Live Security Platinum FakeAV infections on the rise (June 20, 2012)

Dell SonicWALL Threats Research team observed a rise in FakeAV variant titled "Live Security Platinum". It was seen spreading in the wild through compromised webpages. As seen in the past, this FakeAV variant uses various scare tactics to convince the user to buy a license in order to disinfect their system. In addition to the usual scare tactics, it was also found redirecting webpages in Internet Explorer to a fake alert page.

On vitising the compromised page, a drive by infection is triggered without the users knowledge. The injected script on the compromised webpage is heavily obfuscated and leads to the download and execution of the FakeAV variant:

The FakeAV when executed performs the following activities:

• It creates the following files:
  
  • %appdata%529C50D8002841870004330E2830AC72529C50D8002841870004330E2830AC72.exe (Copy of itself)
  • %appdata%529C50D8002841870004330E2830AC72529C50D8002841870004330E2830AC72 (Data file)]
  • %UserProfile%DesktopLive Security Platinum.lnk
  • %ProgramFiles%Live Security PlatinumLive Security Platinum.lnk
• It creates the following registry keys:
  
  • HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionRunOnce:529C50D8002841870004330E2830AC72:"%appdata%529C50D8002841870004330E2830AC72529C50D8002841870004330E2830AC72.exe"
  • SoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapDomains:{removed IP Address}
• It steals user cookies
• It connects to remote servers to report infection and for contacting fake payment gateways:

  

• Some of the alerts generated are shown below:

  

  

  

• It hooks GetUrlCacheHeaderData in Wininet.dll to redirect users to a fake alert page in Internet Explorer :

  

• It repeatedly prompts the user to buy the product:

  

  

• If the user decides to activate the software, it open a fake payment page asking for credit card details and personal information:

  

Dell SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

• GAV: LiveSecurityPlatinum (Trojan)
• GAV: LiveSecurityPlatinum_2 (Trojan)
• GAV: LiveSecurityPlatinum_3 (Trojan)
• GAV: LiveSecurityPlatinum_4 (Trojan)
• GAV: LiveSecurityPlatinum_5 (Trojan)