Paltalk Rogue Trojan Loader From Palnet Ad Server

Monday, March 29, 2010 “Sunny Sky50m” a.k.a. “obergeek“@admin of PCTECH room in Paltalk chat

Page 1

Paltalk Rogue Trojan loader from PalNet Ad Server

Captured by Sunny Sky50m @PCTECH


Page 2

Reason for This reportPopup below produced by Paltalk Today Ad. 27 March-2010

• For the last 6 months PCTECH has been fighting this same Trojan acquired by innocent Paltalk users.

• Sometimes they complain of this “fake” Trojan warning and say they did nothing, then attempting to cancel the alarming message. Some users thought their System Security was prompting them to perform an online scan, others new it was a bad sign but were infected anyways.

• We call this a Rogue Virus by Phishing or pretending to be a bonfire security warning. Any response OK or cancel triggers a fake online scan shown in a Paltalk Today window, then a click anywhere on that window triggers an executable Trojan to be automatically downloaded by “paltalk.exe” from a “rogue” server with no domain name.

• The evidence in this report shows that paltalk.exe and hence AVM Software, Inc. (PALTALK) care of Network Solutions, is 100% responsible for this Trojan Worm which contradicts their public statements of the same.

• Unfortunately the most common security packages employed by PC users do not detect this Trojan, until it is too late. (See VirusTotal results) For experienced PCTECH @admins, it is easy to prevent.

• Incidentally clicking [OK] or [Cancel] or even [x] triggers a repeat popup window and fake security scan shown on the next page.

• We want Paltalk to take corrective action immediately, as we enjoy the service and hope to prevent the anxiety and frustration that this problem causes to many users.

• Not to slight the painstaking efforts PCTECH admins, who freely help any Paltalk users rid their computers of infections or other PC confusions, we could do with fewer infected pro bono “customers”.


Page 3

The Rogue Online Scanner The Paltalk Today window popped up from the background to the top of the desktop. It behaved like any webpage but without an address bar.

In this window, it shows a fake Windows System Task on the left with fake Explorer folders and fake trojan scanner results. It looked like an active animated online program, but was actually a harmless animated GIF or PNG file, thus going undetected by any AntiMalware software.

In this case just pretending to be an online Security Scan but with an embedded hyperlink supplied by PALNET server and if clicked went straight to the resulting Trojan server to initiate a download.. “ to Fix your Infected Computer! (not!)

<<< Clicking anywhere on the Paltalk Today window triggers the Trojan download.”inst.exe”


Page 4

Where does the Trojan come from?whois 85.12.44.148? inetnum: 85.12.44.128 - 85.12.44.255

netname: XS-24descr: XS-24 international ltdcountry: nladmin-c: PL2400-RIPEtech-c: TW1148-RIPEstatus: ASSIGNED PAmnt-by: EUROACCESS-MNTsource: RIPE # Filtered

person: PC Leurinkaddress: EuroAccess Enterprises Ltd.address: Alsacelaan 5address: 5627 CA Eindhoven, The Netherlandsphone: +31 (0)20-7173209 +31 (0)20-7173209 fax-no: +31 (0)40-2488764

e-mail:

mnt-by: EUROACCESS-MNTnic-hdl: PL2400-RIPEsource: RIPE # Filtered

person: TA Westervoordeaddress: EuroAccess Enterprises Ltd.address: Alsacelaan 5address: 5627 CA Eindhoven, The Netherlandsphone: +31 (0)20-7173209 +31 (0)20-7173209 fax-no: +31 (0)40-2488764

e-mail:

mnt-by: EUROACCESS-MNTnic-hdl: TW1148-RIPEsource: RIPE # Filtered


Page 5

How is Paltalk infecting users?• Paltalk Today ads change every so often, depending on tab selections,

logon time and user paid subscription “ads enable”. (paid Paltalk users may select an option to hide Paltalk Today and setting to “opt out” or hide ads.)

• The contents are outsourced to various ad servers, some hosted as hypertext, others in the Adobe Flash player frame.

• Most security minded users PC users have a HOSTS file which blocks known bad domains. .. However, some ads persist to come thru even from blocked ads such as “a.trialfusion.com” This implies the Palnet server determines which ads are displayed and not the client application. In this case, when the “Warning” Ad occurred simulateously with the Paltalk Today page being forced to the foreground desktop but with a blank white page, implying it was intending to display an ad but this client PC had blocked the request with the HOSTS file. However, a subsequent click on the warning prompt responded with the animated Fake Trojan scanner on Page 3 implying the ad came from an unblocked site or a direct domain IP address.


Page 6

Which AV missed detecting this Malware?inst.exe was saved, and was sent to www.virustotalcom for analysis.

The results showed this file could kill processes, read & write files using in the kernel32.dll( 2 imports )> USER32.dll: CreateWindowExA, GetTaskmanWindow, MessageBoxA, GetMessageExtraInfo, UpdateWindow, CreateWindowExW, SendMessageA> KERNEL32.dll: ExitProcess, CreateFileW, WriteFile, ReadFile, GetVersionExW, GetModuleHandleW, DuplicateHandle, CloseHandle

VIRUS-TOTAL RESULTS File inst.exe received on 2010.03.27 21:49:18 (UTC)Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED

Result: 8/42 (19.05%) {detected by 8 of 42 malware software types}Version Last Update Resulta-squared 4.5.0.50 2010.03.27 -AhnLab-V3 5.0.0.2 2010.03.27 -AntiVir 7.10.5.241 2010.03.26 -Antiy-AVL 2.0.3.7 2010.03.26 -Authentium 5.2.0.5 2010.03.27 -Avast 4.8.1351.0 2010.03.27 -Avast5 5.0.332.0 2010.03.27 -AVG 9.0.0.787 2010.03.27 -BitDefender 7.2 2010.03.27 -CAT-QuickHeal 10.00 2010.03.27 -ClamAV 0.96.0.0-git 2010.03.27 -Comodo 4407 2010.03.27 -DrWeb 5.0.1.12222 2010.03.27 -eSafe 7.0.17.0 2010.03.25 -eTrust-Vet 35.2.7391 2010.03.26 -F-Prot 4.5.1.85 2010.03.27 -F-Secure 9.0.15370.0 2010.03.27 -Fortinet 4.0.14.0 2010.03.27 -GData 19 2010.03.27 -Ikarus T3.1.1.80.0 2010.03.27 -Jiangmin 13.0.900 2010.03.27 -K7AntiVirus 7.10.1004 2010.03.22 -Kaspersky 7.0.0.125 2010.03.27 Packed.Win32.Krap.aiMcAfee 5933 2010.03.27 FakeAlert-KW.eMcAfee+Artemis 5933 2010.03.27 FakeAlert-KW.eMcAfee-GW-Edition6.8.5 2010.03.27 Heuristic.BehavesLike.Win32.Packed.KMicrosoft 1.5605 2010.03.27 Trojan:Win32/WinwebsecNOD32 4978 2010.03.26 -Norman 6.04.10 2010.03.27 -nProtect 2009.1.8.0 2010.03.27 -Panda 10.0.2.2 2010.03.27 -PCTools 7.0.3.5 2010.03.27 -Prevx 3.0 2010.03.27 -Rising 22.40.05.04 2010.03.27 -Sophos 4.52.0 2010.03.27 -Sunbelt 6101 2010.03.26 FraudTool.Win32.SecurityTool (v)Symantec 20091.2.0.41 2010.03.27 Suspicious.InsightTheHacker 6.5.2.0.246 2010.03.27 Trojan/FakeAV.genTrendMicro 9.120.0.1004 2010.03.27 -VBA32 3.12.12.2 2010.03.27 -ViRobot 2010.3.27.2248 2010.03.27 -VirusBuster 5.0.27.0 2010.03.27 -


Page 7

Here is a summary of Paltalk’s Infection trigger mechanism

• Using Procmon.exe from http://live.sysinternals.com to capture events – (20MB was too big to fit here)

• A trace log was captured that shows paltalk.exe activity as follows;– requesting TCP send and receive from 64.40.10.75:17760 (get url)

• Server name from whois.sc NetRange: 64.40.0.0 - 64.40.15.255 • CIDR: 64.40.0.0/20 OriginAS: AS18505 NetName: PALNET-01

– Read file inst.exe from 85.12.44..148 (rogue Dutch host)

• This occurrence is infrequent but occurs roughly once per day or so.

• I decided to delete my large HOSTS file and Restricted Site lists to capture this event

• It took 4 days to see the popup event occur.

• Other PCTECH admins saw it on the previous week perhaps once every 2 days on a PC setup to wait for the Trojan Scan Ad.

• Closing the Paltalk Today window stopped the subsequent file download.

• (novice users were not so lucky)


Page 8

Paltalk.exe file creation log with trojan• Procmon.exe was used to capture paltalk.exe file access activities for a few hours.• Note Files in reverse order: inst.exe (=trojan) , alert.png (=animated fake online scan picture), ErrorPagesScripts, (animated) Progress bar…gif


Page 9

No signs of Paltalk or PC being Infected Event• This user conducted number

scans to ensure PC was free of any active trojans or even dormant ones in any temporary internet folders using A-Squared, MSE, Avast, HJT, RunScanner, Spybot S&D, etc etc

• During the event, Paltalk active threads were recorded and shown to the right

• none of the Paltalk Threads look suspicious as well;


Page 10

What does VirusTotal call this trojan?

• Antivirus Version Last Update Result• Sunbelt 6101 2010.03.26 FraudTool.Win32.SecurityTool (v)• Symantec 20091.2.0.41 2010.03.27 Suspicious.Insight• TheHacker 6.5.2.0.246 2010.03.27 Trojan/FakeAV.gen• Kaspersky 7.0.0.125 2010.03.27 Packed.Win32.Krap.ai• McAfee 5933 2010.03.27 FakeAlert-KW.e• McAfee+Artemis 5933 2010.03.27 FakeAlert-KW.e• McAfee-GW-Edition 6.8.5 2010.03.27

Heuristic.BehavesLike.Win32.Packed.K• Microsoft 1.5605 2010.03.27 Trojan:Win32/Winwebsec

• Fraud Security Tool seems to best describe Paltalk Today Ad which was used to display the Fake Trojan (PNG file) but later fetches a real Trojan (inst.exe) using Paltalk.exe fetched from a rogue server after the user clicks the page to attempt to cancel or accept a repair action.


Page 11

What do we expect from Paltalk?

• Estimate completion date for Corrective Action on preventing the Rogue Trojan infection

• Confirmation of the above action by cut-in date• Some recognition to PCTECH @Admins for

making Paltalk safer and users happier by assisting thousands of users each year with PC security and audio setup issues. (Other rooms also assist in this effort, as much as they can)


Page 12

What else could be done?• Problems: • 1) Users have no idea how loud their audio is• 2) The audio level changes even after they calibrate or test it• 3) Quieter talkers followed by MegaLOUD talkers can be painful• 4) Muted experienced Talkers are often embarassed when they have no useful visual or audio feedback• 5) Paltalk’s lame audio meter has only 2 bars and since it detects DC offset it is often at 2 bars for users the high gain

and DC offset (codec issue), leaving little or no visual feedback of mic level.• 6) Paltalk slider’s are global and shared with other Windows rather than DirectX independent (except win7)• 7) Audio sliders are often wrong.. (show zero when not) due to shared interference or errors.• 8) The bandwidth wasted on poor quality audio has significant room for improvement

• Suggestions;• Make the audio use as easy as Skype, new device enabled for audio is optional (cam or usb or analog)• Restore the old audio VU icons for mic level which were more effective than current useless ones • (current VU meter is useful for very few)• Include a real VU meter to normalize the listening & broadcast experience• Make Music room setup for audio cards easier to setup with tools like Andrea recorder

• I could fill out another 20 pages, but shall stop here for lack of time…. Tony Stewart P Eng EE’75 (aka Sunny Sky50m)

• Keep the good times rolling and restore the faith in Paltalk by taking Corrective Action.

Technology

Paltalk Rogue Trojan Loader From Palnet Ad Server