Self-Deleting Malware, Targets Home Routers to Gather Information

Researchers with Trend Micro Have Analyzed Malware that, 1st Connects to Home Routers and Scans for Connected Devices and then Sends the Information it Gathers to a Command-and-Control (C&C) Server, before Deleting itself without a Trace. The Malware was Detected by Trend Micro as 'TROJ_VICEPASS.A', or 'VICEPASS' and it has been Observed Infecting Users that Navigate to Malicious Websites Hosting a Purported Adobe Flash Update, according to a Monday Post by Kenney Lu, of Trend Micro. Once Downloaded and Executed, the Malware Uses a Predefined List of Usernames and Passwords to Attempt to Connect to the Home Router, Lu Wrote. Some of the Usernames include Admin, D-Link, Guest, Root and User and Some of the Passwords include 12345678, Admin, Password and QWERTY. “This malware appears to be used primarily for intelligence gathering”, Lu Told SCMagazine.com in a Tuesday Email Correspondence. “Specifically, it enumerates as many connected devices as possible, attempts to connect to them and returns a list of results to the command-and-control server.”


When Connected to the Home Router, the Malware Scans for Devices Using Various Strings in its Search, including Dlink, D-link, Laserjet, Apache, Cisco, Gigaset, Asus, Apple, iPhone, iPad, Logitech, Samsung and XBox, Lu Wrote in the Post. Lu Said that, the Malware “will affect every device in the target network. If it finds any of these vendors' devices, the devices will be given a specific vendor name, [and] other devices will be marked as 'unknown'”. The Search Results are Encrypted Using Base64 and a Self-Made Encryption Method and are Sent to the C&C Using HTTP Protocol, Lu Wrote in the Post, Explaining that, the Malware will then Delete itself and Remove any Trace of its Existence. In the Post, Lu Suggested that, Attackers Could be Using 'VICEPASS' for Reconnaissance for Bigger Campaigns. He Wrote that, the Information Gleaned from the Malware could also be Stored and Used for Future Cross-Site Request Forgery (CSRF) Attacks. To Protect against these Types of Threats, Lu Suggested Using Strong Passwords, Not Clicking on Links in Emails and Updating Software from Official Websites.




Info Source:

http://blog.trendmicro.com/trendlabs-security-intelligence/malware-snoops-through-your-home-network