TROJ_FAKEAV.OTJ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

It displays a window where users can purchase this fake antivirus program.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\guard-{4 letters}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
GuardSoftware = "%Application Data%\guard-{4 letters}"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Attachments

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SPP

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MpCmdRun.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MpUXSrv.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
MSASCui.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msconfig.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msmpeng.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
msseces.exe

It adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Settings
UID = "hetuxksquf"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Settings
net = "{yyyy-mm-dd}_1"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Settings
Config = "{Hex Values}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Settings
ip = "{User's Ip Address}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
ConsentPromptBehaviorAdmin = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
ConsentPromptBehaviorUser = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableVirtualization = "0"

Process Termination

This Trojan terminates processes or services that contain any of the following strings if found running in the affected system's memory:

• Full Image Path without 'windows'
• avgnt
• defender
• cmd.exe
• regedit
• msconfig
• procexp
• avcenter
• msascui
• egui
• msseces
• mbab
• taskmgr
• avguard
• avastsvc

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• http://checkip.dyndns.org

It connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.82.249/{values}

It connects to the following time servers to determine the current date:

• time.windows.com

Mobile Malware Routine

This Trojan sends the gathered information via HTTP POST to the following URL(s):

• http://{BLOCKED}.{BLOCKED}.80.155/customgate/process/?callback=jQuery{number}&name={name}&email={email address}&num={card number}&cvv={code}&year={expiration yr}&month={month}&phone={phone number}&address={Address}&country={country}&state={state}&zip={zip code}&option=0&support=true&id={number}&sub_id={number}&install_id={install name}&project_id={number}&serial={serial}

Rogue Antivirus Routine

This Trojan displays the following fake alerts:

The following window is displayed for users to purchase the fake antivirus program:

It displays the following window and pretends to scan the system: