Windows XP is officially dead, at least from Microsoft's perspective, but there are still millions of users using it and that is the main reason why cybercriminals target these systems.
AppRiver, a company that provides cybersecurity solutions for email and Web products, is now reporting a new spam campaign that is distributing the Upatre downloader to users around the world, but this time, the malware is only running on a Windows XP computer.
This new spam campaign comes as an email with the subject line “Attorney-Client Agreement” and tries to trick users into opening ZIP that contain the Upatre trojan.
AppRiver says that this campaign is different from other spam campaigns because the ZIP file consists of three random names, which are always different in each email, making it difficult for spam filters to block messages based on the file name of its attachment.
If a user falls victim to the lengthy text of the spam email, which uses a well-known scare tactic, users will end up with Upatre on their computers.
Upatre, first spotted in August 2013 after the Blackhole Exploit Kit debacle, is known to be a Trojan downloader, a type of malware that only delivers dangerous malware to infected machines. In the past, Upatre has been used to download malware such as Dyreza, Rovnix, Crilock, and Zeus.
The latest version of Upatre is less dangerous because it only runs on XP machines, disabling one of its internal filters when running on a different platform.
Once on an XP machine, the malware begins taking over system processes, adding registry entries, closing security certificates, and checking for reverse-engineering debugging tools.
Once all of this is done, it then sends the user's IP address and local OS details to a C&C server located at 197.149.90.166:12299 and waits for further instructions.
"Even on Windows XP these samples looked a little rickety as if they were ready to crash after a fairly short period of time, but they had the best success rate for XP machines," said AppRiver's Fred Touchette, who also adds that they expect to see more advanced versions of this Upatre targeting XP machines in the coming days.
