TROJ_DROPPR.XQ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following file(s)/component(s):

• %User Temp%\RarSFX0\update.bat - Executes the dropped copy
• %User Temp%\RarSFX1\1.exe - Also detected as TROJ_DROPPR.XQ
• %User Temp%\uDwn-FSRQ\config.bip - Contains configuration for 1.crx
• %User Temp%\uDwn-FSRQ\whoviewsfm.xpi - Firefox extension
• %User Temp%\uDwn-FSRQ\1.crx - Detected as JS_CHROMEX.AI
• %User Temp%\uDwn-FSRQ\install.rdf - Contains installation information
• %All Users Profile%\Application Data\1\1.crx - Detected as JS_CHROMEX.AI
• %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\hoverst@facebook.com\chrome.manifest
• %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\hoverst@facebook.com\content\prefman.js
• %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\hoverst@facebook.com\content\script-compiler-overlay.xul
• %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\hoverst@facebook.com\content\script-compiler.js
• %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\hoverst@facebook.com\content\skin\icon.png
• %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\hoverst@facebook.com\content\xmlhttprequester.js

It drops the following copies of itself into the affected system:

• %User Temp%\RarSFX0\1.sfx.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\Mozilla\Firefox\Profiles\4wwmjcqo.default\extensions\hoverst@facebook
• %All Users Profile%\Application Data\1
• %User Temp%\RarSFX0
• %User Temp%\RarSFX1
• %User Temp%\uDwn-FSRQ

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %All Users Profile% is the All Users or Common profile folder, which is C:\Documents and Settings\All Users in Windows 2000, XP, and Server 2003, and C:\ProgramData in Windows Vista and 7.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKLM\SOFTWARE\Google\
Chrome\Extensions\{random letters}
path = "%All Users Profile%\Application Data\1\1.crx"

HKLM\SOFTWARE\Google\
Chrome\Extensions\{random letters}
version = "1.0.0"

It adds the following registry keys as part of its installation routine:

HKCU\Software\Microsoft\
Windows\CurrentVersion\Explorer\
BitBucket
c =

HKLM\SOFTWARE\Google
Chrome =

HKLM\SOFTWARE\Google\
Chrome
Extensions =

HKLM\SOFTWARE\Google\
Chrome\Extensions
{random letters} =

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows
CurrentVersion =

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows\CurrentVersion
Internet Settings =

NOTES:

It terminates running Google Chrome and Mozilla Firefox processes. It then opens a new Google Chrome window.