A new virus is currently circulating on Facebook. The malwarewas forwarded to us for analysis by the friendly website www.safer-internet.gr. The new virus is encrypted to make analysis difficult and to avoid detection by antiviruses, but the technical team of iGuRu.gr managed to "see" the operation of the malicious program.
But let's start from the beginning.
The virus comes in a .zip file as shown in the photo below – click to enlarge. Its name can be random and comes with a different one each time. The virus must have java installed on your computer to run,
The specific file we examined is called Form_0910.zip. The zip contains an executable .jar file (Java file) which is not recognized by antiviruses (we scanned it with two different ones and it did not "hit"). The jar file contains the following files
.settings folder
META-INF folder
.classpath
.project
and the malicious file (encrypted) DOYUMGEOGFVKNBO.class
If someone runs the jar file, the malware will create a folder in C:\ called temp. Once it creates the folder (it's not that fast) it starts downloading a large Windows executable (.exe) file. (We ran the jar in a Windows 7 virtual machine).
In our case the file name was QNIDSUE.VZZ, but that doesn't matter as the name was random (the second time we ran it it was called VEKDGH.CXV). The file size surprised us as it was 3.8MB, quite large for a malicious program.
The malicious exe was identified by ESET as Win32/Injector.AZFL trojan, a fairly new malware for ESET which first recorded it on March 7, 2014.
| Detection created | 2014-03-07 |
The exe contains many subprograms (it is a kind of wrapper), so it can perform many functions. It can send emails, connect to ftps, it contains many places with usernames and passwords, which shows us that it can connect to remote computers and download other files.
One of its most dangerous features is that it can read the cookies on the victim's computer. This means it can steal all the passwords stored on the computer.
But it doesn't end here.
There is another file, pthreads.dll. This particular .dll is used to see what Windows is running. The Windows task manager runs the same dll. This can be useful to the malicious user for different things.
1. see what the victim's computer is running and adapt the attack accordingly, or
2. hide the malicious program from Windows processes.
If you have run the jar, search the drive where Windows is installed for a temp folder. Delete the folder and scan your entire system with a reliable and up-to-date antivirus.
Beware of this virus as it is very aggressive and aims to steal your credentials. Although the virus comes in a file that can be executed on all platforms, it attacks Windows machines.
We would like to thank the friendly website www.safer-internet.grfor the immediate information and our technician and friend Paul Delia, for the "exploration" of the virus.
The check we did with VirusTotal is here. (last) and Real here
And the analysis from Malwr
Source: secnews.gr
