This malware was designed to spread BackDoor.Yebot. Being written in Assembly, it targets Windows systems. When launched, the Trojan injects its code into svchost.exe, csrss.exe, lsass.exe and explorer.exe processes. Then, it sends the following request to the command and control server:
http://46.***.***.24/f/i.html?n=1&i=6C78E45B&s=22E2F&g=3&c=6C78E45B&pl=%5B
System%20Process%5D;0;0;System;4;0;smss.exe;368;4;csrss.exe;584;368;winlogon.exe;
608;368;services.exe;652;608;lsass.exe;664;608;VBoxService.exe;820;652;
svchost.exe;864;652;svchost.exe;952;652;svchost.exe;1044;652;svchost.exe;
1100;652;svchost.exe;1132;652;spoolsv.exe;1388;652;mscorsvw.exe;1516;652;
wuauclt.exe;1700;1044;alg.exe;2016;652;wmiprvse.exe;256;864;explorer.exe;
996;884;wscntfy.exe;1076;1044;VBoxTray.exe;1172;996;python.exe;1556;820;
18dacf3896cee9d20b15dfa6d912394e363252b9904798215edc4e4798c3e459;492;1556&r=
0.51103000.2600.1
The malware downloads BackDoor.Yebot from the remote server, decrypts it using an RC4 algorithm with the key c=6C78E45B, then performs all the manipulations in its memory and transfers control to the entry point of a dynamic link library.
Some of Trojan's features are encrypted and can be decrypted only while being executed. To perform this action a malicious program reserves the memory that is automatically freed when the feature's code is executed. Encrypting process implements the bytes' reordering, so that the entropy of the encrypted code does not change.
First, the Trojan sets the AddVectoredExceptionHandler parameter to intercept all exceptions, especially, "IN" privileged instructions. In this case, to provide anti-debugging in the Trojan's assembler code, some call instructions were replaced with "IN" instructions followed by one or two bytes. Examples of Trojan's code:
.text:00485A01 push 18h
.text:00485A03 push 0
.text:00485A05 push 10h
.text:00485A07 push offset ExceptionHandler
.text:00485A0C push offset TimerHandler
.text:00485A11 push offset unk_481934
.text:00485A16 push dword_481930
.text:00485A1C call eax ; ntdll_RtlCreateTimer
.text:00485A1E push 54Eh
.text:00485A23 call ds:Sleep
.text:00485A23 ; ---------------------------------------------------------------------------
.text:00485A29 Function_In_485a29 db 0ECh ; ь ; 0x48417c GetAllAPIs
.text:00485A2A db 7Ch ; |
.text:00485A2B db 21h ; !
.text:00485A2C ; ---------------------------------------------------------------------------
.text:00485A2C push 1
.text:00485A2E push offset unk_401730
.text:00485A2E ; ---------------------------------------------------------------------------
.text:00485A33 db 0E4h ; ф ; 0x4016d4 advapi32_InitializeSecurityDescriptor
.text:00485A34 db 61h ; a
.text:00485A35 ; ---------------------------------------------------------------------------
.text:00485A35 push 0
.text:00485A37 push 0
.text:00485A39 push 1
.text:00485A3B push offset unk_401730
.text:00485A3B ; ---------------------------------------------------------------------------
.text:00485A40 db 0E4h ; ф ; 0x4016d8 advapi32_SetSecurityDescriptorDacl
.text:00485A41 db 62h ; b
.text:00485A42 ; ---------------------------------------------------------------------------
.text:00485A42 lea edx, unk_401730
This malware also incorporates mechanisms to verify the virtual machine in a target system using the following algorithm:
- Monitoring of the SYSTEM\ControlSet001\Control\DeviceClasses registry branch for Ven_VMware_ line
- Checking an application SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall SysAnalyzer in the list of installed programs
The address of the command and control server is also encrypted by using an RC4 algorithm, the encryption code is in one of the encrypted features.
The Trojan incorporates a mechanism to bypass User Accounts Control using the Elevation: Administrator! new: {3ad05575-8857-4850-9277-11b85bdb8e09} vulnerability.
