• Email
• Facebook
• Twitter
• Google+
• Linkedin

Trojan.VBS.MISPADU.THIADBO

---

• マルウェアタイプ: トロイの木馬型
• 破壊活動の有無: なし
• 暗号化: なし
• 感染報告の有無: はい

---

  概要

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

---

  詳細

侵入方法

マルウェアは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

インストール

マルウェアは、以下のフォルダを作成します。

• C:\{string2 from the decrypted response from url}

その他

マルウェアは、以下を実行します。

• It terminates itself when executed in a virtual environment whose computer name is "JOHN-PC" by checking for the following values:
  • OS Model Name
  • Virtual Machine - for Hyper V
  • VMware Virtual Platform - for VMware
  • VirtualBox - for Virtualbox
  • BIOS Version
  • Hyper-V 2008(Beta,RC0,RTM and R2)
  • VS2005/VS2005R2/VS2005R2SP1
  • VPC2004/VPC2007
  • Windows Virtual PC
• Also terminates itself if the default installed OS language is not in the following list:
• Spanish – Spain (traditional)
• Portugese – Brazil
• Spanish – Mexico
• Spanish – Spain
• Spanish Microsoft Office Language – (Microsoft Office Language Value – LANGUAGE_SPANISH)
• Connects to the following url to download and execute malicious vbscript code in memory to check system and download more files:
  • http://{BLOCKED}.{BLOCKED}7.173/gt21.php
• If C:\Users\Public\{string1 from the decrypted response from url}4.zip does not exist
  • Connects and decrypts data from http://{BLOCKED}.{BLOCKED}7.173/k1oa.php
  • Connects and downloads file from http://{BLOCKED}.{BLOCKED}7.173/m/k1o{string3 from decrypted data from url}.gt2
  then saves to
  • C:\Users\Public\{string1 from the decrypted response from url}4.zip
• If C:\Users\Public\{string1 from the decrypted response from url}1.zip does not exist
  • Connects and downloads file from http://{BLOCKED}.{BLOCKED}7.173/k1oa{string1 from the decrypted response from url}.gt2
  then saves it to C:\Users\Public\{string1 from the decrypted response from url}1.zip
  • Connects and downloads file from http://{BLOCKED}.{BLOCKED}7.173/k1oasq.gt2
  • Connects and downloads file from http://{BLOCKED}.{BLOCKED}7.173/k1oasl.gt2
  • Connects and downloads file from http://{BLOCKED}.{BLOCKED}7.173/k1oass.gt2
  • Connects and downloads file from http://{BLOCKED}.{BLOCKED}7.173/k1oaai.gt2
  then saves it to
  • C:\Users\Public\{string1 from the decrypted response from url}sq.zip
  • C:\Users\Public\{string1 from the decrypted response from url}sl.zip
  • C:\Users\Public\{string1 from the decrypted response from url}ss.zip
  • C:\Users\Public\{string1 from the decrypted response from url}ai.zip

Extracts the contents of the zip files to the created folder, "C:\{string2 from the decrypted response from url}" and renames them to the following:

• {string1 from the decrypted response from url} - detected as Trojan.AutoIt.MISPADO.THIADBO
• {string1 from the decrypted response from url}1.{reversed last 3 characters of string1} - detected as Trojan.Win32.MISPADO.THENC
• {string1 from the decrypted response from url}ai.exe - non-malicious AutoIt loader
• libeay32.dll – non-malicious libraries
• ssleay32.dll – non-malicious libraries
• winx86.dll – non-malicious libraries
then deletes all the downloaded zip files

Decrypts and encrypts configuration from code and saves to:

• C:\Users\Public\{second character of computer name}_

Gathers the following data:

• strings from decrypted response from url
• created folder path
• hard-coded values from the script
• current date

then encrypts and saves it to

• C:\Users\Public\{second character of computer name}

Executes the following downloaded exe files with arguments:

• {string1 from the decrypted response from url}ai.exe {string1 from the decrypted response from url} @1
• {string1 from the decrypted response from url}ai.exe {string1 from the decrypted response from url} ##1
• {string1 from the decrypted response from url}ai.exe {string1 from the decrypted response from url} ##3

Hides the said created folder

---

  対応方法

ご利用はいかがでしたか？　アンケートにご協力ください