# MA-386.042014: MyCERT Advisory - Spear Phishing Attacked Related to MH370 Plane

**Date:** 18 Apr 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-386.042014  
**Advisory ID:** MA-386.042014

---

**1.0 Introduction**
Recently MyCERT had been receiving several reports from organizations within the constituency regarding the circulation of a suspicious email that takes advantage of the missing MH370 plane. The email is purportedly from an Investigation Team of a Malaysian Department which includes a suspicious attachment. Clicking on the attachment will launch a fake MH370 missing flight transcript and will also drop other malicious files in the victim machine. The transcript serves to lure and entice recipients to click on the attachment.
**2.0 Affected Systems**
The malware will infect the below platforms:
- Windows 2000
- Windows Server 2003
- Windows XP (32-bit, 64-bit)
- Windows Vista (32-bit, 64-bit)
- Windows 7 (32-bit, 64-bit)
- Windows 8 (32-bit, 64-bit)
**3.0 Impact**
The infected computer allow attacker to remotely control the computer to do various command. The malware gathers information about the IP address and hostname of the infected computer.
**4.0 Brief Description**
The malware is a Trojan and is known as Kloak-A by Sophos Anti-virus which spreads through email.Once infected on the victim machine, the malware will pick random email addresses in the infected machine’s Address Book and will send an infected email to random addresses.
- The suspicious email arrives with the below Subject:
**Announcement of President to the Council (PRES OBA/2289)through ICAO Portal  (MAS)**
- The Email is From:
**Investigation Team**
- Sample Email:
*Figure 1: Sample Email*
> The email contains random filenames with either a .ZIP file or a .RAR file which is password protected. The password is already provided in the email itself. This malicious code program has several capabilities and characteristic which includes command and control capabilities. Clicking on the attachment will launch PDF file with fake MH370 Missing Flight Transcript. The malware also takes advantage of current news event and has capabilities to generate fake SSL certificate.
- Below is attached a sample of partial fake transcript.
*Figure 2: Sample Shown Partial Fake Transcriptin PDF file.*5.0 Detection**
Any updated version of Anti-virus software is able to detect the presence of this malware in an infected machine.
- Install and update Anti-virus software in the computer.
- Run the updated version of Anti-virus software on the infected machine to scan and detect the malware.
**6.0 Recovery**
Machines that had been infected with this malware can be cleaned using an updated version of Anti-virus software. Cleaning steps are as below:
- Disconnect the infected machine from the network.
- Disable System Restore. Please refer here on how to disable System restore:
<http://www.mcafee.com/us/downloads/free-tools/disabling-system-restore.aspx>
- Run an updated version of Anti-virus software to scan, detect and remove the malware
- Re-scan the infected machine with an updated version of Anti-Virus to make sure the machine has been cleaned properly.
- Enable System Restore
- Re-connect the machine to the network.
- Appy preventive measures to prevent re-infection.
- Monitor the situation from time to time and take necessary action accordingly.
**7.0 Preventive**
- System Administrators are advised to apply Anti-virus filters at organizations' email gateway to block the emails that contain malware infected attachments.
- System Adminstrators are advised to block attachments with the following extensions, .ZIP, .RAR, .EXE, .PIF, .SCR, .BAT and attachments with double extensions at the email gateways.
- End users should always practise safe email practices. Guides on safe email practices is available at:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=96fa0022-2ca9-47cb-975f-0d1225cc278e
)
- Users are advised to avoid passing pass around any unverified messages 
- Users are advised not to click or open any attachments they receive via emails or via social media channles as the attachment may contains malware. It is best practice to always scan the attachment with an updated version of Anti-virus software and to make sure the attachment is confirmed clean from any malware, prior to open the attachment.
- MyCERT also advises users to install the latest security updates for their computers and make sure their Anti-virus software is updated with latest signature files.
- Users who received suspicious emails, attachments or URLs can forward them to MyCERT for further analysis.
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. If users have any enquiries on this matter, please reach us through the following channels:
E-mail :[[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 on call incident reporting)
SMS : CYBER999 REPORT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: [https://twitter.com/mycert‎](https://twitter.com/mycertâ€Ž)
**8.0 References**
- <http://www.class-analyzer.net/analysis/9688/0/rhtml>
- <http://blog.trendmicro.com/trendlabs-security-intelligence/targeted-attack-campaign-hides-behind-ssl-communication/>
- <http://www.fireeye.com/blog/technical/malware-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html>
- <http://www.mcafee.com/us/downloads/free-tools/disabling-system-restore.aspx>