Home / mailings

PDF

WSLabs, Malicious Code: World Bank Deception: Trojan Horse

Posted on 29 October 2007
Websense Security Lab

Websense® Security Labs(TM) has discovered a new Trojan horse using real data from the World Bank. As in past targeted attacks, the samples that we have captured appear to be using names and email addresses taken from the contact pages of the legitimate site. In this case, the email body includes the name of a real World Bank employee.

The message reads:

Subject: WorldBank report
Dear Colleagues,

This three-year Country Partnership Strategy (CPS) builds on Bulgaria's considerable achievements over the last eight years ..

*snipped for brevity*

.. and the surveillance roles played by the International Monetary Fund (IMF) and the EU's Stability and Growth Pact upon Bulgaria's EU accession.

At the following link you'll find our report:

http://<URL REMOVED>/

Thank you!

Best Regards,
Ivelina Taushanova
Associate Professor of Management Science
<USERNAME REMOVED>@worldbank.org
http://WorldBank.org

The link leads to the malicious executable WorldBank_doc_36146.txt.exe, which is displayed with the standard notepad.exe icon. Unless the user has configured Windows to explicitly show the file extension (which most people do not, since it requires changing the default configuration), there is no way to visually tell that this file is actually an executable. When run, the initial executable drops a plain text document with information from a real World Bank document, displayed in IE. Also dropped is a packed Trojan horse (bifrose) whose file name makes it appear to be an MSN Messenger plugin.

When this article was created, no anti-virus vendors detected the initial executable as malicious.

The initial executable downloaded by the victim does not actually make any outbound connection from the victim's desktop to obtain the two dropped files. Because both dropped files are derived from the initial executable, no suspicious network traffic is generated. The dropped Trojan horse (msnmsgr_plugin.exe) maintains a persistent connection to a host name on the dyndns.org domain.

Screenshot available within full alert.


For additional details and information on how to detect and prevent this type of attack:
http://www.websensesecuritylabs.com/alerts/alert.php?AlertID=812

 

TOP