In the last few days Certego identified and analyzed a new spam campaign that targeted italian domains. This campaign is spreading a variant of the Dridex financial malware which is loaded with operational intelligence that is effective against many Italian banks. Dridex is not new nor original software, as it belongs to the famous Zeus family, being derived from one of Zeus descendant known as Cridex or Feodo. It uses a command and control system based on traditional web servers via plain HTTP. The spreading technique itself is not particularly sophisticated, as it uses an Office document, in this case an Excel file, that is attached to spam email messages. The document contains a series of VBScript macros, which execution is usually disabled by default in Office products, just because in the past the same method was widely used to convey malicious programs. It therefore seems even more surprising that, despite the notifications that alert the user about the potentially dangerous consequences of their actions, this block is voluntarily removed to be able to open the attachment. Once again the most basic social engineering techniques are enough to induce a careless behaviour that can have very serious consequences.
The campaign analyzed by Certego uses email messages in English, with the subject "Order T / N: CL0943_744". One of the sender is "Mariana Holland, State Department <firstname.lastname@example.org>". The body of the email is as follows:
"Your order is ready for collection at your chosen store.View full order details T / N: CL0943_744 in attached document."
The attachment is an excel file containing different macros, a sequence of statements in VBScript that have the task of downloading the malware itself from a public site and of running it. Macros are heavily obfuscated in an attempt often successful of circumventing antivirus checks. The following image shows the VBScript procedure used to execute a command using the system shell.
As we see, the command is a heavily obfuscated string, which is processed by a further subroutine that returns the cleartext version of the command to be executed. This second subroutine, from wich we have removed some jump code for clarity, is shown in the following screenshot.
This function only takes the odd characters of the obfuscated string, and the end result is visible in the last image below.
The macro downloads a file "sspidarss.cab" from the IP address 134.19.180 [.] 144, then decompresses it and launches the executable content.
Once installed on your system Dridex uses, like all other Zeus variants, a configuration file that contains the "instructions" on the actions to take when it detects that a browser on the infected machine is visiting a specific web page belonging to a targeted bank. In the latest sample we analyzed, as we posted Friday on Twitter and Pastebin, there were about forty new Italian targets , including some major banks and e-commerce portals.
Dridex can intercept communications with your home banking portal, and possibly steal login credentials or manipulate transactions in order to commit fraud. The only effective defense is a sufficient awareness and preparation of users, that must avoid the opening of suspicious attachments. In the case we have shown, the email you may receive in your inbox should ring many alarms: it comes from an unknown and implausible sender, it refers to a purchase you have never done, and it requires you to disable Office macros protection in order to be able to open the attachment. If you already fell to the trick and became infected, you must be aware of unnecessary sensitive data that your usual home banking portal may ask you to input at login or during transactions.
Certego Threat Intelligence can help the affected institutions to identify suspicious transactions carried out by malware compromised devices and block fraud transactions.