On Friday afternoon a few users received an email with the subject "Important - Internal Use Only". It had an attachment "internal_use-only.gadget" It was not stopped or flagged by the UTM (9.117). When I submitted to www.virustotal.com about 25 of 53 AV vendors identified as a virus, and all were within the 24 hour period preceding my submission. By the time I checked, Sophos was one of the AV vendors identifying as malware. So very much a new issue.
There were two things that concerned me. One was that the malware contained in the attachment was supposedly the scary ransomware. Secondly, in the attachment there were three files, gadget.html, main.exe, and gadget.xml. The UTM was set to block exe files. It was not able to identify the payload in the attachment.
Secondly, I had taken the effort to try and submit the sample to Sophos themselves. I was able to do so, but only by saying that it was a Windows problem. Their submission site has no knowledge of Sophos UTMs. UTM is not a category that can be selected!!! Finally I was able to get the file uploaded and they did respond with a malware identification:
internal_use_only.gadget -- identity created/updated (New detection Troj/ZipMal-DW)
main.exe -- identity created/updated (New detection Troj/Upatre-CD)
1cf9f.sys -- already detected (Mal/NecurSys-A (all product versions))
ycare.exe -- identity created/updated (New detection Troj/Upatre-CD)
PKO52AC.bat -- non-malicious
socok.exe -- identity created/updated (New detection Troj/Zbot-III)
gadget.html -- non-malicious
gadget.xml -- non-malicious
internal_use_only.gadget.zip -- archive file
I have taken action on our UTMs to add the blocked attachment extension "gadget" which I hope will better protect against this type of risk. I presume that a Windows 7 user who clicked on the attachment would have had the desktop try and run it as a desktop gadget.
I'd be interested to know whether adding "gadget" to blocked file extensions will work (maybe it only works for 3 letter extensions?).
For those interested there is a discussion on the malware [url=http://myonlinesecurity.co.uk/Important Company Update[/url]
This thread was automatically locked due to age.
