TROJ_FURTIM.B

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %User Startup%\puntow.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

It drops the following component file(s):

• drops the following component files
• %Windows%\Temp:1 (to be detected as TROJ_FURTIM.C)
• % Windows %\VZT6nsdX.txt
• % Windows %\F5Ws94kb.txt
• % Windows %\PsfjH4KN.txt
• % Windows %\bootstat.dat
• % Windows %\bootstat2.dat

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• xxxxxx{username}

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager
BootExecute = "autocheck autochk *, %Windows%\Temp:1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Session Manager
SetupExecute = "C:\WINDOWS\Temp:1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer
HideSCAHealth = "1"

Other Details

This Trojan does the following:

• Checks if the API wine_get_unix_filename is present, terminates itself if found
• Checks if CPUinfo matches the following strings, which are normally used by virtual machines:
  • Intel(R) Xeon(R) CPU
  • Common KVM processor
  • Common 32-bit KVM
  • Virtual CPU
  • Intel Celeron_4x0 (Conroe/Merom Class Core 2)
  • Westmere E56xx/L56xx/X56xx (Nehalem-C)
  • Intel Core 2 Duo P9xxx (Penryn Class Core 2)
  • Intel Core i7 9xx (Nehalem Class Core i7)
  • Intel Xeon E312xx (Sandy Bridge)
  • AMD Opteron 240 (Gen 1 Class Opteron)
  • AMD Opteron 22xx (Gen 2 Class Opteron)
  • AMD Opteron 23xx (Gen 3 Class Opteron)
  • AMD Opteron 62xx class CPU
  • Intel CPU version
• Checks if being run in the following virtual machine:
  • VMwareVMware
  • XenVMMXenVMM
  • KVMKVMKVM
  • prl hyperv
  • Microsoft Hv
• Checks the following computer name for presence inside sandbox:
  • brbrb-d8fb22af1
  • jonathan-c561e0
  • avreview1-VMXP
  • vwinxp-maltest
  • avreview-VMSunbox
  • infected-system
• Checks the filepath Z:\VxStream if being run in sandbox
• Checks the following filepaths:
  • C:\xxx\sample.exe
  • C:\sample.exe
  • C:\Shared\dum._vxe
  • C:\SniferFiles\sample.exe
  • C:\virus\virus.exe
  • C:\virus.exe
  • c:\sampel.exe
  • C:\setup.exe
  • C:\runme.exe
  • c:\VMRun\Zample.exe
  • c:\FILE.EXE
  • C:\run\temp.exe
  • c:\taskrun\samples\rtktst.exe.exe
  • c:\artifact.exe
  • C:\manual\sunbox.exe
  • C:\1.exe
• With the following filepath:
  • malware.exe
  • \virus\
  • admin\downloads\samp1e_
  • sample_execution
  • mlwr_smpl.exe
• Disables the following DLLs when found to avoid detection:
  • avcuf32.dll
  • BgAgent.dll
  • guard32.dll
  • wl_hook.dll
  • QOEHook.dll
  • a2hooks32.dll
• Checks the following sandbox related filepaths and terminates if found:
  • C:\agent\agent.pyw
  • C:\sandbox\starter.exe
  • c:\ipf\BDCore_U.dll
  • C:\cwsandbox_manager
  • C:\cwsandbox
  • C:\Stuff\odbg110
  • C:\gfisandbox
  • C:\Virus Analysis
  • C:\iDEFENSE\SysAnalyzer
  • c:\gnu\bin
  • C:\SandCastle\tools
  • C:\cuckoo\dll
  • C:\MDS\WinDump.exe
  • C:\tsl\Raptorclient.exe
  • C:\guest_tools\start.bat
  • C:\tools\aswsnx\snxcmd.exe
  • C:\Winap\ckmon.pyw
  • c:\tools\decodezeus
  • c:\tools\aswsnx
  • C:\sandbox\starter.exe
  • C:\Kit\procexp.exe
  • c:\tracer\mdare32_0.sys
  • C:\tool\malmon
  • C:\Samples\102114\Completed
  • c:\vmremote\VmRemoteGuest.exe
  • d:\sandbox_svc.exe
• Checks the following CPU brands and if the number of CPU in the machine is 1, it terminates itself:
  • Intel(R) Core(TM) i7
  • Intel(R) Core(TM) i5
  • Intel(R) Core(TM) i3
  • Intel(R) Core(TM)2 Duo CPU
• Checks if the following DLLs are loaded, and it terminates itself if any of it are:
  • dir_watch.dll
  • tracer.dll
  • SbieDll.dll
  • APIOverride.dll
  • NtHookEngine.dll
  • api_log.dll
  • LOG_API.DLL
  • LOG_API32.DLL
• Checks if any of the following files are present, and terminates self if found:
  • taskrun\bruta\kbruta.sys
  • taskrun\bruta\TBM.sys
  • vmx_svga.sys
  • vmmouse.sys
  • xennet.sys
  • CaptureProcessMonitor.sys
  • CaptureRegistryMonitor.sys
  • CaptureFileMonitor.sys
  • CWSandboxWatchdogDri
  • VBoxVideo.sys

NOTES:

This Trojan checks for the presence of the following kernel drivers. If these are present, it proceeds to the next checking:

• wstif.sys
• bdsnm.sys
• bdsflt.sys
• ggc.sys
• catflt.sys
• wsnf.sys
• llio.sys
• mscank.sys
• EMLTDI.SYS
• 360Box.sys
• 360Box64.sys
• 360Camera.sys
• 360Camera64.sys
• 360SelfProtection.sys
• 360AntiHacker.sys
• 360AntiHacker64.sys
• 360AvFlt.sys
• aswMonFlt.sys
• aswRvrt.sys
• aswRdr2.sys
• aswVmm.sys
• aswNdisFlt.sys
• aswSnx.sys
• aswSP.sys
• aswStm.sys
• avnetflt.sys
• avkmgr.sys
• avipbb.sys
• avgntflt.sys
• pctNdis.sys
• pctNdisLW64.sys
• vsdatant.sys
• pwipf6.sys
• 360Box.sys
• 360Box64.sys
• 360Camera.sys
• 360Camera64.sys
• 360SelfProtection.sys
• 360AntiHacker.sys
• 360AntiHacker64.sys
• 360AvFlt.sys
• K7Sentry.sys
• K7FWFilt.sys
• K7TdiHlp.sys
• 360AvFlt.sys
• 360FsFlt.sys
• tpsec.sys
• mwfsmflt.sys
• ProcObsrvesx.sys
• bdfsfltr.sys
• ffsmon.sys
• fildds.sys
• filmfd.sys
• filppd.sys
• kl1.sys
• klif.sys
• kltdi.sys
• kneps.sys
• klkbdflt.sys
• klmouflt.sys
• GDBehave.sys
• GDNdisIc.sys
• gdwfpcd64.sys
• gdwfpcd32.sys
• ABFLT.sys
• Bfilter.sys
• Bfmon.sys
• Bhbase.sys
• EpfwLWF.sys
• epfwwfp.sys
• eamonm.sys
• ehdrv.sys
• epfw.sys
• eelam.sys
• avgdiskx.sys
• avgidsdriverlx.sys
• avgtdix.sys
• avgunivx.sys

It terminates the following applications when found running. It only does this check if one of the kernel drivers in the aforementioned list is found:

• apispy.exe
• autoruns.exe
• autorunsc.exe
• dumpcap.exe
• emul.exe
• fortitracer.exe
• hookanaapp.exe
• hookexplorer.exe
• idag.exe
• idaq.exe
• importrec.exe
• imul.exe
• joeboxcontrol.exe
• joeboxserver.exe
• multi_pot.exe
• ollydbg.exe
• peid.exe
• petools.exe
• proc_analyzer.exe
• procexp.exe
• procmon.exe
• regmon.exe
• scktool.exe
• sniff_hit.exe
• sysanalyzer.exe
• vmsrvc.exe
• vmtoolsd.exe
• vmusrvc.exe
• vmwaretray.exe
• vmwareuser.exe
• wireshark.exe
• xenservice.exe
• pythonw.exeprl_tools.exe
• FakeHTTPServer.exe
• BehaviorDumper.exe
• SbieSvc.exe
• guninraik.exe
• vboxservice.exe
• vboxtray.exe

It terminates itself if the following filepaths are found:

• C:\Program Files\VMware\VMware Tools
• C:\Program Files (x86)\VMware\VMware Tools

It searches for the following registry information:

• \Registry\Machine\SYSTEM\CurrentControlSet\Enum\IDE
• \Registry\Machine\SYSTEM\CurrentControlSet\Enum\SCSI

If the value contains any of the following strings, it terminates itself:

• QEMU_
• VMware
• Ven_Red_Hat&Prod_VirtIO
• DiskVBOX
• DiskVirtual

If the following registry exists, it terminates itself:

• HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__\VBOXBIOS
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\Hyper_V_Gen_Counter_V1
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\XEN0000\0
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\XENBUS\CLASS_VBD&REV_02

It checks the reigstry HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System and if the following string exists, it terminate itself:

• BOCHS - 1
• VBOX - 1
• PRLS - 1
• VirtualBox

It terminates itself if the following strings are found in the network card:

• Realtek RTL8139C+ Fast Ethernet NIC
• VMware Accelerated AMD PCNet Adapter
• Microsoft Virtual Machine Bus Network Adapter
• Microsoft Hyper-V Network Adapter
• Adaptador de red de bus de m?quina virtual de Microsoft

It terminates itself if any of the following windows is found:

• PROCEXPL
• sysinternals
• PROCMON_WINDOW_CLASS
• sysinternals
• Autoruns
• sysinternals
• TCPViewClass
• sysinternals
• TCPView - Sysinternals: www.sysinternals.com
• File Monitor - Sysinternals: www.sysinternals.com
• Registry Monitor - Sysinternals: www.sysinternals.com
• Process Monitor - Sysinternals: www.sysinternals.com
• gdkWindowToplevel
• Wireshark
• API_TRACE_MAIN
• Wget [100%%] http://tristan.ssdcorp.net/guid
• C:\Program Files\Wireshark\dumpcap.exe
• C:\wireshark\dumpcap.exe
• C:\SandCastle\tools\FakeServer.exe
• C:\\Python27\\python.exe
• start.bat - C:\Manual\auto.bat
• Fortinet Sunbox
• PEiD v0.95
• Total Commander 7.0 - Ahnlab Inc.
• Total Commander 6.53 - GRISOFT, s.r.o.
• Total Commander 7.56a - Avira Soft
• Total Commander 7.56a - ROKURA SRL
• C:\strawberry\perl\bin\perl.exe
• ThunderRT6FormDC
• SysAnalyzer
• TfrmMain
• All-Seeing Eye
• Afx:400000:b:10011:6:350167
• Malicious Code Monitor v1.7.6 For NT(x86) - (ariesike@naver.com)
• TApplication
• Mouse Move - by RJL Software, Inc.
• SmartSniff
• SmartSniff
• ConsoleWindowClass
• VxStream Kernel Service Manager

It terminates itself if it finds any of the following registries:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Iris Network Traffic Analyzer
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallWatch Pro 2.5
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SysAnalyzer_is1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{13BE68B1-7498-48AB-9D22-AD3AB
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Add
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualB
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE&DEV_BEEF&SUBSYS_00000000&REV_00
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_80EE&DEV_CAFE&SUBSYS_00000000&REV_00
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_5333&DEV_8811&SUBSYS_00000000&REV_00
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_1AB8&DEV_4005&SUBSYS_04001AB8&REV_00
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_1AB8&DEV_4000&SUBSYS_04001AB8&REV_00
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\PCI\VEN_1AB8&DEV_4006&SUBSYS_04061AB8&REV_00
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{25AD16E5-F48B-4455-83D7-849D6
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Iris Network Traff
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SysAnalyzer_is1
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\InstallWatch Pro 2
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{13BE68B1-7498-48A
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{25AD16E5-F48B-445

It executes the following commands:

• %Windows%\system32\netsh.exe winsock reset
• %Windows%\system32\netsh.exe firewall set opmode mode = DISABLE profile = ALL
• %Windows%\system32\netsh.exe advfirewall set allprofiles state off

It searches the registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class and {subkeys}\Linkage\UpperBind for the following strings:

• ABndis
• Teefer2
• SBFWIMCL
• Bcfilter
• Epfwndis
• klim5
• aswNdis
• Avgfwfd
• scfndis
• NNSNAHS
• NNSNAHSL
• afw
• wsnf
• SBFWIMCL
• econceal
• ABndis
• Bdfndisf
• nnetsec
• netfilter
• OAnet
• VPCNetS2
• kwflower
• eset_epfwndis
• kl_klim5
• sw_aswNdis
• gr_avgfwfd
• nt_econceal
• kwflowerDevice
• KL_KLIM6
• aswNdisFlt
• PCTNdisLW
• EFW_NdisLwFlt
• ESET_EpfwLWF
• ft_fortifilter
• pwipf6
• inspect
• pwipf6mp
• Fkndisf
• pctNDIS
• RusRoute
• Yndisim"
• AVSNDISIM

In {subkey}\ComponentId if the subkey is not tap and it matches any of the variable {variable1}, it replaces {subkey}\UpperBind with one or more of {variable2}:

• {variable 1}
  • ms_ndiswanipv6
  • ms_ndiswanip
  • ms_pschedmp
  • ms_l2tpminiport
  • ms_pptpminiport
  • ms_ndiswanbh
  • ms_pppoeminiport
  • ms_ptiminiport
  • *tunmp
• {variable 2}
  • Ndisuio
  • RasPppoe
  • rspndr
  • lltdio
  • Tcpip
  • Tcpip6
  • PSched
  • Wanarpv6
  • RMCast
  • Wanarp
  • Ndisuio
  • RasPppoe
  • Tcpip
  • NdisWan
  • NdisWan
  • NdisWan
  • NdisWan
  • PSched
  • Tcpip6

If it does not match any of {variable 1}, it leaves the registry blank.