BARTALEX is a macro script embedded in a Microsoft document file. It usually arrives as an attachment on spam mails. User has to open the attachment and enable execution of macro in Microsoft Office in order for the macro script to execute. It uses pure social engineering trick wherein it appears to be as a mail about a fax, wire transfer, parcel, invoice or billing statements. No exploit was used.
| Detection | URL | Published date / time (GMT +8) |
|---|---|---|
| W2KM_BARTALEX.EU | http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/w2km_bartalex.eu | March 7, 2015 |
| W2KM_BARTALEX.SM | http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/w2km_bartalex.sm | March 31, 2015 |
| W2KM_BARTALEX.VVQV | http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/w2km_bartalex.vvqv | April 22, 2015 |
| W2KM_BARTALEX.SMA | http://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/w2km_bartalex.sma | May 6, 2015 |
Solution Map
| Major Products | Versions | Virus Pattern | Behavior Monitoring | Email Reputation | AntiSpam Pattern | Web Reputation | DDI Pattern |
|---|---|---|---|---|---|---|---|
| OfficeScan | 10.6 and above | Update Pattern via web console | Update Pattern via web console | N/A | N/A | Enable Web Reputation Service* | N/A |
| Deep Security | 8.0 and above | N/A | N/A | N/A | N/A | ||
| ScanMail | SMEX 10 and later | N/A | Enable Email Reputation Service* | Update Pattern via web console | N/A | ||
| SMD 5 and later | N/A | N/A | N/A | ||||
| InterScan Messaging | IMSVA 8.0 and above | N/A | Enable Email Reputation Service* | N/A | |||
| InterScan Web | IWSVA 6.0 and later | N/A | N/A | N/A | N/A | ||
| Deep Discovery | DDI 3.0 and later | N/A | N/A | N/A | Update Pattern via web console |
Recommendations
User Education
- Ensure that the Trend Micro Products are updated.
- Always check who the email sender is. If the email is supposedly coming from a bank, verify with your bank if the received message is legitimate. If from personal contacts, confirm if they sent the message. Do not rely solely on trust by virtue of relationship, as your friend or family member may be a victim of spammers as well.
- Double check the content of the message. There are obvious factual errors or discrepancies that you can spot: a claim from a bank or a friend that they have received something from you. Try to go to your recently sent items to double check their claim. Spam messages can also use other social engineering lures to persuade users to open the message.
- Refrain from clicking links in email. In general, clicking on links in email should be avoided. It is more safe to visit any site mentioned in email directly. If you have to click on a link in email, make sure your browser uses web reputation to check the link, or use free services such as Trend Micro Site Safety Center.
- Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task.
- Be aware of social engineering attacks to be safe.
Configuration Best Practices
-
Best practices in configuring OfficeScan for malware protection
- Some malwares arrive as email attachment of spam email messages that use social engineering method to lure users to open and execute it. You can refer to the article Filtering and blocking email attachments using Trend Micro's messaging products.
- For ERS Advance service (IP reputation) users, make sure that this feature is enabled and QIL is at least set to level 2. You can refer to the article Setting the Quick IP List (QIL) Filtering Level for IP Reputation.
- For IMSVA users and during an outbreak, we advise the clients to create a policy that would block executables and archive document and zip files which will be submitted to support for further analysis. You can refer to the articles Blocking emails with attached EXE files and Archive emails with a Word document or a zip file attached.
The policies above are usually placed after the following rules:
- Spam rule
- Antivirus rule
- Client’s other customize rule (optional)
The objective is to reject all known spam mails and known malwares and at the same time, get a high confidence sample file that will be submitted to support for further analysis.
Sample Collection
- To ensure that new variants of this malware family is detected, we need to continue collecting samples so it can be submitted for analysis and added to the patterns and solutions if needed.
- This is best done by filtering and blocking email attachments using Trend Micro's Messaging products. You may refer to this link for information on typical file types that carries the said malware.
The link above you should give you an idea on what type of sample files can be collected during an outbreak.
- When collecting a sample spam mail with possible BARTALEX involvement, please make sure to send the actual or original spam mail and not the forwarded spam.
- Collect and submit spam and all quarantined samples for sourcing and analysis.
For new cases you may upload 1 ZIP or RAR file (up to 50 MB) that is protected with the password "virus" to this link.
FTP will be helpful for other samples. ZIP or RAR files that is protected with the password "virus"
SMEX and WFBS-Messaging Security Agent Quarantined mails
Please resend all quarantined mails from MSA or SMEX server side to specific recipient for sourcing. To resend a message that is displayed in the Quarantine Log, place a checkmark in the box corresponding to that message’s row in the log and then click Resend.
Spam from client side can be pulled out from either spam folder or junkmail.folders.
IMSVA Quarantined mails
For IMSVA please download the files from the IMSVA console > Mail Areas & Queues > Query > Quarantine tab. Display logs then click specific emails to download copies.
- If Trend Micro product, ATTK scan and other Trend Micro anti-malware tools did not find or detect any malwares, do the procedure described in the link to collect suspicious samples and system information.
- Normal filtering configuration should be reverted once the alert has passed
Related blog entries
