MSUpdater Trojan and link to targeted attacks

Dermot7 · Jan 31, 2012

This blog post is based on a joint report by Zscaler and Seculert (their blog post). Researchers from both companies separately identified attacks which used a remote access tool (RAT) malware that apparently targeted defense-related organizations. With joined forces, we analyzed the incidents that we observed and those published in the open-source to identify attack patterns and incidents from early 2009 to present.
Click to expand...

http://research.zscaler.com/2012/01/msupdater-trojan-and-link-to-targeted.html

Searching_ _ _ · Feb 2, 2012

Seculert and Zscaler identified similar command and control (C&C) beacon patterns. The most often observed are HTTP GET requests to the path:
/microsoftupdate/getupdate/default.aspx?ID=[num1]para1=[num2]para2=[num3]para3=[num4]

The malware attempts to stay under the radar of network security products by sending fake "Microsoft Windows Update" HTTP requests. Another malware participating in these attacks dropped a file named "msupdater.exe". Therefore, we have decided to refer to this threat family as the "MSUpdater" Trojan.
Click to expand...

Seculert Research Lab

Sneaky bugger.

J_L · Feb 2, 2012

Does it have a digital signature?

wat0114 · Feb 2, 2012

The threat arrives in phishing emails with a PDF attachment, possibly related to conferences for the particular targeted industry. The PDF exploits a vulnerability within Adobe (for example, a 0-day exploit was used against CVE-2010-2883) which then drops a series of files to begin communicating with the command and control (C&C).
Click to expand...

How to avoid: Don't open suspicious attachments and keep software updated.

The Trojan functionality is decrypted at run-time, and includes expected functionality, such as, downloading, uploading, and executing files driven by commands from the C&C.
Click to expand...

How to avoid: use a firewall with application control.

Nothing scary about this.

Log in or Sign up

MSUpdater Trojan and link to targeted attacks

Dermot7 Registered Member

Searching_ _ _ Registered Member

J_L Registered Member

wat0114 Guest

Log in or Sign up

MSUpdater Trojan and link to targeted attacks

Dermot7 Registered Member

Searching_ _ _ Registered Member

J_L Registered Member

wat0114 Guest

Useful Searches