<html>
<body>
<blockquote type=cite class=cite cite=""><font size=3>Subject: TA15-098A:
AAEH<br>
Date: Thu, 09 Apr 2015 08:10:19 -0500<br>
To: w3hwn@comcast.net<br>
From: "US-CERT" <US-CERT@ncas.us-cert.gov><br><br>
<img src="https://public.govdelivery.com/system/images/37745/original/BANNER_NCCIC_USC_01.png" width=700 height=100 alt="NCCIC / US-CERT">
<br><br>
National Cyber Awareness System:<br>
<a href="https://www.us-cert.gov/ncas/alerts/TA15-098A">TA15-098A:
AAEH</a><br>
04/09/2015 12:00 AM EDT<br><br>
Original release date: April 09, 2015<br><br>
</font><h3><b>Systems Affected</b></h3><font size=3><br><br>
<ul>
<li>Microsoft Windows 95, 98, Me, 2000, XP, Vista, 7, and 8
<li>Microsoft Server 2003, Server 2008, Server 2008 R2, and Server 2012
</ul><br>
</font><h3><b>Overview</b></h3><font size=3><br><br>
AAEH is a family of polymorphic downloaders created with the primary
purpose of downloading other malware, including password stealers,
rootkits, fake antivirus, and ransomware.<br><br>
The United States Department of Homeland Security (DHS), in collaboration
with Europol, the Federal Bureau of Investigation (FBI) and the
Department of Justice (DOJ), released this Technical Alert to provide
further information about the AAEH botnet, along with prevention and
mitigation recommendations.<br><br>
</font><h3><b>Description</b></h3><font size=3><br><br>
AAEH is often propagated across networks, removable drives (USB/CD/DVD),
and through ZIP and RAR archive files. Also known as VObfus, VBObfus,
Beebone or Changeup, the polymorphic malware has the ability to change
its form with every infection. AAEH is a polymorphic downloader with more
than 2 million unique samples. Once installed, it morphs every few hours
and rapidly spreads across the network. AAEH has been used to
download other malware families, such as Zeus, Cryptolocker, ZeroAccess,
and Cutwail.<br><br>
</font><h3><b>Impact</b></h3><font size=3><br><br>
A system infected with AAEH may be employed to distribute malicious
software, harvest users' credentials for online services, including
banking services, and extort money from users by encrypting key files and
then demanding payment in order to return the files to a readable state.
AAEH is capable of defeating anti-virus products by blocking connections
to IP addresses associated with Internet security companies and by
preventing anti-virus tools from running on infected machines.
<br><br>
</font><h3><b>Solution</b></h3><font size=3><br><br>
Users are recommended to take the following actions to remediate AAEH
infections:
<ul>
<li><i>Use and maintain anti-virus software</i> - Anti-virus software
recognizes and protects your computer against most known viruses. It is
important to keep your anti-virus software up-to-date (see
<a href="http://www.us-cert.gov/ncas/tips/ST04-005">Understanding
Anti-Virus Software for more information</a>).
<li><i>Change your passwords</i> - Your original passwords may have been
compromised during the infection, so you should change them (see
<a href="http://www.us-cert.gov/ncas/tips/ST04-002">Choosing and
Protecting Passwords for more information</a>).
<li><i>Keep your operating system and application software up-to-date</i>
- Install software patches so that attackers can't take advantage of
known problems or vulnerabilities. Many operating systems offer automatic
updates. If this option is available, you should enable it (see
<a href="http://www.us-cert.gov/ncas/tips/ST04-006">Understanding Patches
for more information</a>).
<li><i>Use anti-malware tools</i> - Using a legitimate program that
identifies and removes malware can help eliminate an infection.
</ul><br>
Users can consider employing a remediation tool (examples below) that
will help with the removal of AAEH from your system.<br><br>
Note: AAEH blocks AV domain names thereby preventing infected users from
being able to download remediation tools directly from an AV company. The
links below will take you to the tools at the respective AV sites. In the
event that the tools cannot be accessed or downloaded from the vendor
site, the tools are accessible from Shadowserver
(<a href="http://aaeh.shadowserver.org">http://aaeh.shadowserver.org</a>
).<br><br>
The below are examples only and do not constitute an exhaustive list. The
U.S. Government does not endorse or support any particular product or
vendor.<br><br>
</font><h3><b>References</b></h3><font size=3><br><br>
<ul>
<li><a href="http://www.f-secure.com/en/web/home_global/online-scanner">
F-Secure Online Scanner for Windows Vista, 7 and 8</a>
<li>
<a href="http://www.f-secure.com/en/web/labs_global/removal-tools/-/carousel/view/142">
F-Secure Removal Tools for Windows XP</a>
<li><a href="http://www.mcafee.com/stinger">McAfee Stinger for Windows XP
SP2, 2003 SP2, Vista SP1, 2008, 7 and 8</a>
<li>
<a href="http://www.microsoft.com/security/scanner/en-us/default.aspx">
Microsoft Safety Scanner for Windows 8.1, Windows 8, Windows 7, Windows
Vista, and Windows XP</a>
<li><a href="http://www.sophos.com/VirusRemoval">Sophos Virus Removal for
Windows XP SP2 and above</a>
<li><a href="http://www.trendmicro.com/threatdetector">Trend Micro Threat
Detector for Windows XP, Windows Vista, Windows 7, Windows 8/8.1, Windows
Server 2003/2008, and 2008 R2</a>
</ul><br>
</font><h3><b>Revision History</b></h3><font size=3><br><br>
<ul>
<li>April 9, 2015: Initial Release
</ul><hr>
This product is provided subject to this
<a href="http://www.us-cert.gov/privacy/notification">Notification</a>
and this <a href="http://www.us-cert.gov/privacy/">Privacy & Use</a>
policy.<br>
<hr>
OTHER RESOURCES: <br>
<a href="http://www.us-cert.gov/contact-us/">Contact Us</a> |
<a href="http://www.us-cert.gov/security-publications">Security
Publications</a> | <a href="http://www.us-cert.gov/ncas">Alerts and
Tips</a> | <a href="http://www.us-cert.gov/related-resources">Related
Resources</a> <br>
STAY CONNECTED: <br>
<a href="http://public.govdelivery.com/accounts/USDHSUSCERT/subscriber/new">
<img src="https://service.govdelivery.com/banners/GOVDELIVERY/SOCIAL_MEDIA/envelope.gif" width=25 height=25 alt="Sign up for email updates">
</a> <br><br>
SUBSCRIBER SERVICES:<br>
<a href="http://public.govdelivery.com/accounts/USDHSUSCERT/subscribers/new?preferences=true">
Manage Preferences</a> |
<a href="https://public.govdelivery.com/accounts/USDHSUSCERT/subscriber/one_click_unsubscribe?verification=5.950164116ce9221a178d1afcfce6b64a&destination=w3hwn@comcast.net">
Unsubscribe</a> |
<a href="https://subscriberhelp.govdelivery.com/">Help</a><br>
<hr>
This email was sent to w3hwn@comcast.net using GovDelivery, on behalf of:
United States Computer Emergency Readiness Team (US-CERT) · 245 Murray
Lane SW Bldg 410 · Washington, DC 20598 · (888) 282-0870
<a href="http://www.govdelivery.com/portals/powered-by">
<img src="https://service.govdelivery.com/banners/GOVDELIVERY/logo_gd_poweredby.gif" width=115 height=35 alt="Powered by GovDelivery">
</a> </font></blockquote></body>
</html>