12345

5/04/2011

[Warning] Detected malicious file disguised as a "ALYAC" file

1. Introduction

Emerging malicious file disguised as "ALYAC", free Anti-Virus software, from ESTsoft make user special attention for whom especially using this "ALYAC".
Since this malicious file has similar icon and description, general user can be easily infected.

To prevent from those malicious files, spend some times to maintain about your PC's availability.

In case of being found malicious file disguised as "ALYAC" at 3.3 DDoS, it doesn't have DDoS function, however, lately found malicious file contains DDoS function.


2. Spreading path and symptoms of infection

First of all, recently found malicious file, known as spreading from following URL, can also be spread as an attachment of e-mail.

* Malicious file disguised "ALYAC" spreading path(Currently not available.)

- http://(~~).info/(~~)/100.exe

Actually first distributed URL is found from United Kingdom. But with some reasons including manual written in Korean, we can expect that the developer chose UK as a first distribute place.

  
After downloading and installation, it removes itself, makes clone to this following path, and configures always running while Internet Explorer is being run.

* Generated file
- C:\Documents and Settings\explorerere.exe (52,224 bytes)


* Registers registry value
- [HKLM\SYSTEM\CurrentControlSet\Services\zvwerqt]
- Name : ImagePath
- Data : "C:\Documents and Settings\explorerere.exe

Generated copy continuously tries to access this following URL, and can download additional malicious file. In addition, we expect that generated malicious file can perform as a Backdoor and Bot on registered service level. Currently additional analysis is on the way.



It forged not only the icon but description of "ALYAC". To inspect it deeply, however, you can distinguish between normal and forged description.



                     <Malicious file>                                                      <Normal file>

You can find this difference between malicious and normal file on looking up that red box above.

* Difference

- Normal file : Describes modules' function in "ALYAC"
- Malicious file : Describes function in "ALYAC"

In addition, it can send GET Packet to certain destination continuously with using "GET Flooding" technique, one of DDoS attacking methods.



3. How to prevent

General user can download without doubt. If infected, it can make a lot of zombie PC. Therefore, to use PC safely from security threats of these malicious attachments, we recommend following "Security management tips" for general users.

Security management tips

1. Maintain the latest security update on OS and applications
2. Use anti-virus SW from believable security company and keep updating the latest engine and using real time detecting function
3. Do not see and download attached file from suspicious e-mail.
4. Keep caution to link from instant messenger and SNS.

INCA Internet (Security Response Center / Emergency Response Team) provides diagnosis/treatment function with nProtect Mobile for Android for mobile such as malicious file stated above and runs responding system against various security threats.

No comments:

Post a Comment