TROJ_KILIM.EFLD

This malware poses as a Chrome browser plugin required to play videos. Users receive a message with a link in the social networking site, Facebook. Clicking the URL leads to a page that supposedly looks like Facebook, thus preventing users from detecting anything suspicious about the download of a bogus Chrome plugin.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System%\Tasks\winspt - scheduled task(Windows Vista above)

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It drops and executes the following files:

• %Application Data%\startupbt.bat - used to create scheduled task
• %Application Data%\winsner.exe - contains main routine (also detected as TROJ_KILIM.EFLD)

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

Autostart Technique

The scheduled task executes the malware every:

• ONLOGON (at user login)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tree\winspt

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Logon\{ID of created scheduled task}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tree\winspt
Id = "{ID of created scheduled task}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tree\winspt
Index = 2

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Logon\{ID of created scheduled task}
Path = "\winspt"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tasks\{ID of created scheduled task}
Triggers = {data}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Schedule\
TaskCache\Tasks\{ID of created scheduled task}
DynamicInfo = {data}

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}s.{BLOCKED}g.us/pingjs/?k=sanerdown
• http://{BLOCKED}i.{BLOCKED}e/saner.php
• http://{BLOCKED}s.{BLOCKED}g.us/pingjs/?k=sanerindi

NOTES:

This malware creates a scheduled task as its auto-start with the task name winspt and target file %Application Data%\winsner.exe

It connects to http://fei.{BLOCKED}e/saner.php to get the following:

• List of target URLs to download files from
• Path and file names to be used upon download

It then downloads the files from the target URLs using the specified path and file names. It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Upon successfully getting the URLs, the malware connects to http://whos.{BLOCKED}g.us/pingjs/?k=sanerindi to communicate whether the file execution was successful or not. After executing the downloaded files, it then reports the status (success or fail) of the downloaded files’ execution to its C&C server.

This Trojan posts the following information to its command and control (C&C) server:

• -OS Version