Hotfile used to spread malware

You might remember my previous post where I stated that Rapidshare is used to spread rogueware .

Exactly the same tactic is applied with Hotfile, another file hosting service.


UPDATE 13/01/2011: Spreading malware through Hotfile is still common, so to speak. I've seen a TDSS variant spreading on it with the filename "surprise.exe" VirusTotal results can be found here . RapidShare seems to be faster in cleaning up infected files.


I received an email from one of my contacts with no subject. It contained the following link:

Link from hotfile which downloads a trojan horse. Link edited for your safety.

exe.exe

Result: 11/41 (26.8%)

MD5: 4169dc3f5e44067435016d79336c4e1a
VirusTotal
Anubis Report
ThreatExpert Report

After executing the file it connects to remote hosts which can download other malware.



Conclusion

The conclusion is actually the same as in my previous post, but I will state it once again:

You should never trust an email which has:

- only a URL included in the message
- crappy spelling and grammar if there is content in the message
- been sent out to everyone in the sender's address book
- been sent from an unknown sender
- promises you can buy something for a very cheap price
- No subject or strange subjects ( eg.: "0 enjoy yourself" )

Never reply to this kind of email, simply delete it and don't look back ;) .

If you have downloaded a program and you are unsure about its intentions, you can always upload it to VirusTotal or other online virusscanners (VirScan, Jotti). Keep in mind that if a file is not detected by any engine, it is not necessarily clean!

RapidShare used to spread rogueware

Besides the usual spam this morning, in the likes of "very good news . now you can buy new iphone 4 from this site! ",

I had also received an email from someone I know. It was sent to all of his contacts, including me. The message only contained the following URL:


Link to Rapidshare to download a file called "surprise.exe" I have obfuscated the URL for your safety.

It comes to no surprise that actually this file is rogueware with the name Security Shield. Below you can find an example screenshot of this rogue:


Security Shield rogueware

surprise.exe

Result: 11/42 (26.2%)

MD5: a6af97e7a5fd59c82b4c08a568eae882
VirusTotal
Anubis Report
ThreatExpert Report

When executing the downloaded file ( surprise.exe ):



Conclusion


Besides coming from a trusted person, this rogueware program is also using Rapidshare as a 'mirror' for spreading. Also, the file has the name "surprise.exe" which may convince you even further that your friend has just sent you a message with a nice surprise e-card or similar. After all, you know the person who sent it, why would it hurt ?

The above pictures proove why. I doubt you'd want some rogueware sitting on your computer. The trick is you should never trust an email which has:

- only a URL included in the message
- crappy spelling and grammar if there is content in the message
- been sent out to everyone in the sender's address book
- been sent from an unknown sender
- promises you can buy something for a very cheap price
- No subject or strange subjects ( eg.: "0 enjoy yourself" )

If you have downloaded a program and you are unsure about its intentions, you can always upload it to VirusTotal or other online virusscanners (VirScan, Jotti). Keep in mind that if a file is not detected by any engine, it is not necessarily clean!

Peace out.

new rogue: PCoptimizer 2010

As already stated in my previous post, there are two new rogues (rogue security software, rogueware) lurking around:

PrivacyGuard 2010 and PCoptimizer 2010

You can be presented with either of these GUIs:


PrivacyGuard 2010 (picture: BleepingComputer)



PCoptimizer 2010


If you execute any program, you can be presented with the following pop-up:


PCoptimizer 2010 pop-up


I also made a small video on how you can disable this rogue and access your programs again. In this video I targeted PCoptimizer 2010, but you can also apply these steps on PrivacyGuard 2010.



Direct link to HD video on YouTube


6 easy steps:

1) Go to Start > Run
2) Type in: C:\windows\system32
3) Find taskmgr.exe and make a copy
4) Paste taskmgr.exe on your desktop (for example) and rename to explorer.exe
5) Locate the process for the rogue (in this case, PCoptimizer 2010.exe) and click on End Process
6) You can now execute your Antivirus or Antimalware tools again, or browse the internet and download one :) .

new rogue domain: privacyguard2010.com

Whois record for privacyguard2010.com

Registrant Contact:

Name: Bayangol Duureg, Undsen Khuuliyn Gudamj 24

Address: 15111 N. Hayden Rd., Ste 160, PMB 353

City: Ulaanbaatar

Country: Mongolia

hxxp://privacyguard2010.com

Result: 3/17 (18 %)

Domain Hash: fec975d80b19c2ec3ce80fac1cd7800b

URLVoid

Note: this page does not trigger a "scan" of your computer, however, you can download a malicious file. Visit at own risk !

Some related domains:

hxxp://pcprotectioncenter.com/

hxxp://privacycorrector.com/

hxxp://pcoptimizer2010.com/

hxxp://psccenter.com/

hxxp://controlcenter2011.com/

The following file was downloaded:

setup.msi

Result: 1/43 (2.3%)

MD5: 92577052e1f4f51cb74d37727d032168

VirusTotal

ThreatExpert Report

This file drops:

PCoptimizer2010.exe

Result: 2/43 (4.7%)

MD5: 6ad932b045a4ac666659d496a81af52d
VirusTotal
Anubis Report
ThreatExpert Report

Screenshot examples:

PrivacyGuard 2010 home page

When executing the file (PCoptimizer2010.exe)

PrivacyGuard 2010 installation wizard

New scam/phishing tactics

Recently I've seen some new scam/phishing tactics rising to the surface:

Email inviting you to download the newest PDF reader



Email inviting you to download Google Earth


Basically they just want you to pay for a product you can download for free. This time it's Adobe PDF Reader and Google Earth that are being targeted.

Be alerted when you receive an email with subjects like:

New 2010 Version for Google Earth
Update to PDF Reader 2010 for Windows‏
Get more out of Google Earth‏
New PDF Reader with Activation Code‏
Update your PDF Reader for Windows‏

Do not click on any of the links, and don't be fooled if the URL doesn't look 'funny'.

They might use URL shortener services such as bit.ly or tinyurl.com to hide the real URL.

If you are really interested in any of the forementioned applications, go to the original site and download it *for free ;)* from their website.

Screenshot of the 'PDF' website



Screenshot of the 'Google Earth' website


Conclusion

The conclusion is pretty simple: delete these emails and never reply on them !
If you are unsure if the email is legit or not, I would delete it anyway.
For instance: Google will not email you with a request to download their Google Earth application and pay for it.

You can always use URLvoid and VirusTotal URL scanners as a reference.

Be safe people, and don't fall for these tricks.