TROJ_OFICLA.CYW

This Trojan arrives as attachment to mass-mailed email messages.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats. It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives as attachment to mass-mailed email messages.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\Application Data\{random folder name}\csrss.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %User Profile%\Application Data\{random folder name}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "explorer.exe "%User Profile%\Application Data\{random folder name}\csrss.exe""

(Note: The default value data of the said registry entry is "Explorer.exe".)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft
setiasworld = "{random characters}"

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:Enabled:ldrsoft"

Download Routine

This Trojan connects to the following malicious URLs:

• http://{BLOCKED}us.ru/cnn/img.php?v=1&id={random characters}&b=&tm=1&os=&av=&br=&

It accesses the following websites to download files:

• http://www.{BLOCKED}ta.net/geza/pot.exe
• http://www.{BLOCKED}tta.net/css/spm3.exe

It saves the files it downloads using the following names:

• %User Temp%\{random number}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Trend Micro detects the dowloaded file as:

• TROJ_ZBOT.SMHA

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.