Analysis by: Anthony Joe Melgarejo
ALIASES:

Exploit:JS/Blacole (Microsoft), JS/Exploit-Blacole.gq !! (McAfee)

 PLATFORM:

Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

This Trojan may be hosted on a website and run when a user accesses the said website.

This is the Trend Micro detection for files that contain a malicious script.

  TECHNICAL DETAILS

File Size: 165,695 bytes
File Type: HTML, HTM
Memory Resident: No
Initial Samples Received Date: 14 Mar 2013
Payload: Connects to URLs/IPs, Downloads files

Arrival Details

This Trojan may be hosted on a website and run when a user accesses the said website.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

  • http://{BLOCKED}.{BLOCKED}.138.211/5bbf82700a13a31a3335b128b89880d7/5bbf82700a13a31a3335b128b89880d7/q.php?pf=2v:33:2w:1n:1m&ue=1i:31:32:1g:1n:1h:1l:1l:1n:31&t=1k&ur=f&sv=s

It saves the files it downloads using the following names:

  • %User Temp%\wpbt0.dll - detected as TSPY_FAREIT.MIR

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other Details

This is the Trend Micro detection for files that contain a malicious script.

It executes the downloaded file using the following commands:

  • %User Temp%\wpbt0.dll
  • regsvr32 -s %User Temp%\wpbt0.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

NOTES:

It checks for the following Devios and/or OS:

  • Windows
  • Mac
  • Linux
  • FreeBSD
  • iPhone
  • iPod
  • Windows CE
  • Windows Mobile
  • Pocket PC

It checks for the following browsers:

  • Gecko
  • Chrome
  • Safari
  • Opera

It checks for the versions of the following plugins:

  • Java
  • Flash
  • Adobe / Acrobat (PDF) Reader

It passes the parameters val and prime when the Java applet is loaded.

It adds an iframe with the following URL to vulnerable browsers when a vulnerable PDF plugin is detected:

  • http://{BLOCKED}.{BLOCKED}.138.211/5bbf82700a13a31a3335b128b89880d7/5bbf82700a13a31a3335b128b89880d7/q.php

It redirects an update download attempt to the following URL when a vulnerable Flash plugin is detected:

  • http://{BLOCKED}.{BLOCKED}.138.211/5bbf82700a13a31a3335b128b89880d7/5bbf82700a13a31a3335b128b89880d7/q.php

  SOLUTION

Minimum Scan Engine: 9.300
FIRST VSAPI PATTERN FILE: 9.790.06
FIRST VSAPI PATTERN DATE: 15 Mar 2013
VSAPI OPR PATTERN File: 9.791.00
VSAPI OPR PATTERN Date: 15 Mar 2013

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Close all opened browser windows

Step 3

Remove malware/grayware files dropped/downloaded by JS_BLACKOLE.MIR

    • TSPY_FAREIT.MIR

Step 4

Scan your computer with your Trend Micro product to delete files detected as JS_BLACKOLE.MIR. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.

Related Malware