Top 10 malware reported to Sophos in December 2006

PWS-LDPinch.dr!4f8fa1f

This is a password stealing trojan designed to send the local passwords to the trojan author.


Aliases
Infostealer.Ldpinch (Symantec) Trojan-PSW.Win32.LdPinch.aze ( Kaspersky ) TSPY_LDPINCH.KI (Trend Micro)
Characteristics
Characteristics -

This is a password stealing trojan designed to send the local passwords to the trojan author.

The trojan is delivered in the following filename.

Windows Vista All Versions Activation 21.11.06.exe (839,830 bytes) (detected as PWS-LDPinch.dr!4f8fa1f since DAT 4913)Upon execution, the following files are dropped.

%WINDIR%\csrss.exe ( 33760 bytes ) detected as PWS-LDPinch!6e51bf02
since DAT 4913 C:\Documents and Settings\%USER%\Local Settings\Temp\smss.exe ( 33760 bytes ) detected as PWS-LDPinch!6e51bf02
since DAT 4913 C:\Documents and Settings\%USER%\Local Settings\Temp\vista.exe innocent file C:\Documents and Settings\%USER%\Local Settings\Temp\tokens.dat C:\Documents and Settings\%USER%\Local Settings\Temp\pkeyconfig.xrm-ms C:\Documents and Settings\%USER%\LocalSettings\Temp\windows.vista.rtm.activation.crack-ind.txtThe following registries entries are added.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
"system" = "%WINDIR%\csrss.exe"
The trojan attempts to gather the following information.

SMTP Email address POP3 Server, UserName, Password IMAP Server, UserName, PasswordIt also gathers the password from the following applications.


  Read More Here...
 

Exploit-MSWord.b

Overview -

This detection covers malformed Word Document files that attempts to exploit a new Microsoft Word vulnerability. When opened in Microsoft Word XP or 2003, it causes a buffer overflow that can lead to arbitrary code execution in the targeted system.

Characteristics -

This detection covers malformed Word Document files that attempts to exploit a new Microsoft Word vulnerability. When opened in Microsoft Word XP or 2003, it causes a buffer overflow that can lead to arbitrary code execution in the targeted system.

McAfee Host IPS customers are proactively protected from this threat with sig 3754.

McAfee Avert Labs is currently investigating this threat. The vendor for the affected software has been notified for a security patch. More information will be posted here when available.

More details of this vulnerability at:

• http://vil.nai.com/vil/content/v_vul27249.htm

PWS-JO

Malware authors are using Skype to help spread a pair of Trojan packages.

The malware does not exploit flaws in Skype as such, as a computer worm might do, but spreads by tricking users into agreeing to run hostile code, which poses as a "cool program" from one of their contacts.

F-Secure reports that two different and separate malware samples are using Skype as an attack vector. One malware sample - called "sp.exe" - attempts to link to a site called nsdf.no-ip.biz to download additional malware components. The other sample of malware, first detected at the beginning of October, attempts to download components from marx2.altervista.org.

The websites used to download secondary malware samples have both been pulled since the attack was detected earlier this week.

Read more here...

BackDoor-CWA.dr

Chinese Hackers Launch New Office Attack

A Microsoft (NSDQ: MSFT) PowerPoint presentation circulating via e-mail is the latest example of a 2006 trend in which paid-for-hire Chinese hackers target Western businesses with malicious Office documents, a security researcher said Wednesday.
The newest threat, said Ken Dunham, director of VeriSign iDefense's rapid response team, hides within an apparently innocent PowerPoint slide show, "Christmas+Blessing-4.ppt," which is attached to an e-mail message. The PowerPoint file, which circulated sans exploits last year around Christmas, has been making the rounds since Sunday.

"The reality is that this is a very popular file," said Dunham, "and poorly detected by most antivirus scanners." However, some security companies, including F-Secure, have created signatures to sniff out the threat.

More important is that Christmas+Blessing-4 shares characteristics with the Office document-based attacks that began seven months ago. "This is very similar to other Office attacks from May and June," Dunham said. "It's a targeted attack, this time [against a company] in the public utility sector."

 

Read More Here...

W32/Dref-V