TROJ_ZCLICK.PQT

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %Application Data%\{random foldername}\{random filename 1}.exe
• %System%\{random filename 2}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SecurityCenterServer{number}
ImagePath = ""%System%\{random filename 2}.exe" -service "%Application Data%\{random foldername}\{random filename 1}.exe""

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SecurityCenterServer{number}
DisplayName = "Security Center Server - {number}"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random entry} = "%Application Data%\{random folder name}\{random filename 1}.exe"

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random entry} = "%Application Data%\{random folder name}\{random filename 1}.exe"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SecurityCenterServer{number}

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

NOTES:

It connects to the following URL(s) to get its configuration file that is loaded in memory:

• http://{BLOCKED}le-indi.com/b/opt/{hash}
• http://{BLOCKED}reen.ru/b/opt/{hash}
• http://{BLOCKED}n-vaper.su/b/opt/{hash}

However, as of this writing, the said sites are inaccessible.

This configuration file may contain the following:

• Click URL (redirection url source)
• Flash URL
• Mutex Name
• Search URL (referrer url)
• Update URL (new C&C)

The data in the configuration files may be used for its pay-per-click scheme. It may do so by displaying a full screen window with loaded URLs and performing various mouse movements and scrolling when this window is active.

It does not have rootkit capabilities.

It does not exploit any vulnerability.