{"id":84523,"date":"2017-07-21T19:58:15","date_gmt":"2017-07-21T14:28:15","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=84523"},"modified":"2017-07-21T20:19:06","modified_gmt":"2017-07-21T14:49:06","slug":"nemucodaes-malspam-back-time-brought-along-kovter-trojan","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/nemucodaes-malspam-back-time-brought-along-kovter-trojan\/","title":{"rendered":"NemucodAES malspam is back and this time it brought along Kovter Trojan"},"content":{"rendered":"

For the last few weeks, we have been observing a new malicious spam (malspam) variant that is spreading via an email claiming to be from the United Parcel Service (UPS) carriages. The email carries a zip attachment that contains NemucodAES Ransomware and fileless Kovter Trojan.<\/p>\n

Earlier, such malspam campaigns were delivering Cerber Ransomware and Kovter Trojan.<\/p>\n

Attack Methodology <\/strong><\/p>\n

Step1 –<\/strong> The user receives a spam email with a malicious zip that contains a JavaScript file.<\/p>\n

\"nemucod1\"
Fig 1. Spam email<\/figcaption><\/figure>\n

Spam emails sent in this campaign usually contain the below subject lines and attachment names to trick the user into opening the email.<\/p>\n

 <\/p>\n\n\n\n\n\n\n\n\n\n\n
Subject Lines<\/strong><\/td>\nAttachment Names<\/strong><\/td>\n<\/tr>\n
***INFECTED*** Problems with item delivery n.004640147<\/td>\nUPS-Package-004640147.zip<\/td>\n<\/tr>\n
***INFECTED*** Problems with item delivery n.001656569<\/td>\nUPS-Label-001656569.zip<\/td>\n<\/tr>\n
Parcel ID004692898 delivery problems please review<\/td>\nUPS-Receipt-004692898.zip<\/td>\n<\/tr>\n
We could not deliver your parcel #004522553<\/td>\nUPS-Delivery-004522553.zip<\/td>\n<\/tr>\n
Our UPS courier can not contact you (parcel #008284689)<\/td>\nUPS-Parcel-ID-008284689.zip<\/td>\n<\/tr>\n
Notification status of your delivery (UPS 5952930)<\/td>\nUPS-Delivery-Details-5952930.zip<\/td>\n<\/tr>\n
Notification status of your delivery (UPS 001387092)<\/td>\nUPS-Package-001387092.zip<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00a0<\/strong><\/p>\n

Step2 – <\/strong>JavaScript execution<\/p>\n

The JavaScript file has a long variable which is used to download \u201ccounter.js\u201d files from compromised websites. This \u201ccounter.js\u201d is responsible for switching into embedded PHP and download its PHP interpreter files which are, in turn, responsible for encryption.<\/p>\n

 <\/p>\n

\"Fig
Fig 2. Malicious JavaScript<\/figcaption><\/figure>\n

 <\/p>\n

\"Fig3:
Fig 3: Dropped files at %temp% location<\/figcaption><\/figure>\n

After execution, files are encrypted without any extensions or name change. For encryption, a mix of AES-128 in ECB mode and RSA encryption algorithms are used in order to make the decryption of files more difficult.<\/p>\n

After encryption, the below ransom note is displayed.<\/p>\n

\"Fig
Fig 4. Ransom note<\/figcaption><\/figure>\n

Along with with Nemucod Ransomware, the user\u2019s computer is infected with the Kovter fileless malware. Kovter hides in the Windows registry which is used in campaigns that generate fraudulent clicks on online ads to make money for the attacker.<\/p>\n

\"Fig
Fig 5. Kovter registry entry<\/figcaption><\/figure>\n

How Quick Heal helps<\/strong><\/p>\n

1. Quick heal Email Protection<\/strong> successfully blocks such malicious attachments even before they infect the system.<\/p>\n

\"Fig
Fig 6. Quick Heal Email Protection<\/figcaption><\/figure>\n

2. Quick Heal Virus Protection <\/strong>successfully detects and deletes the malicious script file used in the attack.<\/p>\n

\"Fig
Fig 7. Quick Heal Virus Protectio<\/figcaption><\/figure>\n

3. The below graph shows the trend of the spam emails we received from 1st<\/sup> to 16th<\/sup> July 2017.<\/p>\n

\"Fig
Fig 8<\/figcaption><\/figure>\n

Security Tips<\/strong><\/p>\n

    \n
  1. Do not click on links or open attachments received in unexpected and unknown emails<\/li>\n
  2. Do not open files with double extensions (e.g. doc.js, wsf.js, etc.)<\/li>\n
  3. Avoid clicking on pop-up ads, especially those that talk about unbelievable offers<\/li>\n
  4. Avoid visiting less-popular websites<\/li>\n
  5. Keep your computer\u2019s Operating System and software such as Adobe, Java, Internet browser, etc., patched and up-to-date<\/li>\n<\/ol>\n

     <\/p>\n

    Acknowledgment<\/strong><\/p>\n

      \n
    • Subject Matter Expert<\/strong>
      \nPrashant Tilekar, Swati Gaikwad | Quick Heal Security Labs<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

      For the last few weeks, we have been observing a new malicious spam (malspam) variant that is spreading via an email claiming to be from the United Parcel Service (UPS) carriages. The email carries a zip attachment that contains NemucodAES Ransomware and fileless Kovter Trojan. Earlier, such malspam campaigns were delivering Cerber Ransomware and Kovter […]<\/p>\n","protected":false},"author":29,"featured_media":84533,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-84523","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84523"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/29"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=84523"}],"version-history":[{"count":4,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84523\/revisions"}],"predecessor-version":[{"id":84537,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/84523\/revisions\/84537"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/84533"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=84523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=84523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=84523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}