TROJ_TIBS

TROJ_TIBS is the Trend Micro detection for malicious files that have been packed by the polymorphic closed source packer TIBS.

TIBS packer is known to be used to pack malware that belongs to the following families:

• WORM_NUWAR
• TROJ_NUWAR
• WORM_ZHELAT

This Trojan adds certain registry entries to disable the Task Manager. This action prevents users from terminating the malware process, which can usually be done via the Task Manager.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\YUR1.exe
• %System Root%\x
• %System%\YUR3.exe
• %System%\wind32.exe
• %System%\kernels32.exe
• %User Temp%\{random filename}.exe
• %User Temp%\{random filename}.tmp

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
\\YUR1.exe = "%System%\YUR1.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
\\YUR1.exe = "%System%\YUR1.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
\\YUR3.exe = "%System%\YUR3.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
\\YUR3.exe = "%System%\YUR3.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System = "%System%\wind32.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
System = "%System%\kernels32.exe"

Other System Modifications

This Trojan adds the following registry entries to disable the Task Manager:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
System
DisableTaskMgr = "1"

Dropping Routine

This Trojan drops the following files:

• %Desktop%\BEST BDSM PORN.url
• %Desktop%\GAY FETISH SEX.url

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}ount.net/32647543ygwvrhbjt3h4evjrbgnrt.php?adv=137&code1=MR0D&code2=6510
• http://{BLOCKED}ount.net/adv/137/adload.php?{random characters}
• http://{BLOCKED}ount.net/pic/search.jpg
• http://{BLOCKED}unt.net/rftghjkljhgfdsdfgh.php?adv=9&code1=ITL0&code2=2703
• http://{BLOCKED}unt.net/adv/09/adload.php?{random characters}