TROJ_FAKEAV.OTN

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

It displays a window where users can purchase this fake antivirus program.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan is injected into the following processes running in memory:

• svchost.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "{malware location}\{malware name}"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Attachments

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MpCmdRun.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MpUXSrv.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MSASCui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msconfig.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msmpeng.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msseces.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SPP

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
LowRiskFileTypes = ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Attachments
SaveZoneInformation = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Settings
Config = "{Hex Values}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Settings
ip = "computer's IP address"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Settings
net = "yyy-mm-dd_3"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Settings
UID = "{10 random letters}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MpCmdRun.exe
Debugger = "svchost.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MpUXSrv.exe
Debugger = "svchost.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MSASCui.exe
Debugger = "svchost.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msconfig.exe
Debugger = "svchost.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msmpeng.exe
Debugger = "svchost.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msseces.exe
Debugger = "svchost.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
ConsentPromptBehaviorAdmin = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
ConsentPromptBehaviorUser = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableVirtualization = "0"

Process Termination

This Trojan terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• MpCmdRun.exe
• MpUXSrv.exe
• MSASCui.exe
• msconfig.exe
• msmpeng.exe
• msseces.exe

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• http://checkip.dyndns.org

It connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.82.249/{values}

It connects to the following time servers to determine the current date:

• time.{BLOCKED}s.com

Rogue Antivirus Routine

This Trojan displays the following fake alerts:

The following window is displayed for users to purchase the fake antivirus program:

It displays the following window and pretends to scan the system:

NOTES:

This Trojan connects to the following URL(s) if users purchase the fake antivirus program:

• http://{BLOCKED}.{BLOCKED}.80.155/customgate2/?callback=jQuery{number}_{number}&name={name}&email={email}&num={card number}&cvv={card cvv}&year={card expiration year}&month={card expiration month}&phone=&address={address}&country={country}&state={state}&zip={zip code}&option=2&support=true&id={number}&sub_id=1&install_id={UID}&project_id={number}&serial={serial}
• http://{BLOCKED}.{BLOCKED}.80.155/customgate2/process/?callback=jQuery{number}&transaction_id={number}