Trojan.Win32.KILLFILES.SMTH

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %User Temp%\{random}.TMP

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Infiltra y ejecuta los archivos siguientes:

• %System Root%\123.bat → contains commands for adding registry entries

(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).

Agrega los procesos siguientes:

• cmd /c %System Root%\123.bat
  The bat file contains the following commands
  • reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\ZhuDongFangYu.exe" /v debugger /t reg_sz /d "ntsd -d" /f
  • reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\360tray.exe" /v debugger /t reg_sz /d "ntsd -d" /f
  • reg add "hklm\software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe" /v debugger /t reg_sz /d "ntsd -d" /f
• cmd.exe /c assoc .txt = exefile
• cmd.exe /c ftype comfile={malware path}\{malware file name}.exe
• cmd.exe /c ftype zipfile={malware path}\{malware file name}.exe
• cmd.exe /c ftype jpgfile={malware path}\{malware file name}.exe
• cmd.exe /c ftype txtfile={malware path}\{malware file name}.exe

(Nota: %System Root% es la carpeta raíz, normalmente C:\. También es la ubicación del sistema operativo).

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
jpgfile\Shell\Open\
Command
{default} = {malware directory}\{malware file name}.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ZhuDongFangYu.exe
debugger = ntsd -d

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
360tray.exe
debugger = ntsd -d

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskmgr.exe
debugger = ntsd -d

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
zipfile\Shell\Open\
Command
{default} = {malware directory}\{malware file name}.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.txt
{default} = exefile

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
txtfile\shell\open\
command
{default} = {malware directory}\{malware file name}.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
comfile\shell\open\
command
{default} = {malware directory}\{malware file name}.exe

Otros detalles

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
.txt

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
jpgfile

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
jpgfile\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
jpgfile\Shell\Open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
jpgfile\Shell\Open\
Command

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
zipfile

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
zipfile\Shell

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
zipfile\Shell\Open

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
zipfile\Shell\Open\
Command

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
ZhuDongFangYu.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
360tray.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
taskmgr.exe

Hace lo siguiente:

• It locates and deletes all executable files found in drive C.
• Skips searching for executable files in hidden and system folders.
• Replaced all deleted files with a modified copy of itself with the same file name as that of the deleted file.