Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: Even Bad Malware Works - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Even Bad Malware Works

For a few weeks now, I keep receiving a few "Delta Ticket" e-mails a day with zipped executables as attachments. The e-mails are done about as bad as it gets:

  • The "From" address uses a random domain
  • The e-mail does not use the typical "Delta" formating/branding.
  • The attachment is a straight executable, just zipped.
  • Antivirus is ok on a new sample received right now (8/55 according to virustotal) and excellent (>30/55) on older samples. [1]
  • The e-mail (flight information) is very specific and does not appear to be customized to the sender
  • Delta doesn't send tickets as attachments like this.

Fake Delta Ticket e-mail

So they could do a lot better. The sad part is, that they apparently have no need to do better.

The "From" name, which is what most people are looking at, reads "Delta Air Lines". Some major/popular AV tools still don't detect it well at all, and well, users like to click on stuff I guess.

The initial piece of malware appears to be a generic downloader. In my system, it installed what looked like a fake Adobe update. Still running it to see what is exactly going on, but not expecting too much.

 

[1] https://www.virustotal.com/en/file/4cf652e71bbbe37eecda58169471df27db15ca1e5a8f14006128a4883b095409/analysis/1410799974/
 

 

 

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

I will be teaching next: Defending Web Applications Security Essentials - SANS San Francisco Winter 2019

Johannes

3653 Posts
ISC Handler
I got one from the Bank of Africa say I was being awarded a 2.5 million check.

I was supposed to reply to a Gmail account?

Bank of Africa uses Gmail?
Anonymous
I've seen similar delivery method (.exe in a .zip file) as a vector for major breaches at allegedly secure institutions. If your systems allow an average user to run executable code from arbitrary locations (e.g. Outlook temp directory, zip file (or zip temp directory) in their documents directory, etc.) then you're not serious about security. Of course, our typical computer systems allow this by default, and in fact don't make it easy to disable.

Software restriction policies in Windows, however, has a lot of the qualities that are needed (e.g. free, built-in).
packetdude

22 Posts
I've seen similar delivery method (.exe in a .zip file) as a vector for major breaches at allegedly secure institutions. If your systems allow an average user to run executable code from arbitrary locations (e.g. Outlook temp directory, zip file (or zip temp directory) in their documents directory, etc.) then you're not serious about security. Of course, our typical computer systems allow this by default, and in fact don't make it easy to disable.

Software restriction policies in Windows, however, has a lot of the qualities that are needed (e.g. free, built-in).
packetdude

22 Posts

Sign Up for Free or Log In to start participating in the conversation!