TROJ_TRACUR.AC

This Trojan searches for .DLL files in the System folder. It uses {DLL name}wow.exe as the malware file name. It executes a certain command to bypass Windows Firewall.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following non-malicious files:

• %System%\{Random Hex}\lock
• %System%\{Random Hex}\unrar.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %Windows%\{random}wow.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It creates the following folders:

• %System%\{Random Hex}
• %System%\{Random Hex}\b
• %System%\{Random Hex}\h

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{random}wow.exe = "%Windows%\{random}wow.exe"

Other System Modifications

This Trojan creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%Windows%\{random}wow.exe = "%Windows%\{random}wow.exe:*:Enabled:Windows Update Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%Windows%\{random}wow.exe = "%Windows%\{random}wow.exe:*:Enabled:Windows Update Service"

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}9.{BLOCKED}5.49.220/update/
• http://{BLOCKED}.{BLOCKED}8.240.82/update/
• http://{BLOCKED}.{BLOCKED}7.53.210/update/
• http://{BLOCKED}.{BLOCKED}7.153.48/update/

It saves the files it downloads using the following names:

• %System%\{Random Hex}\update.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

As of this writing, the said sites are inaccessible.

NOTES:

It searches for .DLL files in the System folder. It uses {DLL name}wow.exe as the malware file name

It executes the following command to bypass Windows Firewall:

%System%\netsh firewall add allowedprogram
program="%Windows%\{random}wow.exe"name="Windows Update Service"
mode=ENABLE scope=ALL profile=ALL