Waledac malware adds geolocation

Share this article:
Waledac malware adds geolocation
Waledac malware adds geolocation
A new variant of the Waledac malware campaign has been unleashed, taking advantage of the economic crisis by spoofing a legitimate coupon website and using IP address geolocation to appear to offer coupons for local stores.

Criminals are hosting a website that mimicks a site that sells The Couponizer, a product that helps shoppers organize their coupons. Adding legitimacy to the exploit is that the spoofed Couponizer page seems to be offering coupons for stores, restaurants and companies near where the user lives, Phil Hay, lead threat analyst at internet and email filtering solutions company Marshal8e6, told SCMagazineUS.com Wednesday.

To achieve this, the exploit uses a social engineering feature not seen in the other Waledac variants called IP address geolocation, which is a way of determining a user's location based on his or her IP address. The user's IP address is queried against a database to determine its location, then the results of that query are put into the webpage, Hay said.

 
Courtesy of Marshal8e6

The geolocation feature increases the appeal and seeming validity to a casual observer, Hay said.

“You see something popping up with local content -- that's what caught my eye," he said.

Users are being lured to these spoofed pages through spam with subject lines such as, “I've already used these coupons” and “Want to save money? Look at this!” The email bodies contain a link to one of the hundreds of malicious pages hosting the exploit, Hay said.

Experts began detecting this new variant on Sunday. The spam is still being detected with relatively low levels.

About 15,000 messages an hour are being detected, which translates to less than one percent of total spam volume, Sam Masiello, vice president of information security at messaging security firm MX Logic, told SCMagazineUS.com Wednesday.

“Regardless of volume, the most important thing to consider is the potential damage that can be incurred by someone who falls victim,” Masiello said.

To become infected, a user has to download and execute the malware from one of the malicious links on the site, he said. Once infected, the malware can do any number of things to a user's system, including use it to send out other spam or install a keylogger that could result in data loss or identity theft, Masiello said.

The goal of Waledac is to build a botnet, and the criminals behind it are using some clever campaigns to do it, experts said. Waledac has used holiday-themed exploits in the past -- first a Christmas theme, then two different variants with Valentine's Day themes, and it was also hosted on a fake President Obama site.
Share this article:
close

Next Article in News

Sign up to our newsletters

More in News

Cyber Command tests gov't collaboration in wake of attacks

The two-week exercise, "Cyber Guard 14-1," was completed this month.

Text message spammer settles charges filed by FTC

Text message spammer settles charges filed by FTC

Rishab Verma and his company agreed to settle charges filed by the FTC that Verma sent millions of spam text messages that deceitfully promised free merchandise.

Rhode Island hospital to pay $150K for past data breach

More than 12,000 patients' personal and health information was compromised in a breach at The Women & Infants Hospital of Rhode Island.