TrojanSpy.Win32.ZENPAK.A

This Trojan Spy may be dropped by other malware.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan Spy may be dropped by the following malware:

• Trojan.Win32.STOP.THGACAI

Installation

This Trojan Spy drops the following files:

• %All Users Profile%\0 ← marker if run as admin or not

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It drops and executes the following files:

• %All Users Profile%\216c40503e\kndt.exe

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It creates the following folders:

• %All Users Profile%\216c40503e

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Other System Modifications

This Trojan Spy modifies the following registry key(s)/entry(ies) as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
User Shell Folders
Startup = %All Users Profile%\216c40503e

(Note: The default value data of the said registry entry is %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.)

Other Details

This Trojan Spy connects to the following website to send and receive information:

• http://{BLOCKED}ns.com/ppk/index.php
• http://{BLOCKED}u.top/ppk/index.php
• http://{BLOCKED}e.net/ppk/index.php
  
  Here are the details of the message sent to C&C:
  • id - Volume Serial Number
  • sd - 363333
  • vs - 1.41
  • ar - 1 if executed as admin else 0
  • bi - OS Architecture
    • 1 = x86
    • 0 = x64
  • lv - running malware
    • 0 = 1.exe
    • 1 = kndt.exe
  • os - OS version, value can be the following:
    • 1 or 2 = Windows 10, Windows 8,Windows Server 2016, Windows Server 2012
    • 3 or 4 = Windows 8.1, Windows Server 2012 R2
    • 7 or 8 = Windows Vista, Windows Server 2008
    • 9 or 10 = Windows 7, Windows Server 2008 R2
    • 11 = SM_TABLETPC {system configuration setting}
    • 12 or 13 = Windows Server 2003 R2, Windows Home Server, Windows Server 2003
    • 14 = Windows XP
    • 15 = Windows 2000
  • av - value can be [1-12], folder exist %All Users Profile%\{AV}
    where "AV" folder name are the following:
    • 1 = AVAST Software
    • 2 = Avira
    • 3 = Kaspersky Lab
    • 4 = ESET
    • 5 = Panda Security
    • 6 = Doctor Web
    • 7 = AVG
    • 8 = 360TotalSecurity
    • 9 = Bitdefender
    • 10 = Norton
    • 11 = Sophos
    • 12 = Comodo
  • pc - Computer Name
  • un - UserName

It does the following:

• It won't drop and execute if the following folders is found on the system:
  • %All Users Profile%\Norton
  • %All Users Profile%\Sophos
• It create a registry modification if the following folder found in the system:
  • %All Users Profile%\360TotalSecurity

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )