APRIL 2008 Security Alerts

8 April, 2008

BANCORKUT WORM

Bancorkut is a mass mailing worm. It spreads when a user clicks upon the malicious link embedded within the email message body. The worm collects the confidential information such as username and passwords from the infected system and some websites to send the collected information to a remote server under attacker's control. These credentials are further used for performing illegal banking activities.

Typical e-mail contents are as follows :
From: Orkut Seu Profile foi Denunciado
Subject: empty
Body:
Motivo: Você está infectado(a) por algum Malware/Vírus.
Seu perfil está enviando mensagens ilí [REMOVED] rá apagado.
Orkut.com (c) 2008 - Google.com.br e seus fornecedores.
Todos os direitos reservados.

Upon execution, the Worm :
* Searches for email addresses in files with the following extensions:
.dbx, .wab, .mbx, .eml
* Attempts to steal email addresses from the contact list in MSN Messenger.
* Attempts to steal email addresses from the user account of the following social networking Web site:
www DOT orkut DOT com
* It also attempts to steal user passwords from the following Web site: www DOT terra DOT com
* Sends the gathered information to the following locations:
            [http://]maejoana DOT byethost13 DOT com
* It may then download files from the following locations on to the compromised computer: [http://]feliznatal DOT rbcmail DOT ru
* Downloads potentially malicious files from the following locations on to the compromised computer:
1) [http://]74 DOT 254 DOT 144 DOT 200
2) [http://]www DOt ecologia-domestica DOT org
3) [http://]outthegarage DOT com
4) http://]www DOT baixa DOT la

15 April, 2008

GOLDUN TROJAN

An information stealing Trojan called Goldun is spreading via email. It comes as an email attachment or as a malicious link inside the email body which pretends to appear from E-Gold online bank or from Yahoo Shopping. The “subject line” of the email entices users to open the attachment or visit the malicious link and install the Trojan on their system. Upon successful installation the Trojan opens a backdoor and steals confidential information such as usernames and passwords for financial accounts from the infected system and sends this information to the remote server which is under the control of the attacker. These stolen credentials are used for performing illegal online banking activities. Further the Trojan downloads additional malware onto the infected system. It has been observed that variants of this Trojan are spreading widely. The Trojan variant contains a hidden process that steals personal information for financial accounts. It then sends this data to a remote server located at some location.