{"id":2382,"date":"2014-05-24T12:31:17","date_gmt":"2014-05-24T12:31:17","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=2382"},"modified":"2014-05-24T15:38:46","modified_gmt":"2014-05-24T15:38:46","slug":"upatres-gadgetry","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2014\/05\/24\/upatres-gadgetry\/","title":{"rendered":"Upatre’s gadgetry"},"content":{"rendered":"

During last week I have seen News reports talking about spam campaign delivering the malware that is using a .gadget file extension. Since one of my spambait accounts got it as well I decided to run a quick test and write down what I found about it.<\/p>\n

And just in case you are wondering – despite the Gadgets being retired<\/a> they still work.<\/p>\n

The malicious attachment is called internal_use_only.gadget<\/strong>; Gadget files are zip files so one can enumerate their content e.g. with 7Zip:<\/p>\n

Path = internal_use_only.gadget\r\nType = zip\r\nPhysical Size = 6878\r\n\r\n\u00a0\u00a0 Date\u00a0\u00a0\u00a0\u00a0\u00a0 Time\u00a0\u00a0\u00a0 Attr\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Size\u00a0\u00a0 Compressed\u00a0 Name\r\n------------------- ----- ------------ ------------\u00a0 ------------------------\r\n2014-05-16 12:45:26 ....A\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 335\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 220\u00a0 gadget.html\r\n2014-05-16 12:44:14 ....A\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10240\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6151\u00a0 main.exe\r\n2014-05-15 22:08:40 ....A\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 326\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 199\u00a0 gadget.xml\r\n------------------- ----- ------------ ------------\u00a0 ------------------------\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 10901\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 6570\u00a0 3 files, 0 folders<\/pre>\n
If dropped in a folder, we can see the icon of a Gadget<\/p>\n
\"gadget\"<\/a>The content of the gadget.xml<\/strong>:<\/p>\n
\"gadget_xml2\"<\/a><\/p>\n
The content of the gadget.html<\/strong>:<\/p>\n
\"gadget_html\"<\/a>and the third file is a small executable called main.exe<\/strong>.<\/p>\n
Quick analysis confirmed it’s Upatre, a well-known Zeus downloader.<\/p>\n
When main.exe<\/strong> is executed it drops its copy as %TEMP%\\ycare.exe<\/strong> and appends the original path to the main.exe<\/strong> so that ycare.exe<\/strong> can delete it once it’s executed. The executed ycare.exe attempts to connect to just* [ . ]com\/wp-content\/uploads\/2014\/02\/1605UKmw.enc or grab the very same file from dot*[ . ]com\/fonts\/1605UKmw.enc.<\/p>\n
If the user is silly enough to open this gadget on the computer the warning popup will show up:<\/p>\n
\"gadget2\"<\/a><\/p>\n
If the user is silly^2 enough, the ‘gadget’ will be ‘added’ to the Sidebar:<\/p>\n
\"gadget3\"<\/a><\/p>\n
– and the malware thingie will run.<\/p>\n
The Gadgets leave Gadgetish remnants on the system and they can be potentially used to determine the original attack vector:<\/p>\n