Trojan.DownLoader23.60762

SHA1:

ab67dfe418c4f2871f2d05acea412fdea43c4cae

Windows Trojan designed to download other files on the infected device, steal logins and passwords saved in a browser and intercept data entered into various forms on websites.

After the launch, it searches for fragments of malicious code in its own process using signatures and checks its environment for the presence of virtual machines.

To steal confidential information, it injects itself in the process of Windows Explore and processes of such browsers as Microsoft Internet Explorer, Mozilla Firefox and Google Chrome. In browsers, it intercepts functions responsible for operation with network.

Executes the following commands:

Launch file from the temporary folder on the disk of the infected computer;
Inject in a running process;
Delete particular file;
Launch particular executable file;
Save an sqlite database, used by Google Chrome, and send it to cybercriminals;
Change the command and control server to the specified one;
Delete cookies;
Restart operating system;
Turn off the computer.

Technical information

To ensure its autorun and to spread, the Trojan does the following:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%ProgramFiles%\ebaurodr\mhrhcrji.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'conhost' = '"%APPDATA%\adobe\svchost.exe"'

Creates or modifies the following files:

%HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe

It creates the following files on the removable media:

<Removable media disk name>:\RECYCLER\S-1-2-78-8461461661-1125588206-440587871-3261\EyZUXsWR.cpl
<Removable media disk name>:\autorun.inf
<Removable media disk name>:\RECYCLER\S-1-2-78-8461461661-1125588206-440587871-3261\EyZUXsWR.cpl

Malicious functions:

Executes the following:

'%APPDATA%\Keylogger.exe'
'<SYSTEM32>\ping.exe' 127.0.0.1 -n 2
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\216015.bat" "%APPDATA%\Pony.exe" "
'%APPDATA%\scvhost.exe'
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\install.bat" "
'%APPDATA%\svchost.exe'
'%APPDATA%\Pony.exe'
'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE'
'%APPDATA%\svchostmgr.exe'

Injects the malicious code into

the following user processes:

IEXPLORE.EXE

Searches for registry branches responsible for storage of passwords by third-party programs:

[<HKLM>\SOFTWARE\Robo-FTP 3.7\FTPServers]
[<HKCU>\SOFTWARE\Robo-FTP 3.7\Scripts]
[<HKCU>\Software\FlashPeak\BlazeFtp\Settings]
[<HKCU>\SOFTWARE\Robo-FTP 3.7\FTPServers]
[<HKLM>\SOFTWARE\Robo-FTP 3.7\Scripts]
[<HKLM>\Software\SimonTatham\PuTTY\Sessions]
[<HKCU>\Software\CoffeeCup Software]
[<HKCU>\Software\LinasFTP\Site Manager]
[<HKCU>\Software\SimonTatham\PuTTY\Sessions]
[<HKLM>\Software\South River Technologies\WebDrive\Connections]
[<HKCU>\Software\FTPClient\Sites]
[<HKLM>\Software\FTPClient\Sites]
[<HKCU>\SOFTWARE\NCH Software\Fling\Accounts]
[<HKLM>\SOFTWARE\NCH Software\Fling\Accounts]
[<HKCU>\Software\SoftX.org\FTPClient\Sites]
[<HKLM>\Software\Martin Prikryl]
[<HKCU>\Software\South River Technologies\WebDrive\Connections]
[<HKLM>\Software\SoftX.org\FTPClient\Sites]
[<HKCU>\Software\Martin Prikryl]
[<HKLM>\Software\CoffeeCup Software]
[<HKLM>\Software\RIT\The Bat!\Users depot]
[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Software\RIT\The Bat!\Users depot]
[<HKLM>\Software\RIT\The Bat!]
[<HKCU>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
[<HKLM>\Software\Microsoft\Internet Account Manager]
[<HKCU>\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts]
[<HKCU>\Software\RIT\The Bat!]
[<HKLM>\Software\Nico Mak Computing\WinZip\FTP]
[<HKCU>\Software\Nico Mak Computing\WinZip\mru\jobs]
[<HKCU>\Software\MAS-Soft\FTPInfo\Setup]
[<HKCU>\Software\Nico Mak Computing\WinZip\FTP]
[<HKLM>\Software\Nico Mak Computing\WinZip\mru\jobs]
[<HKCU>\Software\RimArts\B2\Settings]
[<HKLM>\Software\RimArts\B2\Settings]
[<HKCU>\Software\Microsoft\Windows Live Mail]
[<HKCU>\Software\Microsoft\Windows Mail]
[<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\GlobalSCAPE\CuteFTP 8 Home\QCToolbar]
[<HKCU>\Software\GlobalSCAPE\CuteFTP 8 Professional\QCToolbar]
[<HKCU>\Software\GlobalSCAPE\CuteFTP 7 Home\QCToolbar]
[<HKCU>\Software\GlobalSCAPE\CuteFTP 7 Professional\QCToolbar]
[<HKCU>\Software\FlashFXP\3]
[<HKLM>\Software\FlashFXP]
[<HKCU>\Software\FileZilla]
[<HKCU>\Software\FlashFXP]
[<HKLM>\Software\FlashFXP\3]
[<HKCU>\Software\GlobalSCAPE\CuteFTP 6 Professional\QCToolbar]
[<HKCU>\Software\Far2\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Far Manager\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Far Manager\Plugins\FTP\Hosts]
[<HKCU>\Software\Far\SavedDialogHistory\FTPHost]
[<HKCU>\Software\Ghisler\Windows Commander]
[<HKLM>\Software\Ghisler\Total Commander]
[<HKCU>\Software\GlobalSCAPE\CuteFTP 6 Home\QCToolbar]
[<HKLM>\Software\Ghisler\Windows Commander]
[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\FileZilla Client]
[<HKCU>\Software\FTPWare\COREFTP\Sites]
[<HKCU>\Software\FTP Explorer\FTP Explorer\Workspace\MFCToolBar-224]
[<HKCU>\Software\Sota\FFFTP\Options]
[<HKCU>\Software\CoffeeCup Software\Internet\Profiles]
[<HKCU>\Software\FTP Explorer\Profiles]
[<HKCU>\Software\ExpanDrive\Sessions]
[<HKLM>\Software\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\VanDyke\SecureFX]
[<HKCU>\Software\Cryer\WebSitePublisher]
[<HKCU>\Software\Sota\FFFTP]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Main]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Main]
[<HKLM>\Software\FileZilla]
[<HKLM>\Software\FileZilla Client]
[<HKCU>\Software\BPFTP\Bullet Proof FTP\Options]
[<HKCU>\Software\TurboFTP]
[<HKLM>\Software\TurboFTP]
[<HKCU>\Software\BulletProof Software\BulletProof FTP Client\Options]
[<HKCU>\Software\BPFTP]

Searches for the following windows in order to

detect tools for analysis:

ClassName: 'PROCEXPL', WindowName: ''

Changes in the file system:

Creates the following files:

%TEMP%\~TM1F.tmp
%TEMP%\install.bat
%ProgramFiles%\Internet Explorer\dmlconf.dat
%TEMP%\~TM20.tmp
%APPDATA%\adobe\svchost.exe
%APPDATA%\svchost.exe
%APPDATA%\Pony.exe
%APPDATA%\svchostmgr.exe
%APPDATA%\Keylogger.exe
%ProgramFiles%\ebaurodr\mhrhcrji.exe
%TEMP%\Cab2A.tmp
%TEMP%\Cab28.tmp
%TEMP%\Cab2E.tmp
%TEMP%\Cab2C.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab22.tmp
%APPDATA%\scvhost.exe
%TEMP%\Cab24.tmp
%TEMP%\216015.bat
%TEMP%\Cab5.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab9.tmp
%TEMP%\Cab7.tmp
%TEMP%\Cab1.tmp
%APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
%APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
%APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
%TEMP%\CabB.tmp
%TEMP%\Cab19.tmp
%TEMP%\Cab17.tmp
%TEMP%\Cab1D.tmp
%TEMP%\Cab1B.tmp
%TEMP%\Cab15.tmp
%TEMP%\CabF.tmp
%TEMP%\CabD.tmp
%TEMP%\Cab13.tmp
%TEMP%\Cab11.tmp

Assigns the attribute “hidden” to the following files:

%HOMEPATH%\Start Menu\Programs\Startup\mhrhcrji.exe
%APPDATA%\adobe\svchost.exe

Deletes the following files:

%TEMP%\~TM20.tmp
%TEMP%\Cab22.tmp
%APPDATA%\Pony.exe
%TEMP%\Cab1B.tmp
%TEMP%\Cab1D.tmp
%TEMP%\~TM1F.tmp
%TEMP%\Cab2A.tmp
%TEMP%\Cab2C.tmp
%TEMP%\Cab2E.tmp
%TEMP%\Cab24.tmp
%TEMP%\Cab26.tmp
%TEMP%\Cab28.tmp
%TEMP%\Cab19.tmp
%TEMP%\Cab7.tmp
%TEMP%\Cab9.tmp
%TEMP%\CabB.tmp
%TEMP%\Cab1.tmp
%TEMP%\Cab3.tmp
%TEMP%\Cab5.tmp
%TEMP%\Cab13.tmp
%TEMP%\Cab15.tmp
%TEMP%\Cab17.tmp
%TEMP%\CabD.tmp
%TEMP%\CabF.tmp
%TEMP%\Cab11.tmp

Network activity:

Connects to:

'pr###liks.com':443
'st###oliks.com':443
'fk#####feew32233.com':443
'po###liks.com':443
'74.##5.232.51':80
'ca#####.digicert.com':80
'wp#d':80
'em####ostings.in':80
'www.download.windowsupdate.com':80

TCP:

HTTP GET requests:

http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
http://ca#####.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
http://11#.#11.111.1/wpad.dat via wp#d
http://ca#####.digicert.com/DigiCertAssuredIDRootCA.crt

HTTP POST requests:

http://em####ostings.in/wp-admin/css/Panel/gate.php

UDP:

DNS ASK pr###liks.com
DNS ASK st###oliks.com
DNS ASK fk#####feew32233.com
DNS ASK po###liks.com
DNS ASK google.com
DNS ASK ca#####.digicert.com
DNS ASK wp#d
DNS ASK em####ostings.in
DNS ASK www.download.windowsupdate.com

Other:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: ''

News about the Trojan

Technologies

Terminology

Training and education

Myths

SHA1:

Technical information

Curing recommendations

Free trial