This malware follows the lines of previously discovered highly sophisticated programs such as Stuxnet, Flame and Duqu which all have targeted the Middle East in particular.
Kaspersky has published an in depth analysis of Gauss on Securelist which provides background information and a summary at the beginning. According to Kaspersky’s information, Gauss was first distributed back in the September to October months of 2011. And just like it has been with other malware of its type, it took security companies more than six months to discover the malware and begin analysis of it.
One of the reasons for this is that the malware has been used to target individuals in specific countries with the Lebanon, Israel and Palestine being targeted the most with the Lebanon topping the list by a wide margin. According to Kaspersky, Gauss uses the same exploit that Stuxnet was using, but in a more effective manner.
The module masks the Trojan’s files on the USB drive without using a driver. It does not infect the system: information is extracted from it using a spy module (32- or 64-bit) and saved on the USB drive.
The primary purpose of Gauss is to collect information and send those information to servers. The trojan can for instance intercept user sessions in browsers and steal passwords, cookies and the browser history, collect information about the computers hardware, the processes and folders of the operating system, and information about local, network and removable drives. It in addition can infect USB Flash drives with a “spy module” to spread to other computer systems and extract information from those systems as well.
The attack users various modules to collect data, infiltrate web browsers and communicate with a master server.
|Cosmos||%system32%\devwiz.ocx||Collects information about CMOS, BIOS|
|Kurt, Godel||%system32%\dskapi.ocx||Infects USB drives with data-stealing module|
|Tailor||%system32%\lanhlp32.ocx||Collects information about network interfaces|
|McDomain||%system32%\mcdmn.ocx||Collects information about user’s domain|
|UsbDir||%system32%\smdk.ocx||Collects information about computer’s drives|
|Lagrange||%system32%\windig.ocx||Installs a custom ‘Palida Narrow’ font|
|Gauss||%system32%\winshell.ocx||Installs browser plugins that collect passwords and cookies|
|Main loader and communication module|
One interesting aspect of Gauss is that it is designed to specifically steal and monitor data related to online transactions, such as those with banks or PayPal. While it would have been certainly in the realm of possibility that Gauss has been designed to steal money from individuals, it is more likely that it is information the attackers were after. Bank transactions reveal a lot about potential targets, not only about funding but also contact related.
All Kaspersky products are detecting the Gauss trojan by now. If you do not use a Kaspersky product you can use the file names and locations in the table above, or contact your antivirus vendor to find out if Gauss is also detected by its products.
It is highly recommended to install security patches as soon as they get released. Chekc out our Windows Update overview here for additional information on how that is done under Windows.