BKDR_NEUREVT.JSJ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

It modifies the Internet Explorer Zone Settings.

It retrieves specific information from the affected system.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• {Path}\jewsdidit{number}\{random file name 1}.exe

It drops the following non-malicious file:

• {Path}\jewsdidit{number}\{random file name 2}.txt

It injects codes into the following process(es):

• wuauclt.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
jewsdidit = "{Path}\jewsdidit{number}\{random file name 1}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
jewsdidit = "{Path}\jewsdidit{number}\{random file name 1}.exe"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\CLSID\{CLSID}\
{random value}\CG1
HAL = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
ShowSuperHidden = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip
Uuid = "{random values}"

Backdoor Routine

This Trojan executes the following commands from a remote malicious user:

• Download and execute files
• Perform Slowloris flooding
• Execute shell commands
• Copy itself in removable drives
• Open a URL
• Uninstall itself

It connects to the following websites to send and receive information:

• {BLOCKED}y.{BLOCKED}s.cat/h/order.php
• {BLOCKED}y.{BLOCKED}s.es/h/order.php
• {BLOCKED}y.{BLOCKED}t.net/h/order.php

Web Browser Home Page and Search Page Modification

This Trojan modifies the Internet Explorer Zone Settings.

Information Theft

This Trojan retrieves the following information from the affected system:

• Operating system version
• CPU information
• Information on installed FTPs
• Installed applications

Other Details

This Trojan connects to the following URL(s) to check for an Internet connection:

• update.microsoft.com
• microsoft.com
• windowsupdate.microsoft.com
• google.com

It deletes the initially executed copy of itself

NOTES:

{Path} can be any of the following:

• %All Users Profile%
• %Program Files%\Common Files

It disables the following antivirus-related applications by adding the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\{application}
Debugger = "{random characters}_.exe"

• a2guard.exe
• a2service.exe
• a2start.exe
• adaware.exe
• ALUpdate.exe
• arcaclean.exe
• avastsvc.exe
• avastui.exe
• avcenter.exe
• AVENGINE.exe
• avgcfgex.exe
• avgdiagex.exe
• avgidsagent.exe
• avgmfapx.exe
• avgnt.exe
• avguard.exe
• avgui.exe
• avgupd.exe
• avgwdsvc.exe
• AVK.exe
• AVKTray.exe
• avshadow.exe
• BgScan.exe
• BullGuard.exe
• BullGuardBhvScanner.exe
• BullGuardScanner.exe
• BullGuardUpdate.exe
• BullGuardUpdate2.exe
• ccsvchst.exe
• ccupdate.exe
• CLPSLA.exe
• coreFrameworkHost.exe
• coreServiceShell.exe
• egui.exe
• ekrn.exe
• epavjobs.exe
• ForceField.exe
• FProtTray.exe
• FPWin.exe
• fshoster32.exe
• GDFirewallTray.exe
• GDSC.exe
• K7TSUpdT.exe
• mbam.exe
• mbamgui.exe
• mcagent.exe
• McPvTray.exe
• mcshell.exe
• mcshield.exe
• McSvHost.exe
• McUICnt.exe
• mcupdate.exe
• mcupdmgr.exe
• MSASCui.exe
• MsMpEng.exe
• msseces.exe
• niu.exe
• op_mon.exe
• pctsAuxs.exe
• pctsGui.exe
• pctsSvc.exe
• PSANHost.exe
• PSUAService.exe
• PSUNMain.exe
• RavMonD.exe
• rcfp.exe
• rsmain.exe
• RsMgrSvc.exe
• RsTray.exe
• SBAMTray.exe
• sbamui.exe
• sguardxup.exe
• starter_avp.exe
• symerr.exe
• uiSeAgnt.exe
• uiWatchDog.exe
• Update.exe
• update_tmp.exe
• updater.exe
• Upgrader.exe
• usrreq.exe
• uWinMgr.exe
• WRSA.exe
• zatray.exe

It attempts to gather account information from the following applications:

• CoreFTP
• FileZilla
• FlashFXP
• FTP Commander
• PuTTY
• Skype
• SmartFTP
• WinSCP

It queries the following registry key to get the processor information:

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor