TROJ_AGKT.SMUS5

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

File Size:

75,794 bytes

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

05 Mar 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

%Program Files%\FreeRapid
%User Profile%\Application Data\PIPI
%System Root%\zwok
%Windows%\LastGood
%Windows%\LastGood\INF
%Program Files%\FREERA~1\tmp
%Program Files%\FREERA~1\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other System Modifications

This Trojan deletes the following files:

%User Profile%\Application Data\2.tmp
%System Root%\359679~1.AQQ
%System Root%\AFC9FE~1.BAT
%User Temp%\inl3.tmp
%User Temp%\setup_kankan.exe
%User Temp%\360moheInstall.exe
%Windows%\fonts\msgothic.ttf
%Windows%\fonts\msuigoth.ttf
%Windows%\fonts\MSMINCHO.TTF
%Windows%\fonts\Gulim.ttf
%Windows%\fonts\Gulimche.ttf
%Windows%\fonts\Dotum.ttf
%Windows%\fonts\Batang.ttf
%Windows%\fonts\Gungsuh.ttf
%Windows%\fonts\Simsun.ttf
%Windows%\fonts\nsimsun.ttf
%Windows%\fonts\MingLiU.ttf
%Windows%\fonts\pmingliu.ttf
%Windows%\INF\oem12.inf

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\ROOT\Certificates\
68A12DE4422589E97E1C6396FE17B5024FE0547A

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU

HKEY_CURRENT_USER\Software\tmp

HKEY_CLASSES_ROOT\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}

HKEY_CLASSES_ROOT\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\
Shell\open(&H)\Command

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR
zmzzmzwbd12 = "zmzzmzwbd12"

HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR
uid = "849ba482ba41d6e4991acd3de3b2aaee"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
SystemCertificates\ROOT\Certificates\
68A12DE4422589E97E1C6396FE17B5024FE0547A
Blob = "{random values}"

HKEY_LOCAL_MACHINE\SOFTWARE\WinRAR
hp = "{random values}"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU
Enable = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU
Size = "a"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU
InitHits = "64"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International\CpMRU
Factor = "14"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International
W2KLpk = "1"

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\International
W2KLpk = "0"

HKEY_CURRENT_USER\Software\tmp
key = "http://www.{BLOCKED}3.com/?r"

HKEY_CLASSES_ROOT
.grp = "MSProgramGroup"

HKEY_CLASSES_ROOT
MSProgramGroup = "Microsoft Program Group"

HKEY_CLASSES_ROOT
MSProgramGroup\Shell\Open\Command = "%System%\grpconv.exe %1"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Internet Explorer\Main
Start Page = "http://www.{BLOCKED}3.com/?r"

(Note: The default value data of the said registry entry is http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home.)

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Main
Start Page = "http://www.{BLOCKED}3.com/?r"

(Note: The default value data of the said registry entry is http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\GrpConv
Log = "Init Application."