Right after the Venezuelan presidential elections cybercriminals launched a new credential stealing malware joined by a social engineering campaign saying that supposedly the last election was a fraud. The name of the malicious file is “listas-fraude-electoral.pdf.exe” which is translates to “Fraud elections lists” and it spread via a fake Globovision Venezuelan news TV station.

The mentioned malware is quite simple and it sets out to disable the UAC system, which allows the criminals to run administrative commands under restricted users accounts.

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

Post was updated 19.03.2012 (see below)

In the last few days a malicious program has been discovered with a valid signature. The malware is a 32- or 64-bit dropper that is detected by Kaspersky Lab as Trojan-Dropper.Win32.Mediyes or Trojan-Dropper.Win64.Mediyes respectively.

Numerous dropper files have been identified that were signed on various dates between December 2011 and 7 March 2012. In all those cases a certificate was used that was issued for the Swiss company Conpavi AG. The company is known to work with Swiss government agencies such as municipalities and cantons.

Information about the Trojan-Dropper.Win32.Mediyes digital signature

Kaspersky Lab malware researcher Tillmann Werner joins Ryan Naraine to talk about the threat from peer-to-peer botnets. The discussions range from botnet-takedown activities and the ongoing cat-and-mouse games to cope with the botnet menace.

Cybercriminals are always looking for new ways to infect systems – ideally without being noticed until it’s too late. The sky is the limit for their creativity, as the latest wave of malicious boot loaders shows. The kit has been pioneered by Brazilian Trojan bankers who aim to remove security software.

This non-traditional infection only affects systems using ntldr, the default boot loader on Windows NT up to and including Windows XP and Windows Server 2003. This choice was no coincidence - XP is still the most popular OS in several countries, including Brazil, where it runs on nearly 47% of all machines.

    Isn’t it great when your forecasts come true? Well, sometimes. But maybe not this time. Today I found a malicious site specially designed to fake three antivirus brands. Kaspersky is top of the list. So, what does it look like?

    While looking over some potentially malicious links from Brazil, I came across an interesting group of files. They were of varying sizes but had similar structures.
 

Kaspersky Lab chief technology officer Nikolay Grebennikov joins Ryan Naraine to discuss the evolution of anti-malware software. Grebennikov talks about the changing face of the malicious threat facing desktop users and the additional components added to Kaspersky's anti-malware products to move beyond signature-based detection of threats. He goes into detail about heuristics and emulation, behavior-based detection and newer proactive technologies to handle real-time malware detection.

After rumors about the supposed merger between SpyEye and ZeuS, and the public release of the source of the latter, it was logical that the range of possibilities opened up even more for new cybercriminals into the ecosystem of crimeware.

Consistent with this, it was only a matter of time for the emergence of new packages based on ZeuS crimeware, which is now realized. Ice IX Botnet is the first new generation of web applications developed to manage centralized botnets through the HTTP protocol based on leaked ZeuS source code.

Identifying a botnet is not an easy task sometimes, especially when one gets lost in different components like droppers, infectors and other bad stuff. Some two weeks ago, Jose Nazario from Arbor Networks pointed me to a new varmint that appears to be another peer-to-peer bot. When executed, the program installs tons of stuff that holds a number of goodies, for example

• an executable hidden in an Alternate Data Stream,
• three Bitcoin miners: the Ufasoft miner, the RCP miner and the Phoenix miner,
• a file with geo-location information for IP address ranges.

However, we leave these aside for now and focus on the botnet's architecture instead, which is really just a channel for pushing software to infected machines. Scrabbling about in the installed programs finally brought up the actual bot, which we detect as Trojan.Win32.Miner.h. The binary has some layers of obfuscation to make analysis harder but eventually writes a UPX packed executable into a memory section from where to original binary can be restored.

One of the first things that come to attention is a list of 1953 hard-coded IP address strings that are contained in the binary. These addresses are contacted by the bot during its bootstrapping phase in order to join the peer-to-peer network.

The ShadyRAT whitepaper spectacle coincided with the start of the Blackhat USA 2011 conference. While it was noted that AV vendors reliably detect related ShadyRAT downloader components, discussion of other components were absent. The downloaders vaguely mentioned in the report have been reliably detected by Kaspersky Lab products for years.

More information was provided later on another vendor's site. But whitepaper readers were left with only a dive into the high level data compiled by the attackers’ web monitoring components and no actionable information presented.

Meanwhile, over on the HBGary blog, the more interesting descriptions of the meat of the backdoor components and communications were discussed - something sysadmins can do something about.

We also added detection of this component and variants like it as Backdoor.Win32.Shady.a (Trojan-Downloader.Win32.Agent.szfj), which was actually used early 2011 and after several months, still active and detected only by Sophos.

This prolonged absence of detection is both acutely problematic and symptomatic of active, determined groups. These Shady backdoors are especially interesting for their style of covert communications with hidden messages appearing in HTML source text on both compromised and managed sites.