Trojan.Win32.SMOKELOADER.AI

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

As of this writing, the said sites are inaccessible.

It terminates itself if it detects it is being run in a virtual environment. It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\{random} -> filename is generated from system information

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %User Temp%\4DD3.tmp -> copy of %System%\ntdll.dll
• %Application Data%\{random} -> XML file to run the dropped copy of itself; filename is generated from system information
• %Application Data%\{random} -> downloaded component from C&C server; filename is generated from system information

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {Random hash from system info}
• opera_shared_counter

It injects codes into the following process(es):

• explorer.exe

It modifies file attributes to make files hidden.

Other System Modifications

This Trojan deletes the following files:

• %Application Data%\{dropped copy}:Zone.Identifier

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• x64dbg.exe
• x32dbg.exe
• autoruns.exe
• idaq64.exe
• idaq.exe
• idaw64.exe
• idaw.exe
• ollydbg.exe
• processhacker.exe
• procexp.exe
• procmon.exe
• tcpview.exe
• wireshark.exe

Download Routine

This Trojan connects to the following URL(s) to download its component file(s):

• http://{BLOCKED}older131-service.space/

As of this writing, the said sites are inaccessible.

Information Theft

This Trojan gathers the following data:

• Computer Name
• User Name
• System Volume Information
• Credentials used in the following protocols:
  • ftp
  • smtp
  • pop3
  • imap
• Data being sent from the following browsers:
  • Firefox
  • Internet Explorer
  • Edge
  • Chrome
  • Opera

Stolen Information

This Trojan sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}older231-service.space/

Other Details

This Trojan terminates itself if it detects it is being run in a virtual environment.

It deletes itself after execution.

It checks if the following virtual machine or sandbox related module(s) is loaded in the affected system:

• sbiedll

It checks if the following virtual machine- or sandbox-related registry keys are present in the affected system:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControLSet\
Enum\IDE\{*vm string*}
where vm string = qemu; virtio; vmware; vbox; xen

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControLSet\
Enum\SCSI\{*vm string*}
where vm string = qemu; virtio; vmware; vbox; xen

It does not proceed to its malicious routine if it detects that it is being debugged.

It adds the following scheduled tasks:

• NvNgxUpdateCheckDaily_{%08X-%04X-%04X-%04X-%08X%04X}
• Task Action: regsvr32 /s /n /u /i:"%Application Data%\{XML file}" scrobj

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)