TROJ_REFROSO.AU

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System Root%\RECYCLER\S-1-5-21-9165828484-4458904799-977774283-9832\rundll32.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\RECYCLER\S-1-5-21-9165828484-4458904799-977774283-9832

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects threads into the following normal process(es):

• EXPLORER.EXE

It terminates itself if it finds the following processes in the affected system's memory:

• Process Monitor
• File Monitor
• Registry Monitor
• WireShark

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%System Root%\RECYCLER\S-1-5-21-9165828484-4458904799-977774283-9832\rundll32.exe"

Download Routine

This Trojan then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

NOTES:
It connects to a remote site to dowload a file. However, the URL where the malware will connect is not in the malware body.