TROJ_QBOT.WX

This Trojan may arrive bundled with malware packages as a malware component. It may be downloaded by other malware/grayware/spyware from remote sites.

It uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It may be downloaded by other malware/grayware/spyware from remote sites.

Installation

This Trojan uses Windows Task Scheduler to create a scheduled task that executes the dropped copy.

It creates the following folders:

• %system Root%\All Users\_qbothome

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ~sasg2136ggvsdswin

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{Random Name} = %System Root%\Documents And Settings\All Users\_qbothome\_qbotinj.exe', '%System Root%\Documents And Settings\All Users\_qbothome\_qbot.dll, /c {Random application name}

Download Routine

This Trojan connects to the following malicious URLs:

• {BLOCKED}v.co.in
• http://{BLOCKED}02.cn/cgi-bin/jl/jloader.pl?r=3d
• http://{BLOCKED}5.in/1
• http://{BLOCKED}5.in/cgi-bin/jl/jloader.pl?
• http://{BLOCKED}5.in/cgi-bin/jl/jloader.pl?r=q
• http://{BLOCKED}ver.com.ua/cgi-bin/exhandler4.pl
• http://{BLOCKED}ver.com.ua/cgi-bin/ss.pl
• http://{BLOCKED}thewhistle.com/cgi-bin/clientinfo3.pl
• http://www.{BLOCKED}cdc2121cdsfdfd.com
• {BLOCKED}3.com.ua
• {BLOCKED}4.cn
• {BLOCKED}1.co.in
• {BLOCKED}2.co.in
• {BLOCKED}3.in

Other Details

This Trojan does the following:

• It may also access the following websites:
  • .hotbar.com
  • search.msn.com
  • urs.microsoft.com
• It avoids to inject itself in the following processes:
  • R&Q.exe
  • ccApp.exe
  • ctfmon.exe
  • ctfmon.exe
  • dbgview.exe
  • dbgview.exe
  • dumprep.exe
  • dwwin.exe
  • explorer.exe
  • far.exe
  • iexplore.exe
  • mirc.exe
  • mirc.exe
  • mmc.exe
  • msdev.exe
  • msdev.exe
  • nc.exe
  • ollydbg.exe
  • ollydbg.exe
  • outlook.exe
  • photoed
  • skype
  • winlogon.exe
• The following component files are referenced in its code:
  • _qbot.dll
  • _qbotinj.exe
  • _qbotnti.exe
  • alias__qbot.dll
  • alias__qbotinj.exe
  • alias__qbotnti.exe
• Upon execution, it sends the following information to inform the remote host of the infection:
  • City
  • Country
  • DNS name
  • Domain
  • Ext_ip
  • Host Name
  • Install time
  • IS_admin
  • OS
  • Qbot_version
  • State
  • Time
  • User
• It avoids access to websites that contains any of the following strings:
  • agnitum
  • ahnlab
  • arcabit
  • avast
  • avg
  • avira
  • avp
  • bit9
  • bitdefender
  • castlecops
  • centralcommand
  • clamav
  • comodo
  • computerassociates
  • cpsecure
  • defender
  • drweb
  • emsisoft
  • esafe
  • eset
  • etrust
  • ewido
  • f-prot
  • f-secure
  • fortinet
  • gdata
  • grisoft
  • hacksoft
  • hauri
  • ikarus
  • jotti
  • k7computing
  • kaspersky
  • malware
  • mcafee
  • microsoft
  • networkassociates
  • nod32
  • norman
  • norton
  • panda
  • pctools
  • prevx
  • quickheal
  • rising
  • rootkit
  • securecomputing
  • sophos
  • spamhaus
  • spyware
  • sunbelt
  • symantec
  • threatexpert
  • trendmicro
  • virus
  • webroot
  • wilderssecurity
  • windowsupdate
• It also monitors affected users' browsing habits specifically on websites that contains any of the following strings:
  • /cashman/
  • /cashplus/
  • access.jpmorgan.com
  • business-eb.ibanking-services.com
  • businessaccess.citibank.citigroup.com
  • businessonline.huntington.com
  • cashproonline.bankofamerica.com
  • cpw-achweb.bankofamerica.com
  • directline4biz.com
  • directpay.wellsfargo.com
  • ebanking-services.com
  • express.53.com
  • ibc.klikbca.com
  • itreasury.regions.com
  • itreasurypr.regions.com
  • ktt.key.com
  • moneymanagergps.com
  • onb.webcashmgmt.com
  • onlineserv/CM
  • premierview.membersunited.org
  • tmconnectweb
  • treas-mgt.frostbank.com
  • treasury.pncbank.com
  • web-cashplus.com
• It searches for information from the following registry key:

  HKEY_CURRENT_USER\Software\Microsoft
  Internet Account Manager\Accounts,

• The said information includes the following:
  • Internet Explorer AutoComplete passwords
  • Internet Explorer Password-protected sites
  • Outlook Express passwords