Trojan.Win32.CONVAGENT.0NA103AQ24

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Favorites%\{Random Character}.url
• %User Temp%\Temp\{Random Character}.tmp
• %User Temp%\{Random Character}TMP\{Random Character}.tmp
• %Favorites%\淘宝购物\icon.ico
• %Favorites%\驴家旅游\icon.ico
• %Favorites%\淘宝购物\Desktop.ini
• %Favorites%\驴家旅游\Desktop.ini
• %User Temp%\{Random Character}.tmp → Deleted afterward
• %User Temp%\fbinst.dll → Deleted afterward

(Nota: %Favorites% es la carpeta Favoritos del usuario activo, que en el caso de Windows 98 y ME suele estar en C:\Windows\Favorites, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Favoritos, en Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Favoritos y en Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\Favorites).

Agrega los procesos siguientes:

• %AppDataLocal%\{Random Character}TMP\Fav~Url.tmp -y -o"%Favorites%"
• %System%\cmd.exe /c %User Temp%\fbinst.dll "%System%\uqdOnce\SUPPORT.IM_" output IMG/* %~nx
• %System%\cmd.exe /c ping 127.0.0.1 -n 50® add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www.{BLOCKED}0.com/?3" /f
• %System%\cmd.exe /c ping 127.0.0.1 -n 3&del /q "{Malware File Path}"
• reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d "http://www..{BLOCKED}0.com/?3" /f

Técnica de inicio automático

Modifique las siguientes entradas de registro para garantizar su ejecución automática cada vez que se inicia el sistema:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
ctfmon.exe = %System%\ctfmon.exe

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache
DependOnService = Tcpip, Afd

HKLM\SYSTEM\ControlSet001\
services\Apache
Description = Apache/2.2.19 (Win32) PHP/5.2.9-1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache
DisplayName = Apache

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache
ImagePath = "%Windows%\Apache\bin\httpd.exe" -k runservice

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache
ObjectName = LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache
Type = 16

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache\Parameters
ConfigArgs = -f, %Windows%\Apache\conf\httpd.conf, -d, %Windows%\Apache\.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache\Security
Security = {Hex values}

Otros detalles

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CURRENT_USER\Software\360safe

HKEY_CURRENT_USER\Software\360safe\
360se

HKEY_CURRENT_USER\Software\360

HKEY_CURRENT_USER\Software\360\
360se3

HKEY_CURRENT_USER\Software\360\
360se5

HKEY_CURRENT_USER\Software\360\
360se5\default

HKEY_CURRENT_USER\Software\360\
360se5\default\LastUrls

HKEY_CURRENT_USER\Software\360\
360se5\default\option

HKEY_CURRENT_USER\Software\360chrome

HKEY_CURRENT_USER\Software\360chrome\
Homepage

HKEY_CURRENT_USER\Software\360chrome\
Homepage\Default

HKEY_CURRENT_USER\Software\360\
360se6

HKEY_CURRENT_USER\Software\360\
360se6\Chrome

HKEY_CURRENT_USER\Software\360\
360se5\default\Wnd

HKEY_CURRENT_USER\Software\360\
360se5\default\Search

HKEY_CURRENT_USER\Software\360\
360se5\default\main

HKEY_CURRENT_USER\Software\PPStream

HKEY_CURRENT_USER\Software\PPStream\
main

HKEY_CURRENT_USER\Software\Baidu

HKEY_CURRENT_USER\Software\Baidu\
BaiduBrowser

HKEY_CURRENT_USER\Software\Baidu\
BaiduBrowser\updateinfo

HKEY_LOCAL_MACHINE\SOFTWARE\360SD

HKEY_LOCAL_MACHINE\SOFTWARE\360Safe

HKEY_LOCAL_MACHINE\SOFTWARE\360Safe\
Coop

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
Synacast

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
services\Apache\Security

Hace lo siguiente:

• Deletes itself after execution.