Perplexing malware served on social welfare site
Legitimate compromised sites usually serve malware that directly or indirectly makes money for its peddlers, but ever now and then an exception to that rule arises.
Microsoft’s researchers have recently been given a heads-up about a Romanian website serving malware, and a closer analysis of the file revealed a rather peculiar behavior.
The site in question is hosted at asistentasociala(dot)info, and it seems to be a rather popular site that offers documents that need to be filled out in order to receive “social welfare” and instructions on how to do it.
Several of the documents (Word and Excel documents, PDFs) made available for download had obviously been changed with EXE files with the same name:
When downloaded, the files’ icons are those of the aforementioned benign types of documents, making the probability of the user noticing something even lesser than before.
Once one of these malicious executables is run, it drops the original, harmless document file in order to keep up the charade, but in the background it also drops a BAT file in the Temporary Files folder.
“The BAT file tries to delete files and folders from two software solutions mainly used in Romanian institutions: Indaco (software that offers services for legal documentation) and Aplxpert (a document management system based on regulations designed for public administration),” explain the researchers.
“It also proceeds to delete folders (along with the files inside) that contain the following strings: ‘aplxpert’, ‘indaco’ (as previously mentioned), ‘mondo’, ‘agr’, ‘factur’ (invoice), ‘gami’, ‘multi’, ‘glob’, ‘alocati’, ‘arenda’, ‘social’, ‘assist’, ‘vmg’, ‘asf’, ‘lemne’ (wood), ‘incalz’ (heating) on the C, D, E, F, G, H drives.”
The researchers are still analyzing the malware, but so far its goal seems quite unique. Are the malware peddlers targeting Romanian government employees, or are they aiming to derail the efforts of those trying to receive welfare from the state – ironically, by supposedly offering help with filling out the same files the malware is programmed to delete? This certainly seems a very targeted action, and my bet would be on the second theory.
Hopefully Microsoft’s researchers will have more insight to offer in a few days.