LinkedIn Spam, exploits and Zeus: Revisited

In my post from June this year, I already reported on an excellent recipe for a cybercrook:

1. Hacking LinkedIn's password (and possibly user-) database.
2. Sending an email to all obtained email addresses, which is urging you to check your LinkedIn inbox as soon as possible.
3. A user unawarely clicking on the link.
4. An exploit gets loaded. Malware gets dropped. Malware gets executed.
5. User's computer is now a zombie (part of a botnet).

You can find that post back here:
LinkedIn spam, exploits and Zeus: a deadly combination ?


Seems this scheme is still being successfully employed, as well the usage of the latest Java exploit (CVE-2012-4681).

Let's clearly divide this clever trick into the 3 parts.


Part 1 - the spam email:


So called reminder from LinkedIn


Example subjects of this email:
Communication LinkedIn Mail
Connection LinkedIn Mail
Contact LinkedIn Mail
Immediate LinkedIn Mail
Invitation reminders LinkedIn
Link LinkedIn Mail
LinkedIn Updates
PENDING MESSAGES - LinkedIn Mail
Relation LinkedIn Mail
Relationship LinkedIn Mail
Rush LinkedIn Mail
Signaling LinkedIn Mail
Urgent LinkedIn Mail



First part of the whole set-up or scheme is of course letting the user click on a malicious link.

This is your typical social engineering trick: it seems you have pending messages from LinkedIn and you can check your inbox by clicking on the link.

Note that the other links also trigger the exploit.


Part 2 - the -in this case Java- exploit

When clicking on one of the links, you are redirected to a website which is hacked and is hosting a Javascript file:


Malicious Javascript

This Javascript is not very malicious, it just redirects to another website (again) where the exploit is hosted:


Location of the actual exploit


Eventually, you'll get on a webpage which contains heavily obfuscated Javascript. Note that the Blackhole exploit kit is responsible for this one. Here's a small part:


Small part of the code; you can see a file called Leh.jar and 2 of its classes



Leh.jar classes, which contains CVE-2012-4681 exploit code

There's an excellent article over at the Immunity blog which takes a closer look at the classes used in this exploit. Remember the classes are just a name, they don't indicate something particular (as far as I know):
Java 0day analysis (CVE-2012-4681)


Here's a link to the fully obfuscated Javascript on PasteBin:
http://pastebin.com/5FeC02UM

...and here's the same file, deobfuscated:
http://pastebin.com/P1Jy2qt1




Part 3 - the Trojan - Zeus/Zbot


I have used Revelo to deobfuscate the malicious Javascript, which now neatly shows our Trojan as well:


File called 3Wcg.exe will be downloaded and executed


When executing this file....:


...it crashed. Badly coded or Sandbox/VM aware

As you can see from the figure above, the sample crashed upon execution... Not much to do here.

Most probably your banking credentials and/or passwords would have been stolen, or you would be sending spam.

Some more information on the associated files:

bv6rcs3v1ithi.htm

Result: 13/42

MD5: 25b67f22490800881c4e13b15f7ac477

VirusTotal Report

Leh.jar

Result: 17/42

MD5: ddf9093ceafc6f7610dcc3fcf2992b98

VirusTotal Report

ThreatExpert Report

3Wcg.exe

Result: 26/41

MD5: df79dfd605eed6d578063089a48d670b

VirusTotal Report

ThreatExpert Report

Malwr Report

Conclusion

Same as one of my previous posts in regards to exploits:

Patch your third-party applications. In cases of Java and Adobe, remove them if unneeded.

Use an antivirus which has or uses behavioural technologies and/or exploit prevention.

Always check the URL of a link. you can verify this by 'hovering' over the URL to check what is really behind.

If you really have messages waiting for you on LinkedIn, and you're curious, just go directly to it by typing it manually in your browser. Delete emails from unknown senders and never open any attachments from them!

Use the add-on NoScript (Firefox) or NotScripts (Chrome) to prevent automatic loading of malicious Javascripts.

Adsense Earning Proof : Latest Google Adsense Earning Proof in Pakistan

Adsense Earning Proof : Latest Google Adsense Earning Proof in Pakistan

Google Adsense Nice Program

Published in Hakin9: Basic Malware Cleaning

I've been published in Hakin9, an IT Security magazine. I will be explaining the basics on how you can detect, identify and of course disinfect a machine from malware. Below is a small excerpt:

Malware is common nowadays. Each day, machines get infected with viruses, spyware, Trojans, keyloggers, rogueware, ransomware, rootkits.

The list continues with more advanced malware like Conficker, Duqu, Stuxnet, Flame.

The malware scenario on itself has also drastically changed.

Where in the past, malware was created for showing off your skills

or gaining your 15 minutes of fame (remember LoveLetter?), it is now almost solely used for the purpose of making money.

If you are reading this article, you have already helped someone getting rid of malware infestations, or you at least have an

interest in the basics on how to clean malware from an infected machine.

WHAT YOU WILL LEARN

• Identifying malicious processes, terminating these processes and how to properly prevent them from running

• Identifying malicious startup entries and system modifications

• Identifying related malicious files, meaning droppers and payload

• Identifying the malware source and effectively tackling it

WHAT YOU SHOULD KNOW

• Basic computer knowledge and common sense

• Use a proper environment for testing purposes

Besides my article (called "Basic Malware Cleaning"), the following articles will also be available in the E-book:

• Malware discovery and protection
• Malware analysis with Cuckoo Sandbox
• Malware Analysis
• KeyLoggers: Approaches and countermeasures
• Untold Story about Keylogger

As you can see, it's all about malware and how to analyse, detect and prevent or disinfect it. An interesting read for everyone, but especially for those who are (interested) in the field of Malware Research/Malware Analysis.

You can download the E-book from the following link:

Malware: From Basic Cleaning to Analysing