Fake Xerox WorkCentre Pro Scans Hide Trojan

Ax3soft have intercepted a new spam campaign, it attempts to trick users into executing malicious files by claiming they are scanned documents. The email are sent from a spoofed email address and contains a subject in one of the following formats:

Scan from a Xerox WorkCentre Pro N 6204257
Scan from a Xerox WorkCentre Pro #866521

The email targets business users. An office print and scan center such as a Xerox machine sent a scanned document by email to a recipient. This kind of condition is really very common.

The body of the email:

Please open the attached document. It was scanned and sent to you using a Xerox
WorkCentre Pro.

Sent by: Guest
Number of Images: 1
Attachment File Type: ZIP [DOC]

WorkCentre Pro Location: machine location not set
Device Name: XRX6150AA7ACDB45706461

For more information on Xerox products and solutions, please visit

http://www.xerox.com

It looks like that the true email template used by Xerox scanning devices was copied by the spammers and the listed file type only be modified by it. When Xerox WorkCentre Pro can send scanned documents through email, these are never sent in ZIP format. Reported by the Tech Herald


An executable file called Xerox_doc.exe will be showed while opening the file archive, it is a new variant of the Official Trojan. Trojans in the Official family of malware can work as botnet clients and are basically used as distribution platform for other menaces, such as adware or scareware.

The trojan also called Gen: Variant.Oficla.4 (F-Secure, GData, NSecure) or W32/Oficla.AP (Authentium).



The files will be created as followings:

%Temp%\1.tmp
%System%\thxr.wgo
%Temp%\2.tmp
%System%\svrwsc.exe

The following directories are created:

%CommonAppData%\Microsoft\OFFICE
%CommonAppData%\Microsoft\OFFICE\TEMP

Stop the Windows service SvrWsc - Windows Security Center Service with the filename %System%\svrwsc.exe. Do not be cheated by it. The Windows Security Center Service is a bad service ,it can do nothing with the legitimate service Security Center from Windows.

It will execute a lot of Windows registry changes and the trojan establish connection with the following IPs on port 80

80.74.132.218
91.212.127.40
91.216.215.66

Data can be obtained from following URLs:

*

hxxp://www.kollo.ch/images/cgi.exe
*

hxxp://musiceng.ru/music/forum/index1.php
*

hxxp://hulejsoops.ru/images/bb.php?v=200&id=465538349&b=avpsales&tm=1
*

hxxp://hulejsoops.ru/images/bb.php?v=200&id=465538349&tid=26&b=avpsales&r=1&tm=1

At the time of writing, only 6 of the 41 AV engines did detect the trojan at Virus Total. Virus Total permlink and MD5: 1d378a6bc94d5b5a702026d31c21e242.

We have added some new policies of Ax3soft Sax2 to detect the Trojan, please update the policy basic knowledge of Sax2 in time.

New trojan variant in mails with "Look my CV. Thank you!"

Pay attention to the subject "Look my CV. Thank you! MyID NR4557547.",it is a new trojan variant in emails and Ax3soft intercepts it.

The similar subject are:

Look my CV. Thank you! MyID NR4557547.
Please look my CV. Thank you! MyID NR0663460.

It chooses the number at the end of the subject not in order and the from email address is fake.

The body of the email:

Good day.

I have figured out that you have an available job.
I am quiet intrested in it. So I send you my resume,

Looking forward to your reply.
Thank you.

The resume098.zip attached in the email. The extracted file resume.exe has 36kb capacity.

The trojan also called W32/Heuristic-210!Eldorado (Authentium, F-Prot) or Backdoor.Bredolab (PCTools)

Creat files as followings:

%Temp%\1.tmp
%System%\fjof.sto
%Temp%\2.tmp
%Windir%\atapsrb.dll

Load the following modules into the address space of other processes:

%Windir%\atapsrb.dll:

Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x1E70000 – 0x1E82000

%Windir%\atapsrb.dll::

Process name: IEXPLORE.EXE
Process filename: %ProgramFiles%\internet explorer\iexplore.exe
Address space: 0×1940000 – 0×1952000

%Windir%\atapsrb.dll::

Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0×10000000 – 0×10012000

A lot of Windows registry modifications are created and the trojan tries to establish a connection with IPs on port 80 as followings:

195.78.109.6
212.78.71.81
95.211.98.246

Download data from the following hosts:

· hxxp://olgashelest.ru/babun/bb.php?v=200&id=603225387&b=6165430227&tm=1

· hxxp://olgashelest.ru/babun/bb.php?v=200&id=603225387&tid=4&b=6165430227&r=1&tm=1

· hxxp://www.scottishchefs.com/photogallery/Slideshows/SLteam2008/p7hg_img_1/fullsize/sepod.exe

The download file sepod.exe has 60kB capacity and it is malware which called W32/Hiloti.I.gen!Eldorado (F-Prot), Trojan.Win32.Hiloti (Ikarus) or Mal/Hiloti-D (Sophos).

Create the files as followings:

%Windir%\dsmd32.dll

Load the following modules into the address space of other processes:

%Windir%\dsmd32.dll:

Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x1E70000 – 0x1E82000

%Windir%\dsmd32.dll:

Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0×10000000 – 0×10012000

A lot of Windows registry modifications are created and the trojan tries to establish a connection with IP95.211.98.246 on port 80 as followings:

We have added some new policies of Ax3soft Sax2 to detect the Trojan, please update the policy basic knowledge of Sax2 in time.

New trojan variant in mails with "Look my CV. Thank you!"

Pay attention to the subject "Look my CV. Thank you! MyID NR4557547.",it is a new trojan variant in emails and Ax3soft intercepts it.

The similar subject are:

Look my CV. Thank you! MyID NR4557547.
Please look my CV. Thank you! MyID NR0663460.

It chooses the number at the end of the subject not in order and the from email address is fake.

The body of the email:

Good day.

I have figured out that you have an available job.
I am quiet intrested in it. So I send you my resume,

Looking forward to your reply.
Thank you.

The resume098.zip attached in the email. The extracted file resume.exe has 36kb capacity.

The trojan also called W32/Heuristic-210!Eldorado (Authentium, F-Prot) or Backdoor.Bredolab (PCTools)

Creat files as followings:

%Temp%\1.tmp
%System%\fjof.sto
%Temp%\2.tmp
%Windir%\atapsrb.dll

Load the following modules into the address space of other processes:

%Windir%\atapsrb.dll:

Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x1E70000 – 0x1E82000

%Windir%\atapsrb.dll::

Process name: IEXPLORE.EXE
Process filename: %ProgramFiles%\internet explorer\iexplore.exe
Address space: 0×1940000 – 0×1952000

%Windir%\atapsrb.dll::

Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0×10000000 – 0×10012000

A lot of Windows registry modifications are created and the trojan tries to establish a connection with IPs on port 80 as followings:

195.78.109.6
212.78.71.81
95.211.98.246

Download data from the following hosts:

· hxxp://olgashelest.ru/babun/bb.php?v=200&id=603225387&b=6165430227&tm=1

· hxxp://olgashelest.ru/babun/bb.php?v=200&id=603225387&tid=4&b=6165430227&r=1&tm=1

· hxxp://www.scottishchefs.com/photogallery/Slideshows/SLteam2008/p7hg_img_1/fullsize/sepod.exe

The download file sepod.exe has 60kB capacity and it is malware which called W32/Hiloti.I.gen!Eldorado (F-Prot), Trojan.Win32.Hiloti (Ikarus) or Mal/Hiloti-D (Sophos).

Create the files as followings:

%Windir%\dsmd32.dll

Load the following modules into the address space of other processes:

%Windir%\dsmd32.dll:

Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x1E70000 – 0x1E82000

%Windir%\dsmd32.dll:

Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0×10000000 – 0×10012000

A lot of Windows registry modifications are created and the trojan tries to establish a connection with IP95.211.98.246 on port 80 as followings:

We have added some new policies of Ax3soft Sax2 to detect the Trojan, please update the policy basic knowledge of Sax2 in time.

Emails with the subject "UPS INVOICE NR9094991" and "Delivery Problem NR2204780" contains trojan

Ax3soft noted the highest virus detection rate from these months, which owes to the combination of the “Thank you for buying iTunes Gift Certificate!” and the latest UPS related emails with subjects like “UPS INVOICE NR9094991″ or ”Delivery Problem NR2204780″

The similar subjects are (the numbers are choosed randomly):

UPS INVOICE NR9094991
Delivery Problem NR2204780

The body of the email:

Hello!
Unfortunately we were not able to deliver your postal you have sent on the 11th of March in time because the addressee’s is inexact.
Please print out the invoice copy attached and collect the package at our department.
UPS Global Services.

Hello!
We failed to deliver the postal you have sent on the 24th of March in time because the addressee’s is wrong.
Please print out the invoice copy attached and collect the package at our department.
UPS Express Services.

The zip archive upsinvoice3325037.zip is contained in the email and it is available to extract the file UPSINVIOCE.exe which has 36 kB capacity.

The trojan is known as W32/FakeAlert.NW (F-Prot), Trojan.Win32.VBKrypt.yj (Kaspersky), Win32/Oficla.EU (NOD32), Troj/Bredo-CX (Sophos) or Trojan.Sasfis (Symantec).

Creat files as followings:

%Temp%\1.tmp
%System%\nnfj.tqo
%Temp%\2.tmp
%Windir%\scindl.dll

Load the following modules into the address space of other processes:

%Windir%\scindl.dll —>
Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x1E90000 – 0x1EA1000

%Windir%\scindl.dll —>
Process name: IEXPLORE.EXE
Process filename: %ProgramFiles%\internet explorer\iexplore.exe
Address space: 0×1940000 – 0×1951000

%Windir%\scindl.dll —>
Process name: [generic host process]
Process filename: [generic host process filename]
Address space: 0×10000000 – 0×10011000

the trojan tries to establish a remote connection with IPs on port 80 as followings:

85.87.17.230
89.149.202.142
95.211.27.238

Download data from the following hosts:

* hxxp://funnylive2010.ru/ms/bb.php?v=200&id=653227819&b=newsp&tm=2
* hxxp://funnylive2010.ru/ms/bb.php?v=200&id=653227819&tid=5&b=newsp&r=1&tm=2
* hxxp://www.yunusemre.net/trpanel/fckeditor/editor/
_source/classes/sistempod.exe

We have added some new policies of Ax3soft Sax2 to detect the Trojan, please update the policy basic knowledge of Sax2 in time.

For more information, please visit http://www.ids-sax2.com/ComputerSecurityNewsletter.htm

If you want to unsubscribe, please click here.

How to Detect Hacker Attack With Sax2

Most computer vulnerabilities can be exploited in a variety of ways. Hacker attacks may use a single specific exploit, several exploits at the same time, a misconfiguration in one of the system components or even a backdoor from an earlier attack.

Due to this, detecting hacker attacks is not an easy task, especially for an inexperienced user, but Sax2 will let it become very easy, Sax2 is a professional intrusion detection and prevention system (NIDS) and it provides a wealth of security policy. This article gives a few basic solution to help you figure out either if your machine is under attack or if the security of your system has been compromised.

Solution1:

Diagnosis View is the most direct and effective place to detect hacker attack and should be our first choice. Sax2 can detects most of hacker attack and generate invasion events, if Sax2 confirm that the current attack are very dangerous, it will automatically block or interfere with the conversation. Picture 1 is an example of detection "Erazer Lite" backdoor.

(picture1)

Solution2:

See E-mail log, Check for suspicious mail, Trojan usually will send a E-mail message in order to steal your important information, such as bank account and password.


Solution3

Suspiciously high outgoing network traffic. If you are on a dial-up account or using ADSL and notice an unusually high volume of outgoing network (traffic especially when you computer is idle or not necessarily uploading data), then it is possible that your computer has been compromised. Your computer may be being used either to send spam or by a network worm which is replicating and sending copies of itself. For cable connections, this is less relevant - it is quite common to have the same amount of outgoing traffic as incoming traffic even if you are doing nothing more than browsing sites or downloading data from the Internet. About how to monitor network traffic, please visits http://www.ids-sax2.com/articles/MonitorNetworkTraffic.htm.

How to Monitor IM Activities with Sax2

In Logs Window, besides the three original logs: HTTP Requests, Email and FTP Transfers , we can monitor real-time activities and detailed messages of MSN instant messengers. The following picture 1 is an example of MSN Activities.


(picture 1)

1.Automatically save all messages for future reference

By default Sax2 will not save logs of those IM activities, to enable this function, we have to make some log settings. Let's take MSN log as an example:

Click "Options" button on the menu bar and then a dialog box will pop up as displayed in picture 2, then switch to "MSN Analyzer" Settings page,

(picture 2)

We can see Log File(s) is disabled. To enable log files, we have to click "..." to open another dialog box where we can define full path to log file.

2.IM Activities Information

Date - date information of the activity;
Time - time information of the activity;
IP1 - IP address of the node that is conducting the IM activity;
Account - account that is conducting the IM activity;
Transactions - detailed message content;

All IM messages are listed in time sequence, Picture 3 is an example of MSN messages.


3.Benefits:

* No need to purchase another IM monitor;
* Monitor all IM activities in real time;
* Save all IM messages for future reference;
* Prevent business secretes from leaking out via IM activities;
* Learn how much time your employees are spending in personal chatting during working hours;

How to Monitor Network Traffic with Ax3soft Sax2

This article is to discuss how we can monitor network traffic .Sax2 make it easy for us to monitor and analyze network traffic in its intuitive and information-rich window. With Sax2's network traffic monitor feature, we can quickly identify network bottleneck and detect network abnormities.

1. Monitor network traffic in "Status" windows

Project status window shows the current status of the operation, including start time, duration, capture packets, buffer usage and real-time network traffic.



2. Monitor network traffic in "Statistical" window

"Statistical" is a view that provides general statistical information of the entire network or the selected node in the "Node Explorer". In "Statistical" we can get a quick view of the total traffic. When we switch among the node from the node explorer, corresponding traffic information will be provided.



2.Monitor network traffic in "Conversations" window

In "Conversations" window we can monitor network traffic by each conversation and the figure out which conversation has generated the largest network traffic.



As we can see, we can analyze network traffic in deferent levels with sax2, thus enables us quickly and efficiently detect network abnormities and troubleshoot network problems.