The e-mail marking the first step of this data harvesting scheme is very likely to go down in the history of cybercrime-generated fiction on human behavior – claiming that if you tell people something is illegal, they won’t do it. This is how the promised tool gets the thinnest of all legitimacy coatings: “This tool could be used by hackers to hack MSN password, it should not Windows Live password hacking is illegal! […]”.
Much like a wolf trying really hard to grow a thick coat of wool and develop a persuasive bleating technique, this tool is allegedly intended for “[…] the use of owners to hack their own MSN accounts […]” and for “forensic scientists”.
Fig. 1 The “trust me, I’m not bad” initial message
Far be it from me the idea of preaching complete distrust in our fellow humans and their natural generosity! However, the logic of this message is quite puzzling. The final reference to the tool being valid for situations in which you are “[…] able to login without having to enter your password” adds to its sci-fi aura.
Such in-depth analysis of the meaning of every e-mail that you receive may not be your favorite pass time, but any claim to rendering password recover easier is quite hilarious in an age when you can never be too cautious about personal data theft.
Literary analysis aside, the promised tool is supposed to be downloaded using the link embedded in the message. And here’s when HackMsn.exe drops its mask and reveals that it’s a backdoor at heart.
Fig. 2. The backdoor exposed.
Identified by BitDefender as Backdoor.Bifrose.AADY, this piece of malicious code affects Windows platforms. The malware injects itself into the explorer.exe process and opens up a backdoor that allows unauthorized access to and control over the affected system.
Moreover, Backdoor.Bifrose.AADY attempts to read the keys and serial numbers of the various pieces of software installed on the affected computer, while also logging the passwords to the victim’s ICQ, Messenger, POP3 mail accounts, and protected storage.
This is not the first campaign aiming to disseminate this piece of malware. You can find out the details of another scheme it’s been part of on the Malwarecity Blog.
This article is based on the findings of BitDefender security researcher Sabina Datcu.
Add Comment