Zeus wants to do your taxes

Published: 2010-03-25
Last Updated: 2010-03-25 20:44:53 UTC
by Kevin Liston (Version: 2)
0 comment(s)

I've received reports of suspicious emails claiming to be from the IRS.  It's a common scheme to get a user to click and run an executable.

It looks like zeus/zbot to me (more on that here: https://zeustracker.abuse.ch/faq.php their cert is a little non-standard,) but I can't share the details yet.  If you've received one of these emails and don't mind sharing the details with our readers, please submit a copy (via: http://isc.sans.org/contact.html

 The email looks something like (thanks for sharing Michael!):

Subject: Underreported Income Notice
Taxpayer ID: <recipient>-00000198499136US

Issue: Unreported/Underreported Income (Fraud Application)

Please review your tax statement on Internal Revenue Service (IRS) website (click on the link below):

Internal Revenue Service


 The download in this particular link was "tax-statement.exe."

If you want to check out your own logs to catch this and similar attacks, I'd suggest looking for domains that look like www.irs.gov.<stuff> and downloaded executables with the word "tax" in them.

For those with enough free-time to try to track the different groups using zeus, this one has an Avalanche feel to it.

Keywords: zbot zeus
0 comment(s)

Responding to "Copyright Lawsuit filed against you"

Published: 2010-03-25
Last Updated: 2010-03-25 17:11:24 UTC
by Kevin Liston (Version: 1)
3 comment(s)

The Scenario:

 Let's say you're responsible for responding to an email like that reported here: https://isc.sans.org/diary.html?storyid=8497


Is this email a problem?

It certainly appears to be appealing to the recipients fears with the scary legal language.  There's a typo or two in there that might make you suspicious.  Real or not, a document like this should be brought to the attention of your security/legal departments.  So it's likely a problem of one sort or another.

What is it?

You could start by checking into the source of the email and the domain hosting the link.  In this case, the originator appears to be a mail-server for a small city.  The domain has been around for nearly a year, but was just updated a few days ago.  Domaintools.com is your friend.

If you're equipped for it, you may ant to start by checking out the document by pulling down to a safe machine.  In my case it's a unix box since it appears to be a word document.  I craft a simple wget script to pull the file down looking like a vulnerable version of IE.

wget --save-cookies=./cookies -U "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322)" $1

Curiosity getting the better of me, I look at the file a bit and see:

{rtf1ansiansicpg1252deff0{fonttbl{f0fswissfcharset0 Arial;}}
{*generator Msftedit;}viewkind4uc1pardlang1033f0fs20{objectobjemb{*objclass Package}objw795objh765{*objdata

Yeah, that doesn't look good.  Let's calculate an md5sum and see what others think of it.

$ md5sum suit_documents.doc
6db76304a2aff6bef94364b86abd8b7f  suit_documents.doc

 Since you're a lone responder and don't have an army of reverse engineers on your staff, we'll leverage this information to see what the group-mind knows about this.

I use the hash-search at virus total to see if someone's already working on this: http://www.virustotal.com/buscaHash.html

In this case, this yields the following results: http://www.virustotal.com/analisis/9b762ff9d2103022bf1476f2c55db91475f31526522716e827875801f92a0d87-1269529133

Some interesting things come back, we know that this is likely some sort of downloader disguised as a document.

I'll also search through http://www.threatexpert.com/ by the md5sum to see if it has already been analyzed.  In this case it hasn't.  I could ship it off there for analysis or one of the other fine sandbox tools such as Anubis (http://anubis.iseclab.org) or CWSandbox (http://mwanalysis.org/)

Looking at the earlier diary entry we see results from Anubis showing some network activity.  Now we have a couple of things to look for to measure impact:

  • Email details to search our mail-logs to determine who received the lure message.
  • The URL of the initial downloader to see who clicked on it and brought it into the network.
  • The network behavior of a system that executed the code.

How bad is it for us?

Using those details it's time to evaluate the impact this attack has had on your firm.  If you have anyone who downloaded the file, or evidence of a machine reaching out for the next-stage then you pull your Malware Incident response document off of the shelf and follow that.  We all have differing levels of documentation to refer to, but there's always some sort of plan, even if it's "update resume."


While you're assess the impact (greps take a while to run sometimes) you have some information that you can leverage to protect the people in your network.  You have email addresses and URLs to block and malware to submit to your vendor (assuming they're not on the virustotal list like mine wasn't.)  Acting quickly on this protection phase makes your clean-up phase go easier.


Now that you have your list of machines that were exposed and your Malware incident response document handy, you follow that to make your systems and network all shiny and clean.


This step is important. 

In my environment, my boss likes to know what it is that I'm doing in the dark data closet.  So keeping track of the event, it's impact, etc. is good for not only tracking the incident, but also review time.

When you were researching the IP that sent the email and hosting the URL (you still have that up in a browser, right?) it is also critical that you report that to the abuse contacts.  Send a kind email reporting the issue, (because they'll likely get a few reports, and most of them might not be so kind.) which helps more than just your own environment.

 Learning from Others/Helping Others

You will want to follow a similar process in response to events reported here and in other blogs and media.  It not only helps protect you from what is hitting other folks, but you may also uncover a gap in your internal detection process.

By submitting malicious URLs to proxy-filter vendors, and malware to AV vendors you help protect not only your environment, but also your neighbors.  If fewer of your neighbors are getting infected, then that's fewer spam-bots, and phishing-sites the eventually target you.

Keywords: response
3 comment(s)

"Copyright Lawsuit filed against you"

Published: 2010-03-25
Last Updated: 2010-03-25 13:30:36 UTC
by Kevin Liston (Version: 1)
5 comment(s)


An email is being sent out warning the recipient of a "Copyright Lawsuit filed against you."  We received a copy here and a number of .EDUs have reported it's receipt.  It looks something similar to:

March 24, 2010
Crosby & Higgins
350 Broadway, Suite 300
New York, NY 10013

To Whom It May Concern:

On the link bellow is a copy of the lawsuit that we filed against you in court on March 11, 2010.
Currently the Pretrail Conference is scheduled for April 11th, 2010 at 10:30 A.M. in courtroom #36.
The case number is 3485934. The reason the lawsuit was filed was due to a completely inadequate response from your company for copyright infrigement that our client Touchstone Advisories Inc is a victim of Copyright infrigement
Touchstone Advisories Inc has proof of multiple Copyright Law violations that they wish to present in court on April 11th, 2010.


Mark R. Crosby
Crosby & Higgins LLP

The law-firms named in the email, header, and sending server all appear to be a mish-mash of existing firms.

If a user clicks on the link and opens the document it will attempt to download additional payload.

Initial Detection

Currently only a few AV solutions detect the initial document: http://www.virustotal.com/analisis/9b762ff9d2103022bf1476f2c55db91475f31526522716e827875801f92a0d87-1269486837

Behavioral Notes

Following Daniel's process (http://isc.sans.org/diary.html?storyid=6703) one could extract the executable and determine what it's up to.

It appears to reach out to to make a request similar to:

GET /fwq/indux.php?U=1234@1014@1@0@0@c791d4a4a147b2cd1843fe4f7f27f3a1df63f95daf0c3ddcd5f1b1e4538fd803


Keywords: RTF
5 comment(s)


Diary Archives