SHA1:
e7fc7a0e2d59dc8e18414830b02304fa5a8ce1b9 (NSIS)
3209448505069ff3a6eb1e446854aa85dad9481b (05DB2C2B.dll)
ae2869629aec2c18aedfc134aed8762ffbb66f2c (237AE0F2.dll)
aeef60dfcfa3745e0a3a57585d8ac4c6046bbb03 (dev25E9.exe)
fd4aa4184fcf6240b0cbb14e9c731a87ed744f0d (devCDFB.exe)
1d5897759ee66047e1d4c6378a52079fac2303f5 (payload)
A dropper Trojan for Microsoft Windows that is implemented as an installer of Nullsoft Scriptable Install System (NSIS). The installer and its content has the following digital signature:
CN = Bit-Trejd
OU = IT
O = Bit-Trejd
STREET = 1st Kolobovskij pereulok d. 27/3 str.3 office 30
L = Moscow
S = Moscow
PostalCode = 127051
C = RU
The Trojan terminates its operation if the computer’s localization differs from 1049 (Russian (ru)) or if the installer’s script detects one of the following programs:
avastui.exe
egui.exe
avpui.exe
spideragent.exe
Besides, the installer requests the system registry branch in order to check whether the Kaspersky anti-virus is installed on the computer:
HKCU\\Software\\KasperskyLab\\AVP6
The Trojan uses the attrib utility to remove “Hidden”, “System”, and “Read only” attributes for "%APPDATA%\Roaming\Microsoft\Shockwave" and "%APPDATA%\Roaming\Microsoft\Guide” directories. If these folders are missing, it creates them.
Then the Trojan saves the 7z packer named 7za.exe and a password-protected 7z archive named as install.dat into a temporary folder, files from which are extracted one by one. First, a dynamic library is unpacked:
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 237AE0F2.dll -aoa"
The Trojan loads this library and calls its export with the following parameters:
"Software\Microsoft\Windows\CurrentVersion\Run", "Shockwave Flash Player", "%APPDATA%\Roaming\Microsoft\Shockwave\Guide.exe".
The following files are then extracted from the archive:
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat devCDFB.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 47ED9F45.dat -aoa"
The unpacked file is then run:
cmd.exe /C "%TEMP%\msi1223.tmp\devCDFB.exe 47ED9F45.dat 1.dat
After that, the installer extracts a dynamic library responsible for decryption of the payload:
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 05DB2C2B.dll -aoa
The rest of the files are then finally unpacked:
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat dev25E9.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat devE49C.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe devE49C.tmp -aoa -o7676545.tmp"
The Trojan saves the The Guide program, which is used to load the library to the memory, into the "%APPDATA%\Roaming\Microsoft\Shockwave\” folder. This program is registered in autorun, and the Trojan places a malicious library, naming it as a corresponding Windows library necessary for the program’s operation, into the folder that contains The Guide. As a rule, when a process is launched, Windows first searchers for required libraries in the folder from which the process was run, and then—in Windows system folders. The Trojan uses this feature to load the malicious library to RAM.
Finally, the Trojan extracts the FileTouch utility:
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat FileTouch.exe -aoa"
This utility helps to set dates of file creation, modification, and access 2016-05-06:
FileTouch.exe /s /c /w /a /r /d 06-05-2016 "%APPDATA%\Roaming\Microsoft\Shockwave\*.*"
The last stage is launch of a downloader component:
%APPDATA%\Roaming\Microsoft\Shockwave\dev25E9.exe Guide.exe 05DB2C2B.dllExtracted files have the following names and purposes:
| File name | Purpose |
|---|---|
| 237AE0F2.dll | It has two exports—F1 and F2. F1 receives a registry key, a parameter name and its value. The file uses SID to check whether the user has administrative privileges (if the privileges are missing, the HKCU registry branch is used, if not—HKLM). Then it uses the API SetWindowsHookEx function to intercept the GetMessage event to grant the sent value to the corresponding parameter in the specified registry key. F2 uses the same operation scheme; yet, it does not grant but removes values in the registry. |
| dev25E9.exe | Trojan.Inject2.24412 |
| devCDFB.exe | The file receives source and target files. It reads the content of the source file, decrypts it with XOR, and then it encrypts it with RC2. The key is generated based on the hard drive data. Encrypted information is saved to the target file. |
| 05DB2C2B.dll | The file decrypts the library from the 1.dat file (that was created by devCDFB.exe) and grants it control. |
The main payload of this Trojan is Trojan.PWS.Spy.19338.
