JS_RETEFE.L

This Trojan may be dropped by other malware.

It takes advantage of certain vulnerabilities.

Arrival Details

This Trojan may be dropped by the following malware:

• TROJ_RETEFE.ASUAM

Installation

This Trojan drops the following files:

• %User Temp%\{8 random characters}.ps1 -> 4 different files,
• %User Temp%\{6 random characters}.zip -> TOR Browser files
• %User Temp%\{Computer Name}.log -> contains logs of the malware's installation and information of the infected system

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops and executes the following files:

• %User Temp%\7za.exe -> 7zip(Normal File)

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• powershell.exe -ep Unrestricted -f "%User Temp%\{8 random characters}.ps1" -> used to run other processes

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Trojan modifies the following registry entries:

HKCU\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
AutoConfigURL = "http://127.0.0.1:5555/{8 random characters}.js?ip={Victim's IP Address}"
4 instances

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• iexplore.exe
• firefox.exe
• chrome.exe

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• http://api.ipify.org/
• http://icanhazip.com/

It does the following:

• It downloads TOR Browser and 7zip
• It uses the following domains for the TOR Browser
  
  • {BLOCKED}3sciyy5jd2.onion
  • {BLOCKED}4byx66pus7.onion
  • {BLOCKED}t4niyqgf7g.onion
  • {BLOCKED}mdsawhd2jf.onion
• It installs fake certificates for Internet Explorer and Firefox
• It modifies the file "%Application Data%\Mozilla\Firefox\Profiles\prefs.js" and adds the following lines:
  
  • "user_pref(\"network.dns.blockDotOnion\", false);"
  • "user_pref(\"security.enterprise_roots.enabled\", true);"
• It uses the Eternal Blue Exploit to upload logs containing the victim's details to the following ftp server:
  
  • ftp://{BLOCKED}itner:hausleitner045923@{BLOCKED}.{BLOCKED}.85.236/in/logs

It takes advantage of the following vulnerabilities:

• EternalBlue