TrojanSpy.Win32.ICEDID.BB

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It injects its dropped file/component to specific processes.

It connects to a website to send and receive information.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following copies of itself into the affected system:

• %All Users Profile%\{GUID}\{6-14 Random Characters}.exe

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It creates the following folders:

• %All Users Profile%\{GUID}
• %All Users Profile%\{5-7 Random Characters}

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

It injects its dropped file/component to the following processes:

• %System%/svchost.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Autostart Technique

The scheduled task executes the malware every:

• Task Name: {GUID}
  • Task Trigger = At log on
  • Task Action = Execution of the dropped copy
  • Details = %All Users Profile%\{GUID}\{6-14 Random Characters}.exe

(Note: %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). )

Backdoor Routine

This Trojan Spy connects to the following websites to send and receive information:

• where:
  • {string1} - f={Username}&h={Computer Name}&b={WorkGroup}&m={Administrator or Domain Controller}&j={CpuID}&s={OS Version}
  • {string2} - in.php?g={Command ID}&c={Customer ID (Bot ID + Unique ID)}&p=0&r=105&i=0&n=0&o=0&k=53268&a={Member ID}&1=
    where {CpuID} can be any of the following:
    • < 0x04 → not VM
    • 0x04 to 0x07 → VMWare
    • 0x08 to 0x0B → XenVM
    • 0x10 to 0x13 → MicroVM
    • 0x20 to 0x23 → KVMK
    • 0x80 to 0x83 → Vbox
• http://{BLOCKED}isti.com/{string1}
• http://{BLOCKED}isti.com/{string2}
• http://{BLOCKED}ure.pw/{string1}
• http://{BLOCKED}ure.pw/{string2}
• http://{BLOCKED}adar.com/{string1}
• http://{BLOCKED}adar.com/{string2}
• http://{BLOCKED}tion.pw/{string1}
• http://{BLOCKED}tion.pw/{string2}
• http://{BLOCKED}usef.com/{string1}
• http://{BLOCKED}usef.com/{string2}
• http://{BLOCKED}ppsi.com/{string1}
• http://{BLOCKED}ppsi.com/{string2}
• http://{BLOCKED}pant.com/{string1}
• http://{BLOCKED}pant.com/{string2}
• http://{BLOCKED}erki.com/{string1}
• http://{BLOCKED}erki.com/{string2}
• http://{BLOCKED}ues.pw/{string1}
• http://{BLOCKED}ues.pw/{string2}
• http://{BLOCKED}tion.pw/{string1}
• http://{BLOCKED}tion.pw/{string2}