Malicious bulk e-mail - "SecuryTeam Order"

Eric the Red · October 26, 2005, 01:34:46 PM

The United Kingdom CERT UNIRAS have today received a number of incident reports about a malicious bulk e-mail.
The e-mail has the subject line "SecuryTeam Order #117457 will be processed manually by our staff.txt" and appears to relate to an order for "KEZAAM! Software distribution service". The e-mail contains the URL of a webpage, which if followed may point to another page that attempts to download and execute malicious software on the user's system.

The following is an alert written by AusCERT which contains further details about the e-mail and provides mitigation advice. UNIRAS considers it likely that the details of the e-mails and URLs involved to change in the future, but the mitigation advice will still be valid:

Quote
===========================================================================
A U S C E R T A L E R T

AL-2005.0037 -- AUSCERT ALERT
"KEZAAM! SecuryTeam Order" e-mails and malicious web site
25 October 2005

===========================================================================

AusCERT Alert Summary
---------------------

Product: Windows
Impact: Access Confidential Data
Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated

Overview:

AusCERT has become aware of fraudulent e-mails circulating widely to
Australian recipients. The e-mails entice users to visit one several
malicious web sites, which in turn point back to:

http: // friendsoftheenemy.net

This web site contains several browser-based exploits to facilitate the
downloading of malware. The Trojan then attempts to install a keylogger to
facilitate the capture of secure credentials.

Mitigation:

This exploit requires user interaction - deleting these e-mails as they
arrive and not clicking on any links they contain is a safe mitigation
strategy.

Ensuring your computer is up to date with the latest windows patches,
particularly those fixing vulnerabilities in Internet Explorer. Also,
allowing scripts to execute from trusted sites only will offer protection
against exploitation by this web site.

The exploits on this site specifically target Internet Explorer, so using
an alternate browser will also offer protection against exploitation by
this web site.

Updated antivirus signatures may allow detection of this threat. AusCERT
recommends regular updating of virus definitions to ensure the maximum
level of protection available from such threats.

For more information regarding protecting your computer from malicious
code see:

http://www.auscert.org.au/3352

Details:

AusCERT has seen several different types of e-mail messages, attempting to
entice the reader to a variety of domains including:

http: // compaqhea.shrink.com/info.html
http: // friendsortheenemy.net
http: // healthcentretoronto.com
http: // uh.gameage.co.uk
http: // chamas.cl/info.html
http: // abomagd.com/info.html
http: // belgiumlive.hostmatrix.org/info.html
http: // bluecalf.com/info.html
http: // buenconsejo.cl/info.html
http: // fondby.com/info.html
http: // 6abari.net/info.html
http: // al-barakah.org/info.html
http: // megacontable.com/info.html
http: // ohiohsfootball.net/info.html
http: // wakeee.hostmatrix.org/info.html

All of which are redirected back to:

http: // friendsoftheenemy.net

This site, installs additional malware which may also contact the hosts:

khaliun.phpwebhosting.com
domestictargetmarket.com
xtrixasf.com
palac-below.de

Administrators may wish to actively block or monitor access to these domain
names and URLs.

Below is an example of the malicious e-mail:

---- start example e-mail ----

From: [various]
Subject: SecuryTeam Order #117457 will be processed manually by our staff.txt

Thank you for your order (#117457).
We will manually process your order and contact you soon by phone or email

Below you can find the summary of the order:

KEZAAM! Software distribution service

746 Comalli Street, Laguna Niguel
CA 92677, USA

Purchased at http://[various]/info.html
- - ---------------------

Order id: #117457
Order date: 20.10.2005 03:21
Order status: Q

Total:
- - -------
Payment method: Credit Card
Subtotal: EUR 164.95
Discount: EUR 0.00
Coupon saving: EUR 0.00
Shipping cost: EUR 0.00
Tax: EUR 0.00

Total: EUR 164.95 | (USD 199.59)

- - --
Thank you for your interest in our products.

Best regards, SecuryTeam!

---- end example e-mail ----

AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at:

http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================

- -----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQ13Rtih9+71yA2DNAQICNAP/VOISQS7W7HCaBy4U52oHmiT6BsJwVSQQ
iehZh/Z+f7Os+WJj7V2O5AMUkZ6+zihhyQ+cr/SdwKMR/7dnAAMF2AIgjOFTToDN
iuG9TqYntYGXUwOkvpuHAKGHMNiSJJm6BBeLi2mbCNqZ5k/2bw0RYN3txw8JrBUO
XKGEehiZElI=
=GzMz
- -----END PGP SIGNATURE-----

Malicious bulk e-mail - "SecuryTeam Order"

Eric the Red