TROJ_ZEGOST.IQ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Current%\ccsbb.p7b
• %Current%\check.exe - also detected as TROJ_ZEGOST.IQ
• %Windows%\Installer\{random number}.msi
• %Windows%\Installer\{709599CB-4CDD-447D-825E-9D5D3EDD4325}\_.exe
• %User Temp%\新建文件夹 (2)\bankrun.exe
• %Application Data%\中华人民共和國最高人民检察院\安全插件\bdardrv.dll
• %Application Data%\中华人民共和國最高人民检察院\安全插件\bdcore.dll
• %Application Data%\中华人民共和國最高人民检察院\安全插件\CrashReport.dll

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Windows%\Installer\{709599CB-4CDD-447D-825E-9D5D3EDD4325}
• %User Temp%\新建文件夹 (2)
• %Application Data%\中华人民共和國最高人民检察院
• %Application Data%\中华人民共和國最高人民检察院\安全插件

(Note: %Windows% is the Windows folder, which is usually C:\Windows.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\中华人民共和國最高人民检察院

HKEY_CLASSES_ROOT\Installer\Components\
6C1AB6DD283548F42B136B93C8681BB3

HKEY_CLASSES_ROOT\Installer\Components\
F0F1729FDFB0F604FB3061A694E0840B

HKEY_CLASSES_ROOT\Installer\Features\
BC995907DDC4D74428E5D9D5E3DD3452

HKEY_CLASSES_ROOT\Installer\Products\
BC995907DDC4D74428E5D9D5E3DD3452

HKEY_CLASSES_ROOT\Installer\UpgradeCodes\
34A016B5C9E3B9E43975A658053A01A2

Other Details

This Trojan adds the following lines or registry entries as part of its routine:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
• %Application Data%\中华人民共和國最高人民检察院\ 安全插件 = ""
• %Windows%\Installer\{709599CB-4CDD-447D-825E-9D5D3EDD4325} = ""
• HKEY_CLASSES_ROOT\Installer\Components\6C1AB6DD283548F42B136B93C8681BB3
• 限定符字符串 = "=rb3Ljj'$=YBN*FWR&}.>"
• HKEY_CLASSES_ROOT\Installer\Components\F0F1729FDFB0F604FB3061A694E0840B
• 限定符字符串 = "=rb3Ljj'$=YBN*FWR&}.>"
• HKEY_CLASSES_ROOT\Installer\Features\BC995907DDC4D74428E5D9D5E3DD3452
• MainFeature = ""
• HKEY_CLASSES_ROOT\Installer\Products\BC995907DDC4D74428E5D9D5E3DD3452
• ProductName = "安全插件"
• PackageCode = "D52C326865EFCEB44BFDF9DB82C3E262"
• Language = "804"
• Version = "1000000"
• Assignment = "1"
• AdvertiseFlags = "184"
• ProductIcon = "%Windows%\Installer\{709599CB-4CDD-447D-825E-9D5D3EDD4325}\_.exe"
• InstanceType = "0"
• AuthorizedLUAApp = "0"
• DeploymentFlags = "3"
• Clients = ":"
• HKEY_CLASSES_ROOT\Installer\UpgradeCodes\34A016B5C9E3B9E43975A658053A01A2
• BC995907DDC4D74428E5D9D5E3DD3452 = ""

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %Windows% is the Windows folder, which is usually C:\Windows.)

It connects to the following possibly malicious URL:

• http://www.download{BLOCKED}date.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
• http://www.download{BLOCKED}date.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab