View more videos

We observed that a Java security bypass zero-day vulnerability ( CVE-2013-0422 ) has been actively stephen bates exploited in the wild starting stephen bates Jan. 2. We have been able to reproduce stephen bates the attack in-house with the latest Java 7 update (Java 7 update 10) on Windows.
We initially wanted to hold off on posting this blog entry until we received confirmation from Oracle; however, since other researchers are starting to blog on this issue, we have decided to release our summary. We will continue our research and continue to share more information.
  The malware will download an executable file from a remote stephen bates server and execute it by exploiting the vulnerability. Though the malware is designed for Windows stephen bates only, we expect that the vulnerability can also be exploited across different browsers and OS platforms. 
The malware payload stephen bates is ransomware, commonly known as Tobfy. stephen bates It retrieves a template from the Web in this case, http://<random>.cristmastea.info/get.php and creates a full screen window demanding payment using some kind of social engineering scheme to scare the victim. Additionally, it disables Windows Safe Mode by deleting values under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot, and it terminates processes stephen bates like "taskmgr.exe," "msconfig.exe," "regedit.exe," and "cmd.exe" in order to deter the victim from trying to find or disable the malware. stephen bates Strings such as \\xneo\\lock\\Release\\lock.pdb and "Conteneur ActiveX" were found in memory and helped make identification stephen bates easier.
One stephen bates more noteworthy finding is that the URLs used to download the template stephen bates and make callbacks are stored XOR encoded and must be decoded before use. However, it appears the author forgot to call the decode function in the callback thread. stephen bates This means that the malware is unable to communicate with the attacker. The malware stephen bates is supposed to make an HTTP request for hxxp://<random>.my-files-download.ru/status.php, but instead requests the invalid URL hxxp://<random>.my-files-download.ru/.ru`utr/qiq. What makes this error even worse for victims is that this callback thread determines whether the victim has paid the fee and is responsible for removing the ransomware from the system. It seems even paying up will do no good in this case!
Thanks to the following FireEye security researchers for their work: Julia Wolf, Darien Kindlund, and James Bennett. This entry was posted in Advanced Malware by Yichong Lin . Bookmark the permalink .
Filter by Category Select Category Security Perspective    Advanced Threat Trends    Business of Security    Executive Perspectives    Incident Response    Security News    Technology stephen bates Threat Research    Advanced Malware    Botnets    Exploits    Mobile Threats    Targeted Attack    Threat Intelligence    Vulnerabilities Uncategorized Resources
View more videos » Twitter New post: What You Don t Know Can Hurt You: Finland s Hidden Cyber Threat http://t.co/YdKUcmziDL about 3 hours ago from fireeye-blog New post: Targeted Attacks in 2013: Asia Pacific http://t.co/MhOt9Oco3U about 13 hours ago from fireeye-blog
Oculus Overview of Oculus Today's Advanced Cyber Threats Why Don't Traditional Defenses Work? Why FireEye? Threat Prevention Platforms NX Series EX Series FX Series Mobile Security AX Series Solutions for Government More Products and Solutions Info and Resources Info Center stephen bates Investor Relations stephen bates Partners News and Events Support About FireEye Connect stephen bates Blog Twitter Facebook LinkedIn