Trend Micro - Securing Your Journey to the Cloud Business
Support
Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Emerging Threat on TSPY_BEBLOH

    • Updated:
    • 7 Jul 2016
    • Product/Version:
    • Deep Discovery Analyzer 5.5
    • Deep Discovery Email Inspector 2.5
    • Deep Security 8.0
    • Deep Security 9.0
    • Deep Security 9.6
    • Hosted Email Security 2.0
    • InterScan Messaging Security Virtual Appliance 8.2
    • InterScan Messaging Security Virtual Appliance 8.5
    • InterScan Messaging Security Virtual Appliance 9.0
    • InterScan Messaging Security Virtual Appliance 9.1
    • InterScan Web Security Virtual Appliance 5.6
    • InterScan Web Security Virtual Appliance 6.0
    • OfficeScan 10.6
    • OfficeScan 11.0
    • ScanMail for Exchange 8.0 2000/2003/2007
    • ScanMail for Lotus Domino 5.0 AIX
    • ScanMail for Lotus Domino 5.0 Windows
    • ScanMail for Lotus Domino 5.0 zLinux
    • Worry-Free Business Security Standard/Advanced 9.0
    • Platform:
    • N/A N/A
Summary

BEBLOH is a spyware that monitors a machine and can steal sensitive information and send gathered information to a remote server. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It executes the downloaded files and, as a result, malicious routines of the downloaded files are exhibited on the affected system.

It also gathers information and reports it to its servers.

BEBLOH Infection Chain

Click image to enlarge.

Antispam Pattern

LAYERDETECTIONPATTERN VERSIONRELEASE DATE
EXPOSUREAll related email samplesAS12821/25/2015

VSAPI Pattern (Malicious File Detection)

LAYERDETECTIONPATTERN VERSIONRelease Date
INFECTIONTSPY_BEBLOH.SMMOPR 12.4093/17/2016
INFECTIONTSPY_BEBLOH.SMM1OPR 12.4073/16/2016
INFECTIONTSPY_BEBLOH.SMM2OPR 12.4073/16/2016
INFECTIONMal_BEBLOH-1OPR 12.54705/24/16
INFECTIONMal_BEBLOH-2OPR 12.54705/24/16

WRS Pattern (Malicious URL and Classification)

LAYERURLScoreBlocking Date
CLEAN-UPuswmrmsu1fgdmm{blocked}.netC&C3/2/2016
CLEAN-UPespedidasalacarta{blocked}.com/ontv.exeDisease Vector3/10/2016

AEGIS Pattern (Behavior Monitoring Pattern)

LAYERDetectionPattern VersionRelease Date
DYNAMIC1933QOPR 155506/21/16 (Batch 1)

Network Pattern

LAYERDetectionPattern VersionRelease Date
CLEAN-UPHTTP_BEBLOH_REQUEST-2RR 1.10155.004/13/2016DYNAMIC
 
Make sure to always use the latest pattern available to detect the old and new variants of TSPY_BEBLOH.
Details
Public

Solution Map - What should customers do?

Major ProductsVersionsVirus PatternBehavior MonitoringWeb ReputationDCT PatternAntispam PatternNetwork Pattern
OfficeScan10.6 and above








Update Pattern via web console


Update Pattern via web console








Enable Web Reputation Service*


Update Pattern via Web console

Not Applicable		Update Pattern via Web console
Worry Free Business SuiteStandard

Not Applicable
Advanced/MessagingUpdate Pattern via web console
Hosted
Deep Security8.0 and above



Not Applicable		Update Pattern via Web consoleNot ApplicableUpdate Pattern via Web console
ScanMailSMEX 10 and later



Not Applicable

Update Pattern via Web console

Not Applicable
SMD 5 and later
InterScan MessagingIMSVA 8.0 and above
InterScan WebIWSVA 6.0 and later
Deep DiscoveryDDI 3.0 and later
Not Applicable		Update Pattern via web console
DDAN
DDEI
 
* Refer to the Product Administrator’s Guide on how to enable the Email Reputation or Web Reputation services features.

Recommendations:

Threat Report

Premium
Internal
Rating:
Category:
Remove a Malware / Virus; Update; SPEC
Solution Id:
1114554
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.