TROJ_MSPOSER.MA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %System Root%\Download
• %System Root%\Dment
• %Program Files%\Services
• %User Temp%\{817ee004-0518-44ca-b2fe-15b1782378f7}
• %User Profile%\Application Data\WAZWQVH
• %Windows%\msapps
• %Windows%\msagent
• %Windows%\web
• %Windows%\Help

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
QQSoftEM = "%Program Files%\Services\servicem.exe"

Other System Modifications

This Trojan deletes the following files:

• %User Profile%\WAZWQVH\jwqivn.bin
• %System Root%\ping

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\WinRAR SFX

It adds the following registry entries:

HKEY_CURRENT_USER\Software\WinRAR SFX
C%%Download = "%System Root%\Download"

Dropping Routine

This Trojan drops the following files:

• __tmp_rar_sfx_access_check_34093
• ??????????.pdf
• winxp.exe
• __tmp_rar_sfx_access_check_40968
• grty????kkiu.ini
• 3tyrjyt8.ico
• lojk.exe
• img_grty??05.gif
• hh_8019.exe
• %Program Files%\Services\QQNewA.txt
• %User Temp%\gergbnnnmhgfgfg.log
• %User Profile%\WAZWQVH\kvn7660.nfo
• %User Temp%\1.tmp
• %Program Files%\Services\VFPSYS.bat
• %System Root%\Ping
• %User Profile%\WAZWQVH\jwqivn.bin

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://rpt2.{BLOCKED}v.com/az.php?{random characters}
• http://rpt2.{BLOCKED}v.com/pab.php?{random characters}
• http://rpt2.{BLOCKED}v.com/res/s60.v3.php?{random characters}
• http://rpt2.{BLOCKED}v.com/rp.php?{random characters}

This report is generated via an automated analysis system.