TROJ_NEBULER.SMK

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

It opens a hidden Internet Explorer window.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following non-malicious files:

• %Current Directory%\{malware name}.bat – used to delete the executed malware and batch file
• %System%\passed.txt – non malicious text file

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It injects itself into the following processes as part of its memory residency routine:

• IEXPLORE.EXE

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MSSMSGS = "rundll32 {malware path and filename},SpXapbF"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSSMGR
Data = {dword value}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSSMGR
LSTV = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSSMGR
BSTV = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSSMGR
MSLIST = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSSMGR
Brnd = {dword value}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSSMGR
SSTV = {hex values}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MSSMGR
SCLIST = {hex values}

Propagation

This Trojan does not have any propagation routine.

Download Routine

This Trojan connects to the following malicious URLs:

• http://{BLOCKED}fseher.net/img/cmd.php
• http://{BLOCKED}ft.net/img/cmd.php

Other Details

This Trojan opens a hidden Internet Explorer window.

NOTES:

The downloaded file is saved in %User Temp% directory.

However, during testing, no files were downloaded.

It creates the following mutex to ensure that only one instance of itself is running in memory:

• m3d5rt10

Retry
del "c:\_virus\winwki32.dll"
if exist "c:\_virus\winwki32.dll" goto Retry
del "c:\_virus\winwki32.bat"
exit

This malware does not have rootkit capabilities.

This malware does not exploit any vulnerability.