TROJ_DOFOIL.EJSO

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

• TROJ_WERDLOD.A

It may be downloaded from the following remote sites:

• http://{BLOCKED}porn.tv/hookersnord.com/wp-includes/js/imgareaselect/gkcjrmgkrcjgcrtcrtrccr/crtbtybtyvtytytbyt.exe

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\{random folder name}\{random file name}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following non-malicious file:

• %Application Data%\{random folder name}\{folder's name}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• svchost.exe

It creates the following folders:

• %Application Data%\{random folder name}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects codes into the following process(es):

• explorer.exe
• svchost.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{installed program name in the system} = "%Application Data%\{random folder name}\{random file name}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
{installed program name in the system} = "%Application Data%\{random folder name}\{random file name}.exe"

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Other Details

This Trojan connects to the following URL(s) to check for an Internet connection:

• http://www.msn.com

It deletes the initially executed copy of itself

NOTES:

This Trojan connects to the URLs that are found in the following registry entries to trick users that it is a legitimate program:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{Installed Program}
HelpLink = "{url related to installed program}"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{Installed Program}
URLInfoAbout = "{url related to installed program}"

It performs infinite sleep if the following applications are seen::

• sbiedll
• dbghelp
• qemu
• virtual
• vmware
• xen

It looks for the window name Shell_TrayWnd and then opens the process associated with the said window to execute its code. This Trojan does this routine to inject its code to svchost.exe, avoiding HIPS detection.

It connects to the following sites to download and execute possibly malicious files from certain URLs:

• http://www.{BLOCKED}gge.at/ta_tools/image.php
• http://www.{BLOCKED}tlift.ch/media/image.php

As of this writing, the URLs are the following:

• http://{BLOCKED}prize.se/components/gate.php?client_id={value}&connected={value}&server_port={value}&debug={value}
• http://www.{BLOCKED}tv.at/admin/gate.php?client_id={value}&connected={value}&server_port={value}&debug={value}
• http://www.{BLOCKED}motreu.ch/pro-kimai/gate.php?client_id={value}&connected={value}&server_port={value}&debug={value}

However, these URLs are already inaccessible.

It does not have rootkit capabilities.

It does not exploit any vulnerability.