TROJ_DIDKR.A

This malware is related to the security incident that affected certain government and news websites in South Korea. Cybercriminals compromised the auto-update mechanism of a file-sharing software in order to serve a modified malicious version of the said software's installer.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This is the detection for the modified version of the SimDisk file-sharing software. It is downloaded as an 'update' on affected systems.

When executed on a system, it downloads other components. The downloaded components include a Tor client, a configuration file, and a file that connects to the Tor network. This malware's use of Tor hides its activities from affected users.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops and executes the following files:

• %User Temp%\RarSFX0\SimDisk.exe
• %User Temp%\RarSFX0\SimDiskup.exe - detected as TROJ_DIDKR.A

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://www.{BLOCKED}g.co.kr/images/korea/c.jpg - detected as TROJ_DIDKR.A

NOTES:

The dropped malware file SimDiskUp.exe accesses the aforementioned URL to download another malware. Once executed, the downloaded file creates the following folders:

• %Application Data%\tor
• %Application Data%\Identities\{GUID}

It drops and executes the following files:

• %Application Data%\Identities\{GUID}\{Random File Name 1} - TROJ_DIDKR.A
• %Application Data%\Identities\{GUID}\{Random File Name 2} - Tor Client

It uses a file name similar to a legitimate file to pass as a legitimate file. It then drops the component %Application Data%\Identities\{GUID}\config.ini. The said file contains file name of the Tor client, affected machine's IP address, and country.