Spymel Info-Stealing Trojan Evades Antivirus Detection via Stolen Certificates

[Exterminator]

Content source

http://news.softpedia.com/news/spymel-info-stealing-trojan-evades-antivirus-detection-via-stolen-certificates-498683.shtml

Zscaler, a US-based cyber-security vendor, has discovered a new trojan, one that spreads via spam email and uses digital certificates to infect computers and remain undetected from security products.

Named Spymel, the trojan first reaches computers as an archive file attached to emails. If downloaded and decompressed, the archive file launches into execution a JavaScript file that downloads and installs the actual malware executable, a .NET binary.

Because the archive file does not contain the malware, antivirus products fail to flag it as dangerous. Additionally, the .NET binary also evades detection by using a digital certificate (probably stolen) issued via DigiCert to a company called SBO INVEST.

Zscaler reports that the first wave of Spymel infections was detected in early December 2015. As soon as Zscaler reported the case to DigiCert and had the certificate revoked, the group behind Spymel quickly updated their certificate in a matter of two weeks, using a different certificate, also issued to SBO INVEST. This latter certificate was also revoked after Zscaler detected it and informed DigitCert.

Spymel can also work as a payload downloader
As for its actual capabilities, this trojan is a classic infostealer that infects hosts, identifies their hardware and software settings, gets in contact with a C&C server, and awaits instructions on what to steal.

According to Zscaler, Spymel can make screenshots of a user's desktop, record videos of the desktop, log keystrokes, and upload stolen data to a remote server.

Additionally, Spymel can also act like a malware payload downloader, being able to fetch and launch other files on the system while also being capable of uninstalling itself.

Spymel also employs more sneaky tricks
Besides using digital certificates to hide from antivirus software, Spymel also has some extra tricks up its sleeve. The trojan comes with a module called ProtectMe, which, when loaded, has the ability to prevent the user from terminating the malware's process via the taskkill shell command and tools like Process Explorer, Task Manager, and Process Hacker.

Zscaler researchers say that Spymel's C&C server is located somewhere in Germany, at android.sh (213.136.92.111), on port 1216. This is probably a rented server, and its owner's real location is somewhere else.

Spymel is a perfect snapshot of today's malware ecosystem, where malware many times uses archive files boobytrapped with JavaScript code and digital certificates to hide.

 

[Deleted member 178]

more and more the need of a deny-default softwares that don't relies on certificates is obvious.