TROJ_SIREFEF.VUI

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It opens random ports. It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Windows%\$NtUninstallKB{GUID}$\{random numbers}\Desktop.ini

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It drops the following file(s)/component(s):

• %Windows%\$NtUninstallKB{GUID}$\{random number}\L\{random character} - detected as TROJ_SIREFEF.PM
• %Windows%\$NtUninstallKB{GUID}$\{random numbers}\@
• %Windows%\$NtUninstallKB{GUID}$\{random number }\cfg.ini

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It creates the following folders with attributes set to System and Hidden to prevent users from discovering and removing its components:

• %Windows%\$NtUninstallKB{GUID}$\{random number}\L
• %Windows%\$NtUninstallKB{GUID}$
• %Windows%\$NtUninstallKB{GUID}$\{random number}

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It injects itself into the following processes as part of its memory residency routine:

• winlogon.exe

Autostart Technique

This Trojan registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\System\ControlSet001\
Services\.afd
ImagePath = \?

Backdoor Routine

This Trojan opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.

It executes the following commands from a remote malicious user:

• send - send information to the CnC server
• recv - receive file or code

It connects to the following websites to send and receive information:

• http://{BLOCKED}s.{BLOCKED}g .com/geo/txt/city.php
• http://{random 8 characters}.cn/stat2.php?w={integer}&i={integer}&a={integer}

Other Details

This Trojan deletes itself after execution.

NOTES:

It patches selected system drivers located in "%System%\drivers\". However, it avoid the following drivers:

• classpnp.sys
• win32k.sys

The patched SYS file is detected as PTCH_ZACCESS.SMF.

It searches for the following services in the system and deletes the services once found:

• windefend
• iphlpsvc
• wscsvc
• mpssvc
• bfe