Made-to-measure attacks delivered in a Word document
26 June, 2005

PandaLabs reports the recent discovery of a surprising new Trojan, Sikou.A, which is extremely versatile and sophisticated and uses a Microsoft Word document to spread. This Trojan exploits a vulnerability that allows it to run arbitrary code in a large number of Microsoft Office applications. This Trojan has been found in a Word document designed to exploit the MS03-037 vulnerability reported by Microsoft, which allows the Trojan to run as soon as the user opens the Word document. When it is run, Sikou.A installs itself. To do this, it copies itself to the system directory and installs two files, one of which contains the Trojans functions. The other file is a driver that allows the Trojan to hide its activity from the user, making it extremely difficult to detect this malware.

Recently, several attacks on companies that aim to steal information using Trojans or other malware have been reported, such as the attacks on Israeli companies (currently subject to legal proceedings). Whats more, malware with customizable functions are appearing more frequently (such as the recent Rona Trojan), fuelling the idea that financial gain is now the motive for computer hackers. More information is available at http://www.pandasoftware.com.

Reprinted by permission of Integrated mar.com (integratedmar.com), EchannelLine © Copyright 2005 Integratedmar.com Corporation.