A number of spam campaigns containing Rapidshare links point to Trojans and other malware stored on the cloud-based storage site.
are using cloud-based storage services to store malware, allowing them to
circumvent e-mail spam filters, according to security experts at Kaspersky Lab
and MX Lab.
Lab detected the click-fraud Trojan, a variant of the
Trojan-Dropper.Wind32.Drooptroop family, which has been in circulation since
the beginning of December, said Vicente
Diaz, a Kaspersky Lab
expert. There are over 7,000 variants of this
particular family, according to Kaspersky. As with other types of malware that
took advantage of the holiday
, the executable file for this Trojan was named gift.exe, Diaz said.
security firm detected more than 1,000 infections using this technique to
distribute this variant, according to Diaz.
Trojan is stored on Rapidshare, a cloud-based file-sharing and storage service.
The spam messages that users receive in their in-box have no text, just a
single link pointing to a valid Rapidshare URL. These messages get past spam
filters because there are no malicious files attached, the domain name is not
considered a "bad" one, and executables hosted on Rapidshare aren't
automatically classified as a threat, said Diaz.
was also a recent fake antivirus spam campaign that included a Rapidshare link
pointing to surprise.exe, according to security firm MX
. The executable file downloads and installs the fake AV Security Shield
on the user's computer, which runs after the computer is rebooted.
downloaded, there's no guarantee that authentic antivirus products will detect
these Trojans. According to MX Lab, only 16 of the 43 major antivirus products
detected surprise.exe as a Trojan or as fake AV.
is getting harder to detect, as authors "run through 40 or more antivirus
software [programs] to make sure the viruses they are developing don't get
detected before releasing it," Neil
, CTO of Dasient, told eWEEK.
Drooptroop Trojan hooks into the spoolsv.exe process and intercepts network
traffic to and from the browser, redirects user requests, and allows a remote
user to gain access to the system, said Diaz. The Trojan also has a fake AV
component, as it displays a fake AV scan inside a browser window to scare the
user into buying the counterfeit security product.
seem particularly attracted to Rapidshare for hosting malware. Sophos warned
about spam messages with Rapidshare links pointing to a fake AV back in 2009.
Jerome Segura of
also reported several pieces of malware being stored on the
site. Those files were downloaded by other Trojans, not by a user, Segura
is a major risk and flaw in file hosting services" and "rather
convenient" for the bad guys, Segura said.
of the holiday, Rapidshare was not available for comment.
work with cloud storage providers to reduce IT operating costs and simplify
maintenance. Spammers are apparently thinking along similar lines, such as not
having to deal with bandwidth costs, said Segura. Using
a free service makes the fake AV scam even more profitable, said Diaz.
has taken advantage of other online cloud services in the past, said Diaz.
Examples include using Twitter as a communication channel for botnets, Amazon
EC2 to host remote control servers and advertising networks to distribute