TROJ_CRYPCTB.SMD

This malware was discovered to be involved in a series of malicious campaigns that found victims in Europe, China, Middle East, Africa, India, and Latin America on late January 2015. It comes as an attachment to a spammed mail and downloads a cryptolocker variant onto affected systems. Users affected by this malware may find their important documents or files unable to be used and/or accessed.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives as an attachment to email messages mass-mailed by other malware/grayware or malicious users.

Installation

This Trojan drops the following files:

• %User Temp%\{malware file name}.rtf
• %User Temp%\temp_cab_{random digits}.cab

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• {BLOCKED}eedle.com:80/menu_files/pack.tar.gz
• {BLOCKED}e.asso.fr:80/piwigotest/pack.tar.gz
• {BLOCKED}sultores.com:80/tmp/pack.tar.gz
• {BLOCKED}portive-martinique.com:80/wp-includes/pack.tar.gz
• {BLOCKED}healthtrack.com:80/media/pack.tar.gz
• {BLOCKED}tem.fr:80/jb/pack.tar.gz
• {BLOCKED}as-saint-joseph.com:80/css/pack.tar.gz
• {BLOCKED}t-its.de:80/fit/pack.tar.gz
• {BLOCKED}u-photographe.com:80/tmp/pack.tar.gz
• {BLOCKED}dessources.com:80/assets/pack.tar.gz
• {BLOCKED}edia.org:80/histoiredesarts/pack.tar.gz
• {BLOCKED}eedle.com:443/menu_files/pack.tar.gz
• {BLOCKED}e.asso.fr:443/piwigotest/pack.tar.gz
• {BLOCKED}es.com:443/tmp/pack.tar.gz
• {BLOCKED}portive-martinique.com:443/wp-includes/pack.tar.gz
• {BLOCKED}healthtrack.com:443/media/pack.tar.gz
• {BLOCKED}stem.fr:443/jb/pack.tar.gz
• {BLOCKED}as-saint-joseph.com:443/css/pack.tar.gz
• {BLOCKED}ts.de:443/fit/pack.tar.gz
• {BLOCKED}u-photographe.com:443/tmp/pack.tar.gz
• {BLOCKED}essources.com:443/assets/pack.tar.gz
• {BLOCKED}edia.org:443/histoiredesarts/pack.tar.gz

It saves the files it downloads using the following names:

• %User Temp%\{random digits}.exe - detected as TROJ_CRYPCTB.SME

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

NOTES:

Upon execution, it opens its dropped non-malicious file %User Temp%\{malware file name}.rtf to hide its malicious routines from the user.