TROJ_RATANKBA.A

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It steals certain information from the system and/or the user.

It connects to certain websites to send and receive information. It deletes the initially executed copy of itself.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %User Startup%\Winslui.exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Information Theft

This Trojan steals the following information:

• Hostname
• Username
• OS version
• Network settings information
• Internet connection and settings
• User sessions
• User accounts
• Network resources and domain

Stolen Information

This Trojan saves the stolen information in the following file:

• %User Temp%\TMP{random}.tmp

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan connects to the following website to send and receive information:

• https://www.{BLOCKED}atch.in

It does the following:

• It executes the following command lines to gather certain information on the affected machine:
  • hostname > %User Temp%\TMP{random}.tmp
  • whoami >> %User Temp%\TMP{random}.tmp
  • ver >> %User Temp%\TMP{random}.tmp
  • ipconfig -all >> %User Temp%\TMP{random}.tmp
  • ping www.google.com >> %User Temp%\TMP{random}.tmp
  • query user >> %User Temp%\TMP{random}.tmp
  • net user >> %User Temp%\TMP{random}.tmp
  • net view >> %User Temp%\TMP{random}.tmp
  • net view /domain >> %User Temp%\TMP{random}.tmp
  • reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" >> %User Temp%\TMP{random}.tmp
• It is capable of downloading and executing files. As a result, malicious routines of the downloaded file(s) is exhibited on the affected machine.

It deletes the initially executed copy of itself