Published:
June 16 2009, 11:22 AM
by
Rossano Ferraris
It’s been awhile since I saw a fake update email which looked like it came from Microsoft security laboratories. Some people complained to me about a strange email that asked the user to update their machines because of a recent outbreak of the well-known Conficker worm (see Figure 1 and Figure 2).
Figure 1 - Fake Email (part 1)
Figure 2 - Fake Email (part 2)
Let’s take a look at the body of this email, which is very well written and uses persuasive language. The lure in the message is a Microsoft removal tool that will scan and clean the user’s machine.
However, I notice a phrase that says “you are advised to disable your already existing antivirus software.” My spam email reveals itself when I move my mouse pointer over the link “click here to download the removal tool” and I discover that the URL redirects the browser to a Russian server (windowsupdate.microsoft.com.ssl3.pop3.ru), which hosts the remtool_conf.exe.
If we look at the header, we see the following:
Figure 3 - Email Header
The email comes from a certain Microsoft[dot]ssl[dot]com whose IP address is 38.100.66.185. This IP address originates from a server which is located in Texas and is not a Microsoft server.
During the analysis, I download and install remtool_conf.exe:
Figure 4 - Removal Tool License
Then I click on “Accept” and the tool - which seems to belong to Symantec - starts to scan my machine:
Figure 5 - Removal Tool Software
The fake software scans the entire machine, and establishes a hidden connection to the host makemymoneys.com (Figure 6) from which it attempts to download and install the malicious file winupdate.exe, which is detected by CA Security products as “DelfInject CX.”
Figure 6 - makemymoneys.com host hidden connection
CA Security products detect the fake removal tool as “FakeScan A” warning against it and have the ability to remove it.
Although there has been a decrease in the number of fake Microsoft update emails, the current fake emails are more sophisticated and use a very high profile social engineering technique to lure and trap people. The CA Research team advises users to be aware of these types of spam message and to update their anti-malware products on a daily basis.