ZeuS Downloader Runs in January, Crashes Rest of the Year

A few weeks ago, we received a rather unusual malicious attachment, which we detect as TROJ_UPATRE.SMAI. This particular attachment, when uncompressed and executed, displays the following error message:

Figure 1. Error message

At first glance, this may lead users to think it is not malicious. However, if we look into its code, one item stands out: it checks for the system time.

Figure 2. Malware code

Looking further, what we found was interesting: the value of the month has been added to a specific memory location, which is in turn contains the memory address and decryption key of code this malware needs to proceed. However, this will only return correct results when it is January.

Figure 3. Code for decryption

Figure 4. Incorrect result

Figure 5. Incorrect result

The images above show the decryption routine of this malware and the possible results. The decrypted string in Figure 4 is unreadable, since the system time of the machine is incorrect. This causes the error message to be displayed.

However, in Figure 5, when the system’s clock has been set to January, the correct address is retrieved and execution proceeds as normal, leading to its payload (a ZBOT variant, detected as TSPY_ZBOT.ADXK).

Beyond this date-checking routine, this spam run and payload is not particularly unusual. It arrives either as a fake fax or document submission message. All other behavior of TROJ_UPATRE.SMAI is consistent with UPATRE malware, which has become a very common threat to arrive via email since September 2013.

Both the spam messages and the malicious attachments used in this attack are now blocked by the appropriate Trend Micro products.

Additional information by Merianne Polintan.

Post from: Trendlabs Security Intelligence Blog – by Trend Micro

ZeuS Downloader Runs in January, Crashes Rest of the Year