Help Removing W97M.Downloader from Mac OS X 10.7.5. I am using Norton Anti-Virus for Mac on OS X 10.7.5. I received notice yesterday of numerous W97M.Downloader infections. A full system scan revealed these can be neither quarantined nor deleted nor fixed. So, I read somewhere to try ClamXav. Question: Q: W97M Downloader on Mac Norton alerted me that my MacBook has been infected with the W97M Downloader Trojan virus. I am running macOS Catalina 10.15.4. Hi I sent an email today and got a reply that 'Remote Server returned '550 This message contains malware (SecuriteInfo.com.W97M.DownLoader.2938.UNOFFICIAL)' Text of reply message is at end of this post. I checked and found that somehow Malwarebytes had disappeared from my Laptop (Windows 7 64 bi. Free Video Downloader for Mac, free and safe download. Free Video Downloader latest version: Free Video Downloader - Download videos from the internet.

McAfee Labs recently found a variant of the W97M macro malware downloader that runs the Vawtrak malware. Although W97M usually employs Microsoft Office documents to run malicious Visual Basic scripts that download and run malware, this instance of W97M contains an embedded executable that is dropped onto the file system using a malicious macro.

W97M is a malware family comprising all malicious Office files (rich text, Word, Excel, etc.) that rely on macros containing VB scripts to download and run a specific malware from its control servers. Recently McAfee Labs has seen multiple waves of W97M malware serving malware, especially:

• Ransomware such as TeslaCrypt and Locky.
• Banking Trojans such as Dridex.

Vawtrak is a multifunctional malware family with the following capabilities:

• Stealing FTP passwords from a victim’s system.
• Stealing certificates from a victim’s system.
• Stealing credentials and other information via process infection.
• Malicious code injection in web pages displayed in a browser on a victim’s system.
• Running arbitrary commands on a victim’s system.

Infection vector and analysis

W97M malware is usually served via malicious email spam campaigns. This instance of W97M, however, is served from compromised websites. These compromised websites might be used with exploit kits or phishing campaigns that trick victims into downloading and running the W97M documents.

Some URLs serving the W97M malware:

• hxxp://www.excel-dougakaisetu.com/wordpress/wp-content/plugins/[masked]/account.doc
• hxxp://www.ippan.x0.to/wp-content/themes/[masked]/account.doc
• hxxp://www.newbeginningsari.org.au/wp-content/[masked]/account.doc
• hxxp://www.sternschule-uelzen.de/wp-content/plugins/[masked]/account.doc
• hxxp://elveland.no/wp-content/themes/[masked]/account.doc
• hxxp://www.nightaccess.com/themes/[masked]/account.doc
• hxxp://excel-dougakaisetu.com/wordpress/wp-content/plugins/[masked]/account.doc
• hxxp://nightaccess.com/themes/[masked]/account.doc
• hxxp://www.paintballandbbthailand.com/modules/[masked]/account.doc
• hxxp://ippan.x0.to/wp-content/themes/[masked]/account.doc
• hxxp://www.elveland.no/wp-content/themes/[masked]/account.doc
• hxxp://paintballandbbthailand.com/modules/[masked]/account.doc
• hxxp://sternschule-uelzen.de/wp-content/plugins/[masked]/account.doc
• hxxp://www.yacht-energy.fr/wp-content/themes/[masked]/account.doc

The W97M sample appears to have an RSA-encrypted message embedded in its contents. The document asks the victim to “enable content” to view the decrypted contents of the document. This is a standard trick to get the victim to enable the malicious macro, which drops an embedded executable and executes it.

Contents of a malicious W97M document.

The document contains the malicious .exe embedded inside one of its forms. We have seen other examples of W97M embedding commands in forms but not as in the preceding example, in which the entire .exe is embedded in the document.

Embedded .exe in a Visual Basic form.

The malicious macro reads the contents of the form and writes it into an executable in the %temp% directory.

Malicious macro code in the W97M malware.

Second-stage executable

The executable dropped in the %temp% directory is a VB 6 binary. The code is decrypted at runtime and the malware creates a suspended copy of itself that is injected with the malicious code. This malware is a variant of Pony malware.

The primary functions of the second-stage binary:

• Steal FTP and other login credentials from known FTP software.
• Download and run the third-stage binary (Vawtrak).

Strings in the second-stage malware indicate the theft of FTP credentials.

Once the second-stage binary has all the credentials it can find, it sends the stolen data to the following control servers:

• hxxp://tittertte.ru/sliva/gate.php
• hxxp://tythetru.ru/sliva/gate.php
• hxxp://rulahat.ru/sliva/gate.php

These domains appear to be under the attacker(s) control:

• They are registered with the same registrar with registrant information hidden.
• They were registered on the same dates.
• They expire on the same dates.

This malware targets the following software for credentials:

• Far Manager
• Total Commander
• Ipswitch WS_FTP
• CuteFTP
• FlashFXP
• FileZilla
• FTP Navigator
• Bulletproof FTP
• Smart FTP
• Turbo FTP
• FFFTP
• FTP++
• GoFTP
• Cofeecup FTP
• CoreFTP
• FTP explorer
• LeapFTP
• WinSCP
• 32BitFTP
• ClassicFTP
• SoftX FTP client
• UltraFXP
• FTPRush
• FTPControl
• FTPVoyager
• LeechFTP
• Estsoft ALFTP
• DeluxeFTP
• Staff FTP
• FTP Visicom Media
• AceBit WiseFTP
• FreshFTP
• BlazeFTP
• 3D-FTP
• EasyFTP
• Winzip FTP
• WinFTP
• FTPSurfer
• FTPGetter
• FTPNow
• Robo-FTP 3.7
• Linas FTP Site Manager
• Notepad++ FTP
• Coffeecup ftp profile
• FTPShell
• MyFTP
• NovaFTP
• Yandex
• Adobe Common SiteServers
• Frigate3
• SecureFX
• Cryer WebsitePublisher
• BitKinex
• ExpanDrive
• NCH Software Fling
• Directory Opus
• NetDrive
• Webdrive
• Opera
• Firefox
• Firefox FireFTP
• Mozilla Seamonkey
• Mozilla Flock
• Mozilla Profiles
• SiteInfo.qfp SpeedFTP
• Chrome login and web data
• Chromium login and web data
• Chrome plus login and web data
• Bromium login and web data
• Nichrome login and web data
• Comodo login and web data
• RockMelt login and web data
• K-Meleon profile data
• Epic profile data
• GlobalDownloader
• NetSarang
• RDP
• CyberDuck
• Putty
• MAS Soft FTPInfo
• NexusFile
• FastStone Browser FTPlist
• MapleStudio Chromeplus
• Windows Live Mail
• Windows Mail
• RimArts Mail
• Pocomail
• Incredimail
• BatMail
• MS Internet Account Manager
• Thunderbird

Once the second-stage malware has uploaded the stolen credentials to the control server, it downloads the third-stage malware from a different set of control servers and runs it:

• hxxp://awc.asia/wp-content/themes/[masked]/hsg.exe
• hxxp://teatromanzonicassino.it/wp-content/themes/[masked]/hsg.exe
• hxxp://www.bisaim.com/wp-content/themes/[masked]/hsg.exe

Third-stage executable

The third-stage executable is the Vawtrak payload (also a VB 6 binary).

The primary purpose of the binary is to infect other running processes in the system and:

• Steal security certificates.
• Infect Chrome and Firefox processes to inject malicious code into browsed web pages.
• Steal financial login credentials for banks.

Process infection and API hooking

The malware spreads across the system by injecting its code into any process that doesn’t appear on the following whitelist:

• csrss.exe
• smss.exe
• wininit.exe
• services.exe
• svchost.exe
• lsas.exe
• lsm.exe
• winlogon.exe
• dbgview.exe
• taskhost.exe

The malware also looks for the following processes to establish API hooks:

• Internet Explorer
  • HttpEndRequest, HttpOpenRequest, HttpQueryInfo, HttpSendRequest,
  • InternetConnect, InternetQueryDataAvailable, InternetQueryOption, InternetReadFile.
• Firefox
  • PR_Close, PR_Read, PR_Write, PR_Close, etc.
• Chrome
  • LoadLibrary, PFXImportCertStore, etc.
• Other processes
  • CreateProcessInternal: To infect any new process spawned by this process.
  • PFXImportCertStore: To steal certificate information from the victim.

API hooks established by the third-stage malware.

The malware uploads the stolen data to one of the following control servers:

• castuning.ru/rss/feed/stream
• mgsmedia.ru/rss/feed/stream
• puropea.com/rss/feed/stream
• futooke.com/rss/feed/stream
• citroxi.com/rss/feed/stream

Infection chain

The stages of infection are illustrated in the following figure:

Anti-VM measures

Both the second- and third-stage binaries of Vawtrak check the monitor resolution using User32.GetMonitorInfoA to make sure the malware isn’t running in a virtual machine. The malware binaries check to make sure the monitor resolution is greater than 800×600. This technique is employed to thwart some behavior-based detection systems.

Vawtrak’s monitor-resolution check.

Conclusion

This W97M malware differs from typical W97M malware due to the embedded binary inside the document. This tactic could be a result of the increased focus in the security community on W97M and the subsequent blacklisting of its control servers. Embedding an .exe in the doc file removes the need to contact a control server to download and execute the second-stage malware.

The encryption mechanisms and the use of VB 6 in both the second and third stages indicate that both instances of the malware share a common codebase, suggesting they could have been written by the same party.

MD5s

W97M samples. These samples are detected by McAfee as “W97M/Dropper.ao.”

• e56a57acf528b8cd340ae039519d5150
• 040c51e8c9118cc113c380d530984ba8
• ef10ea1a8b342dd9f6d1cec46fcd3c0f

Second-stage malware: These samples are detected as “Generic.xy.”

• 4b7623945d31ecd6ff1ed13f0ba1d6e0

Third-stage malware: These samples are detected as “RDN/Generic.cf” and “Vawtrak-FBB.”

• 3e631d530267a38e65afc5b012d4ff0c

Yara rule for W97M Vawtrak dropper

rule W97M_Vawtrak_dropper
{
meta:
author=”McAfee”
description=”W97M_Vawtrak_Dropper”

strings:
$asterismal=”asterismal”
$bootlicking=”bootlicking”
$shell=”WScript.Shell”
$temp=”%temp%”
$oxygon=”oxygon.exe”
$saxhorn = “saxhorn”
$fire = “Fire”
$bin= “546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e”

condition:
all of them
}

Classification

Malware

Trojan-Downloader

W97m.downloader Mac

W97M

W97M.Downloader.QK , Trojan.GenericKD.2465967

Summary

W97M.Downloader.QK is a specially-crafted Microsoft Word document that, when opened silently executes a malicious macro that connects to multiple remote servers to download and display additional components, typically image files and other malware.

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Suspect a file is incorrectly detected (a False Positive)?

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

• Check for the latest database updates

  First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.

• Submit a sample

  After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

  NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

• Exclude a file from further scanning

  If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

  Note You need administrative rights to change the settings.

For more Support

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Trojan Downloader Virus

W97M.Downloader.QK typically arrives as a document attached to a spam email message. Like most such messages, the contents of the email are usually tailored to entice the user into opening the attached Word file.

W97m Downloader Mac Torrent

When the file is launched, an embedded macro in the document silently runs and attempts to connect multiple remote servers. If successful, the macro downloads the following files onto the machine:

• Valid PNG image files that display messages in the Russian language
• A TXT file that contains a link to download additional malware
• And a TXT file that contains b64 encoded data

Text file containing b64 encoded data

When the data in this last file is decoded, it contains code for 3 scripts that are written in the VBScript, PowerShell and Batch coding languages. These scripts in turn attempt to download and execute another file from another remote server.

If the file is successfully downloaded, it is saved in the %TEMP% folder as 8.exe and then executed. At the time of analysis, this file is detected as Trojan.GenericKD.2465967.