The malware authors every now and then send us virus researchers some messages. For example in the compiled binary itself, or as debug output. Now we found a Zbot Trojan variant which tries to evade detection by carrying a digital certificate and therewith looking more legitimate. And this certificate is registered to “DetectMe! ”, also adding random data behind the certificate.

We see hints like these regularly – malware authors proposing names for their malicious creations or suggesting a place where a signature based detection would be suitable. Of course, such hints are ignored by us for detection but make us smile for a short time.

In this special case, our heuristics already notice other suspicious properties of the file and Avira thus detects the malware as TR/Crypt.ULPM.Gen.

Stefan Kurtzhals
Engine R&D

Dirk Knop
Technical Editor

• Malware signed with fake Avira Certificate
  While analyzing new malware samples we stumbled over a sample which contains a digital Avira signature. Something we need to check! Viewing the properties of the digital signature, Microsoft Windows s...
• Bredolab Malware spammed via fake Facebook Mails
  The popularity of the social network Facebook is abused again to spread Malware via Email. The spam mails arrive with the subject “Facebook password has been changed. ID” and contain a ZI...
• Fake Adobe FlashPlayer Update nov.2010 delivers malware
  A website labelled ‘Porn TV’ acts as a malware distribution platform: freev.info When clicking on any video link, a very convincing screen pops up: Downloading the update actually downloa...
• Fake Live Webcam site distributes malware
  A pink colored webpage is set as a trap to attract men looking to chat with young attractive women. Clicking anywhere of the page will trigger a file download for a “Flash Player”. www.{ob...
• Fake Apple iTunes Receipts Used as Malware Tool (PC Magazine)
  PC Magazine - PandaLabs said Monday that the company has discovered fake iTunes receipts that have begun to be sent to users in an attempt to steal personal details. View full post on Yahoo! News: ...
• Week in Microsoft: here mousey mousey, best fake malware ever
  Microsoft unveils shape-shifting Arc Touch Mouse: Microsoft has officially announced the $70 the Arc Touch Mouse. The device is available for presale now, starts shipping in Dec...
• New malware detects browser, shows fake malware warning page
  Microsoft is warning about a new piece of malware, Rogue:MSIL/Zeven, that auto-detects a user's browser and then imitates the relevant malware warning pages from Internet Explor...
• Zeus Malware Used Pilfered Digital Certificate (PC World)
  PC World - Researchers at Trend Micro have found that a widespread piece of malware used a digital certificate from a competing security company's product in an attempt to look legitimate. View ful...
• Zeus malware used pilfered digital certificate
  Researchers at Trend Micro have found that a widespread piece of malware used a digital certificate from a competing security company's product in an attempt to look legitimate. View full post on C...
• Fake Firefox Update Page Pushes Malware
  Thanks to F-Secure for revealing the latest in rogue anti-malware: A fake Firefox "Just Updated" page which pushes you to install an update to Flash. View full post on PCMag.com Security Co...