Nowadays, spammers usually craft elaborate and enticing scams to lure a lot of people into taking action. However, a spam campaign we observed recently is one of the more cruder forms of social engineering. Attached to the spam message is simply an executable file named “pic.exe” that claims be naked pictures. This spam has been circulating with the subject line, “hi my love“:
Spam sample 2
Thankfully, with this low level of social engineering, this spam campaign would probably not fool most people. But, being curious, we gave in, opened the attachment and analyzed what it does. The file “pic.exe” is a downloader Trojan that fetches and executes malicious files from the Web.
Trojan code that downloads additional malicious files
Trojan performing a HTTP request to download files
The first file downloaded is “ebulker_dlfjihgsleigh.exe” an installer of the infamous “SecurityTool” fake antivirus, the same flavour of fake AV distributed by other downloaders such as Bredolab and Sasfis. The installer phones home to its affiliate server by using the HTTP request with this format, http://<remote IP>/cb_soft.php?q=<hexadecimal>.
SecurityTool - A fake AV
The second malicious file downloaded is “outlook.exe”, a sniffer Trojan that monitors FTP, SMTP and POP3 traffic in the infected machine and sends captured data back to its control server. We did not observe any data being sent, but it is most likely targeting user credentials.
Trojan code that monitors the FTP (port 21),POP3 (port 110) and SMTP (port 25) protocol.
This sniffer Trojan drops a legitimate file wpcap.dll and packet.dll in the Windows system directory as well as the packet filter driver npf.sys. This files are commonly used by legitimate network monitoring software such as WireShark. In this case, the Trojan utilizes these DLLs for malicious purposes.
There are a couple of points to this story. The first is that spammers probably don’t care if a spam campaign is unsophisticated. They can send millions of messages, and a few people will inevitably get sucked in anyway. Secondly, these days getting infected usually means multiple pieces of malware doing different things on your computer. Some malware may be obvious like Fake AV, but most will be hidden.
