Method of Infection
Win32/Bredolab.SU usually arrives as a malicious attachment on a spammed email message masquerading as a password reset confirmation email from Facebook.
The email contains the following Subject:
"Facebook Password Reset Confirmation"
The email contains the Body:
-----------------------------------------------------------------------------
Hey ,
Because of the measures taken to provide safety to our clients, your password has been changed.
You can find your new password in attached document.
Thanks,
The Facebook Team
-----------------------------------------------------------------------------
The email contains a malicious zipped file attachment with the filename Facebook_Password_{random-characters}.zip. This file is detected by CA as a Win32/Bredolab.SU.
Below is an image of a sample email.
Back to top
Payload
Win32/Bredolab.SU connects to the malicious server "mmsfoundsystem.ru" to download other malicious files. The malware saves the downloaded files in the Windows %Temp% folder as wpv{Random Numbers}.exe and then executes them. The downloaded files could vary, depending on what is on the malicious server at the time of download.
The trojan drops two dlls: %WINDOWS%\dawmcl.dll and %SYSTEM%\beghghk.dll. It hooks the second dll into the iexplore.exe process.
It creates a file "sdra64.exe" in %APPDATA% folder and then appends the location of this file to the following registry entry so that it runs every time Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
"USERINIT" = "%SYSTEM%\Userinit.exe, %APPDATA%\sdra64.exe"
The Trojan also hooks itself into the explorer.exe process and starts the svchost.exe process.
Note:
%System% is a variable location. The malware determines the location of the current System folder by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95, 98 and ME is C:\Windows\System; and for XP and Vista is C:\Windows\System32. %Temp% is a variable location similar to %System%. The default location is C:\Windows\Temp. %Appdata% is a variable similar to %System%. The default location is C:\Documents and Settings\{Username}\Application Data.
Analysis by Krishna Kona
Back to top