TROJ_BOAXXE.LE

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System%\bopomofo.uce
• %Windows%\Task\At{random}.job

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.. %Windows% is the Windows folder, which is usually C:\Windows.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}\Parameters
ServiceDll = "{malware path and filename}"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{GUID}\
InprocServer32

HKEY_CLASSES_ROOT\CLSID\{GUID}

HKEY_CLASSES_ROOT\{random 1}

HKEY_CLASSES_ROOT\{random 1}\CLSID

HKEY_CLASSES_ROOT\CLSID\{GUID}\
ProgID

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
Browser Helper Objects\{GUID}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
ShellIconOverlayIdentifiers\Enhanced Storage

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}\Parameters

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\SvcHost\
netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_SRSERVICE\
0000\Control

It adds the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{GUID}\
InprocServer32
@ = "{malware path and filename}"

HKEY_CLASSES_ROOT\CLSID\{GUID}\
InprocServer32
ThreadingModel = "Apartment"

HKEY_CLASSES_ROOT\{random 1}\CLSID
@ = "{GUID}"

HKEY_CLASSES_ROOT\CLSID\{GUID}\
ProgID
@ = "{random 1}"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\
ShellIconOverlayIdentifiers\Enhanced Storage
@ = "{GUID}"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}
ImagePath = "%System%\svchost.exe -k netsvcs"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}
Description = "Controller for PnP ISA/EISA Bus"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}
DisplayName = "PnP ISA/EISA Bus Controller"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}
ErrorControl = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}
ObjectName = "LocalSystem"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}
Type = "20"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\{random 2}\Parameters
ServiceMain = "DllRegisterServer"

HKEY_CLASSES_ROOT\CLSID\{GUID}
Version = "64"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Enum\Root\LEGACY_SRSERVICE\
0000\Control
ActiveService = "srservice"

Download Routine

This Trojan connects to the following malicious URLs:

• {BLOCKED}e-domain.info
• {BLOCKED}amily.net
• {BLOCKED}ango.com
• {BLOCKED}p.com
• {BLOCKED}832764.com
• {BLOCKED}idge.com
• {BLOCKED}sicte.com
• {BLOCKED}r.com
• {BLOCKED}in.org
• {BLOCKED}e.com
• {BLOCKED}rpitch.net
• {BLOCKED}ord.info
• {BLOCKED}lac.com
• {BLOCKED}hods.com
• {BLOCKED}outer.net