Cyber Security Awareness Month: Day Two

Fake IRS Email Continues

I know this is becoming the Spam Campaign that Just Won't Die, but today we are still seeing extreme volumes of spam claiming to be from the Internal Revenue Service, with the subject line "Notice of Underreported Income". Here are the host names being used in the spam for October 1st and so far on October 2nd:

October 2, 2009 Domains seen in spam by the UAB Spam Data Mine:

www.irs.gov.ccviilli.com
www.irs.gov.ccviilli.net
www.irs.gov.ccviilll.com
www.irs.gov.ccviilll.net
www.irs.gov.ccvillli.com
www.irs.gov.gerradsz1.be
www.irs.gov.gerradsz1.co.ee
www.irs.gov.gerradsz1.com
www.irs.gov.gerradsz1.eu
www.irs.gov.haqwaz1.co.im
www.irs.gov.haqwaz1.com.im
www.irs.gov.haqwaz1.im
www.irs.gov.haqwaz1.net.im
www.irs.gov.hyyyyf1.cn
www.irs.gov.hyyyyf1.eu
www.irs.gov.hyyyyf2.eu
www.irs.gov.hyyyyf3.cn
www.irs.gov.hyyyyf4.cn
www.irs.gov.hyyyyf5.cn
www.irs.gov.hyyyyf6.cn
www.irs.gov.hyyyyf6.eu
www.irs.gov.hyyyyf7.cn
www.irs.gov.hyyyyf7.eu
www.irs.gov.hyyyyf8.cn
www.irs.gov.hyyyyf8.eu
www.irs.gov.nyuz1a.com
www.irs.gov.nyuz1a.net
www.irs.gov.nyuz2a.com
www.irs.gov.nyuz2a.net
www.irs.gov.nyuz3a.com
www.irs.gov.nyuz3a.net
www.irs.gov.nyuz4a.com
www.irs.gov.nyuz4a.net
www.irs.gov.nyuz5a.com
www.irs.gov.nyuz5a.net
www.irs.gov.vsdftpp.net

October 1, 2009 Domains seen in spam by the UAB Spam Data Mine:

www.irs.gov.ercc1zw.com
www.irs.gov.hyu111a.com
www.irs.gov.msrvtpp101.be
www.irs.gov.msrvtpp101.com
www.irs.gov.msrvtpp101.eu
www.irs.gov.msrvtpp102.be
www.irs.gov.msrvtpp102.com
www.irs.gov.msrvtpp102.eu
www.irs.gov.msrvtpp103.be
www.irs.gov.msrvtpp103.com
www.irs.gov.msrvtpp103.eu
www.irs.gov.vsdftpp.biz
www.irs.gov.vsdftpp.com
www.irs.gov.vsdftpp.in
www.irs.gov.vsdftpp.info
www.irs.gov.vsdftpp.mobi
www.irs.gov.vsdftpp.net
www.irs.gov.vsdftpp.org

Attempting to retrieve the malware from these sites, we were successful only with those on the ".im" country code. Like many cybercriminals, the criminals behind Zeus rely on inexperienced or uncooperative domain name registrars in order to keep their malicious websites live longer. In this case the domains:

haqwaz1.co.im
haqwaz1.com.im
haqwaz1.im
haqwaz1.net.im

as you're no doubt aware (ok, I had to look it up too!) .IM = Isle of Man. These domains would have been registered from "nic.im", who holds the keys to taking those domains off-line. I'm using the "nic.im" "contact us" page to report these fraud domains now.

The current version of the malware, which is still a Zeus Bot or "Zbot" infector, has these characteristics:

File size: 95232 bytes
MD5...: 869dba8c4bd9bb5a9030a24096883c6b

and is currently detected by only 9 of 41 anti-virus products at VirusTotal as you can see in this VirusTotal Report.

Other Malware in the Mail

Another long-running spam campaign claims that there has been a "delivery problem" with either DHL or Western Union.

The spam message says something like:

Hello!

We were not able to deliver the package you have sent on the (date here) in time
because the recipient's address is inexact.
Please print out the invoice copy attached and collect the package at our department.

DHL Customer Service

In this case the "attached package" is a piece of malware:

File size: 62464 bytes
MD5 : a4c926feeb6f906344f583091a02598f

which is well-detected as "BredoLab" as you can see in this VirusTotal Report by 16 of 41 anti-virus products.

Another version of the same spam says the same thing, only uses "UPS Delivery Problem" as the subject line and claims to be sent from "United Parcel Service".

A third version of the spam claims to be from Western Union, using the subject line "Wester Union transfer is available for withdrawl".

Dear customer.

The amount of money transfer: 8566 USD.
Money is available to withdrawl.

You may find the Money Transfer Control Number and receiver's details in document attached to this email.

Western Union.
Customer Service Center.

Whichever of these BredoLab malwares you run, you end up with Fake AV products being installed on your computer.


In the last prominent malware campaign we'll look at today a spam message is sent with the subject line "Thank you for setting the order No.475456". The text of the email reads:

Dear Customer!

Thank you for ordering at our online store.
Your order: Sony VAIO A1133651A, was sent at your address.
The tracking number of your postal parcel is indicated in the document attached to this letter.
Please, print out the postal label for receiving this parcel.

Internet Store.

Several slight variations of the attachment, sometimes called "install" and other times called "open" detect as different malware, with the two main versions being:

File size: 13312 bytes
MD5 : 595dc19dab1fa441304d77971c507d65

which detects as "Bravix" or "FakeAlert" or many other names, as you can see in this VirusTotal Report, which shows that 20 of 41 Anti-virus products detect this as malware.

and

File size: 13824 bytes
MD5 : 19daf4ef68dd4d830d4159e3d0dc7eb0

which also has many different detection names, including "Bravix", as you can see in this VirusTotal Report, which shows 23 of 41 anti-virus products detect this as malware.