TROJ_ROPEST.NBF

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It modifies the Internet Explorer Zone Settings. It lowers the security setting of Internet Explorer.

As of this writing, the said sites are inaccessible.

It connects to certain websites to send and receive information. However, as of this writing, the said sites are inaccessible. It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %User Temp%\tmp{random number and/or letter}.exe - deleted afterwards
• %Application Data%\Microsoft\Windows\IEUpdate\{random name}.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders with attributes set to System and Hidden to prevent users from discovering and removing its components:

• %Application Data%\Microsoft\Windows\IEUpdate

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Control Panel\Desktop
SCRNSAVE.EXE = "%Application Data%\Microsoft\Windows\IEUpdate\{random name}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Command Processor
AutoRun = "%Application Data%\Microsoft\Windows\IEUpdate\{random name}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
{random name} = "%Application Data%\Microsoft\Windows\IEUpdate\{random name}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
Run = "%Application Data%\Microsoft\Windows\IEUpdate\{random name}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random name} = "%Application Data%\Microsoft\Windows\IEUpdate\{random name}.exe"

It drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %Start Menu%\Programs\Startup\{random name}.lnk

(Note: %Start Menu% is the Start Menu folder, where it usually is C:\Documents and Settings\{user name}\Start Menu on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer
GlobalUserOffline = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
NoProtectedModeBanner = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
DisableScriptDebuggerIE = "yes"

It modifies the following registry entries to hide files with Hidden attributes:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "0"

(Note: The default value data of the said registry entry is "1".)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

(Note: The default value data of the said registry entry is "1".)

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Web Browser Home Page and Search Page Modification

This Trojan modifies the Internet Explorer Zone Settings.

It lowers the security setting of Internet Explorer.

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• http://{BLOCKED}.{BLOCKED}.16.67:5051/gf

It saves the files it downloads using the following names:

• %User Temp%\tmp{random number and/or letter}.tmp

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

As of this writing, the said sites are inaccessible.

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.16.15
• http://{BLOCKED}.{BLOCKED}.16.146:8080/pgt/?ver={malware version}&id={malware id}&r={date & time hash}&os={operating system and mshtml.dll version}&res={installed memory size and memory usage}&f={0 or 1}
• http://{BLOCKED}.{BLOCKED}.16.72:8080/pgt/?ver={malware version}&id={malware id}&r={date & time hash}&os={operating system and mshtml.dll version}&res={installed memory size and memory usage}&f={0 or 1}
• http://{BLOCKED}.{BLOCKED}.2.20:8080/pgt/?ver={malware version}&id={malware id}&r={date & time hash}&os={operating system and mshtml.dll version}&res={installed memory size and memory usage}&f={0 or 1}

It requires the existence of the following files to properly run:

• %System Root%\asterope.txt

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It sets the attributes of the following file(s) to Hidden and System:

• %Application Data%\Microsoft\Windows\IEUpdate\{random name}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It does the following:

• Perform click-fraud
• Send system information
• Update Adobe Flash Player
• Delete all files and folders in the %User Temp% folder.
• Execute the command cmd.exe /c ping 127.0.0.1
• Accept parameter in the form of path and name of target file to delete

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

However, as of this writing, the said sites are inaccessible.

It deletes the initially executed copy of itself

NOTES:

{random name} can be any file name from the %System% (usually C:\Windows\system32) folder except for file name with the following strings:

• update
• setup
• install

It does not have rootkit capabilities.

It does not exploit any vulnerability.