TROJ_WERDLOD.T

This Trojan arrives as attachment to mass-mailed email messages.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives as attachment to mass-mailed email messages.

Installation

This Trojan drops the following file(s)/component(s):

• %All Users Profile%\cert{value}.der ← install certificate on trusted root certificate store, will be deleted after
• %User Temp%\{random filename}.txt ← saves gathered cookies content

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Autostart Technique

This Trojan drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\system.pif → copy of itself

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.)

Other System Modifications

This Trojan modifies the following file(s):

• {firefox path}\prefs.js
  This modified 'prefs.js' contains the following:
  • user_pref("network.proxy.type", 2)
  • user_pref("network.proxy.autoconfig_url", "https://{BLOCKED}evpnalarm.net/securevpn.js")

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
AutoConfigURL = "https://{BLOCKED}evpnalarm.net/securevpn.js"

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}omla.{BLOCKED}uhi.at/vs28/schule/administrator/components/com_phocagallery/c.exe
• http://{BLOCKED}tsu-{BLOCKED}et.co.jp/images/medical/rttcrvtretrgyrtytvucyruycutyftr/erzewerebytvtcytr.exe

It saves the files it downloads using the following names:

• %All Users Profile%\Microsoft-KB{random}.exe
  or
• %All Users Profile%\WindowsXP-KB{random}.exe

(Note: %All Users Profile% is the All Users folder, where it usually is C:\Documents and Settings\All Users on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\ProgramData on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

As of this writing, the said sites are inaccessible.

Other Details

This Trojan does the following:

• It downloads and install the following Microsoft Windows Tools if not existing:
  • Microsoft Windows PowerShell
  • Microsoft .Net Framework
  • Windows Server Administration Tools
• It access the following legitimate URLs to download these installers:
  • http://download.microsoft.com/download/{values}/{GUID}/dotnetfx35setup.exe
  • http://download.microsoft.com/download/{values}/{GUID}/WindowsXP-KB926139-v2-x86-ENU.exe
  • http://download.microsoft.com/download/{values}/{GUID}/adminpak.exe
• It connects to the following to update count hits:
  • https://www.{BLOCKED}unter.com/counter.php?mvtyiortiyoxirt
  • https://www.{BLOCKED}unter.com/counter.php?yitoyctoyxirnymrxoii
• It checks for the following processes:
  • VBoxService.exe
  • VBoxTray.exe
  • Proxifier.exe
  • prl_cc.exe
  • prl_tools.exe
  • vmusrvc.exe
  • vmsrvc.exe
  • vmtoolsd.exe
• It checks for social media and bank related domains on cookies and history
• When accessing specific domains, users access the malicious SOCKS server using the file from the following:
  • https://{BLOCKED}evpnalarm.net/securevpn.js
• It terminates the following processes:
  • chrome.exe
  • firefox.exe
  • iexplore.exe
• It imports rogue root certificates to browsers (Internet Explorer, Firefox).