Conficker’s latest move may be tied to a scheme to lure users into downloading fake anti-virus software.
Security researchers monitoring the Conficker worm’s activities say the malware has been observed downloading a file detected by Kaspersky Lab as FraudTool.Win32.SpywareProtect2009.s.
“Once it’s run, you see the app interface, which naturally asks if you want to remove the threats it’s ‘detected,'” wrote Aleks Gostev on Kaspersky Lab’s Analyst’s Diary blog. “Of course, this service comes at a price-$49.95.”
In addition to that file, the worm is also now downloading the Waledac malware, which steals passwords and turns computers into bots for spamming operations. Waledac has emerged as a key part of spamming operations over the past several months, and is widely considered a reincarnation of the infamous Storm botnet.
Tricking users into installing rogue software isn’t new for the worm, which tried the same thing when it first appeared in 2008. The move also represents another example of attackers cashing in on rogueware. Finjan recently issued a report about a rogueware affiliate network that pulled in an average of $10,800 a day. According to Microsoft’s latest Security Intelligence Report, two rogue families, Win32/FakeXPA and Win32/FakeSecSen, were detected on more than 1.5 million computers by Microsoft software.
“Fear is used, universally, as a means to control people,” said Sendio CTO Tal Golan. “Governments use it. Large businesses use it. So it should come as no surprise to anyone that ‘cyber-bad guys’ use it.”
At the moment, the rogue anti-virus software comes from sites located in the Ukraine (131-3.elaninet.com.78.26.179.107) although the worm is downloading it from other sites, according to Kaspersky Lab.
There are numerous tools for disinfecting systems hit by Conficker, some of which are linked to here. The worm spreads by exploiting a patched Microsoft vulnerability as well as via network shares by logging in to machines with weak passwords. It also spreads through removable media. Network administrators are advised to deploy MS08-067 if they have not already done so, as well as to follow best practices regarding passwords.