W32/Bredolab.fam!tr - Released Oct 27, 2009 - Last Updated Nov 02, 2009
Detailed AnalysisBredolab is a very widely distributed bot that is used to download and execute one or more malware packages on computers that it has infected. It is closely associated with the distribution of fake antivirus programs, but can also be used to install other malware. After its work has been done, Bredolab remains in the background, occasionally checking in with its control server for further instructions. Technical DetailsDistributionThe Bredolab bot is mainly spread through spam email campaigns. It has no ability to spread directly to other computers. As an example, two emails from a recent campaign are shown below, in Figure 1.
If the person receiving the email is expecting a package, or works in an office where packages regularly arrive, they probably will get the attachment and unzip it. The unzipped file is about 60 to 70 kilobytes in size, and appears with a Microsoft Excel spreadsheet icon. It is actually an EXE file. When the user tries to open it, the Bredobot installer is executed. The EXE file is a dropper that installs Bredolab on the victim's system. The installer goes through a constant series of changes. During a period of two weeks that this trojan is being observed, a number of changes have been made on the installer: the number of sections changed from three to four; the order of the sections was rearranged; the section names were also rearranged. InstallationPhase 1: Bredolab Install
Phase 2: Malware Installation
Phase 3: Background Operation
Secondary InfectionsThe main purpose of the versions of Bredolab that are currently being distributed is to install a fake antivirus product called Antivirus Pro 2010. This program initially displays what seems to be an antivirus scan in progress.The Windows Security Center control panel applet wscui.cpl has been replaced with a fake one named _scui.cpl. The result can be seen below, in Figure 4. The real Security Center, showing the Firewall and Updates disabled, is on the left. The replacement is on the right. It contains a handy link that the victim can click to pay for an Antivirus Pro 2010 license.
The table below shows the files that are detected by Antivirus Pro 2010 as malware. These files were installed at the same time as Antivirus Pro 2010. All of the files appear to contain random data, with no header of any kind.
One other piece of malware was added to the system during the installation phase. At some point, the computer was also infected with the ZBot trojan. The main ZBot executable file, sdra64.exe, and other ZBot files, were installed and the Winlogon registry key was changed. But when Bedolab finished installing Antivirus Pro 2010, sdra64.exe had been removed, although the registry key remained. ConclusionBredolab performs a fairly simple task, to download and install one or more malware packages. It has some features not found in traditional downloaders. Most important are its ability to update itself and check for new downloads to install. It may also be able to report some information back to the control server. These are features one should expect to find in a modern downloader.Bredolab VariationsThere are currently two different downloaders that are widely identified as Bredolab. They differ mainly in the way they install themselves on the victim's computer. They can easily be identified by their sizes: the larger executable is about 60k, and the smaller one is 25k to 30k. The larger downloader, which adds itself as a BHO, is the one examined here. The smaller one exploits vulnerabilites to hook itself into the system.In the current campaign both Bredolab downloaders install AntivirusPro 2010 by downloading and executing the same installer files. This has probably led to some confusion between the two because most of the files added to infected systems are the same. The downloaders arrive as attachments to very similar spam emails. The naming of the attachments is also very close. Here are some attachment names and sizes from a single day.
As of October 27, 2009 the "DHL" campaign is clearly drawing to a close. Spam carrying the small version has stopped and spam with the large version has almost stopped. Many new emails with the small version have been seen. These have "Facebook Password Reset Confirmation" as the subject and attachment names like Facebook_Password_420ca.exe. New spam with the large version have not been seen yet. If they do arrive, it could demonstrate a connection between the two downloaders. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Recommended Action
|
Reference: ID - 1097244
