TROJ_RAMNIT.SMUT

This Trojan is a component of TROJ_ROOTER.DRL that infects the boot records of the affected system. It writes the said malware in the last sector of the hard disk. It then modifies the master boot record (MBR) to enable the malware to automatically load even before the operating system boots up.

This Trojan arrives as a component bundled with malware/grayware packages. It may be dropped by other malware.

Arrival Details

This Trojan arrives as a component bundled with malware/grayware packages.

It may be dropped by the following malware:

• TROJ_ROOTER.DRL

Installation

This Trojan drops the following files:

• %User Temp%\{random characters}.sys - RTKT_RAMNIT.A

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This Trojan registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service
Type = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service
Start = "4"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service
ImagePath = "%User Temp%\{random characters}.sys"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service
DisplayName = "Micorsoft Windows Service"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service
DeleteFlag = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service\Security
Security = "{hex values}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service\Enum
0 = "Root\LEGACY_MICORSOFT_WINDOWS_SERVICE\0000"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service\Enum
Count = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Micorsoft Windows Service\Enum
NextInstance = "1"

Process Termination

This Trojan terminates the following services if found on the affected system:

• RapportMgmtService

NOTES:

It is a component of TROJ_ROOTER.DRL that infects the boot records of the affected system. It writes the said malware in the last sector of the hard disk. It then modifies the master boot record (MBR) to enable the malware to automatically load even before the operating system boots up.