable bot, and a Web interface to control all your bots by sending them commands through the Web.

Origins and marketing

The pack, version 0.3, is relatively new and seems to be originating from Russia; it was first found in November and is designed to be modular and load plugins. It has some nice features, although it is not as advanced as other packs, like Zeusbot for example. The pack was being sold for $550 in order to buy the backdoor itself (not the builder) and the Web interface. Every update to the backdoor configuration (e.g. a new url to be used for the C&C server) would require...

We have seen many threats that use file-sharing applications in order to spread to other computers. Typically these threats would scan a compromised computer for the shared folders of these programs, and if found would copy themselves into those folders mimicking names that are popular in search queries (e.g. popular pirated softwares, games, or cracks).

W32.Changeup does not scan for existing file-sharing applications, but it does do something unusual. It will actually install a well-known application called Emule and use it to share itself, mimicking tens of thousands of file names from popular user searches. Let’s have a closer look.

Infection
Changeup may arrive on a computer in several ways. As we have seen, it may use the Microsoft Windows Shortcut 'LNK' Files Automatic File Execution...

Last weekend, we warned our customers about a Zero-day exploit targeting Adobe Flash and Reader in the wild. The corresponding BID can be seen here. We have updated our antivirus definitions in order to detect this new threat as Trojan.Pidief.J, and we have done an analysis of this new exploit to understand how it works. 

At first glance, the PDF document looks suspicious: it contains a Javascript object and a Flash application. The Javascript is clearly malicious, and has the typical form of heap-spraying code:

 Image 1: Malicious Javascript code...