RTKT_ZACCESS.E

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following non-malicious file:

• %Application Data%\{random foldername}\@

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Application Data%\{random foldername}
• %Application Data%\{random foldername}\U

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It executes then deletes itself afterward.

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random foldername}
ImagePath = "%Windows%\{random}:{random filename}.exe"

It adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows NT\CurrentVersion\Winlogon
Shell = "%Application Data%\{random foldername}\X"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\Interface\{sid}

HKEY_CURRENT_USER\Software\{random folder name}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random folder name}

It creates the following registry entry(ies) to bypass Windows Firewall:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
%Windows%\explorer.exe = "%Windows%\explorer.exe:*:Enabled:Windows Explorer"

Rootkit Capabilities

This Trojan also has rootkit capabilities, which enables it to hide its processes and files from the user.

Dropping Routine

This Trojan drops the following files:

• %Application Data%\{random foldername}\X - detected as BKDR_ZACESS.SMAE
• %Windows%\{random}:{random filename}.exe - detected as TROJ_FAKEAL.K

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}hu.cn/{BLOCKED}ad.php?w={parameter}&fail={parameter}&i={parameter}
• http://{BLOCKED}hu.cn/{BLOCKED}t2.php?w={parameter}&i={parameter}&a={parameter}
• http://{BLOCKED}hu.cn/{BLOCKED}.exe

However, as of this writing, the said sites are inaccessible.