TROJ_FAKEAV.KEA

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a certain website asking for sensitive information, such as credit card numbers.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following files:

• %Application Data\{9 random alpha characters}\{7 random alpha characters}tssd.exe - copy of itself
• %Windows%\{7 random alpha characters}tssd.exe - copy of itself

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This Trojan creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random characters} = {malware path and file name}

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Run
{random characters} = {malware path and file name}

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows Script\Settings
JITDebug = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Associations
LowRiskFileTypes = .exe

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Attachments
SaveZoneInformation = 1

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
CheckExeSignatures = no

HKEY_CURRENT_USER\Software\Microsoft\
Internet Explorer\Download
RunInvalidSignatures = 1

Other Details

Based on analysis of the codes, it has the following capabilities:

• It executes an embedded VBS script from its malware body. This script acts like a legitimate AV program. It cleans known malware processes, files, GUIDs, and BHOs which are pre-listed in the script’s code. It does this by calling several functions that each perform a specific task in cleaning infection.
• It then sends a notification to the following servers: {BLOCKED}x.com and {BLOCKED}x.net
• It monitors created processes. If a new process is created, this malware does not allow the user to use the executed file. Instead it displays a message that the file being executed by the user is infected and needs to be cleaned. Clicking the button will redirect users to the malware’s fake purchase site.
• This malware intercepts requests from the Internet browser and displays a warning message on the browser.

It connects to the following possibly malicious URL:

• www.{BLOCKED}no.org
• www.{BLOCKED}no.com
• www.{BLOCKED}lt.com
• www.{BLOCKED}ra.com

Rogue Antivirus Routine

This Trojan displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a certain website asking for sensitive information, such as credit card numbers.