Trojan.Click.24535

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe] 'Debugger' = 'ntsd -d'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ctfmon.exe' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run] 'llajyn_df' = '%WINDIR%\system\lljyn081204.exe'
[<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\InternetExplorer\iexplore.exe" -nohome'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.exe] 'Debugger' = 'ntsd -d'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Explorer' = '<DRIVERS>\suchost.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'vmdetdhc.exe' = '<SYSTEM32>\vmdetdhc.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe] 'Debugger' = 'ntsd -d'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe] 'Debugger' = 'ntsd -d'

Creates or modifies the following files:

<SYSTEM32>\spoolsv.exe
%WINDIR%\Tasks\SA.DAT
%WINDIR%\windows.ext
%WINDIR%\Tasks\spoolsv.ext

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\tzatsu] 'Start' = '00000000'

Infects the following executable system files:

<SYSTEM32>\ctfmon.exe
<DRIVERS>\beep.sys

Substitutes the following executable system files:

<SYSTEM32>\dllcache\beep.sys with <SYSTEM32>\dllcache\beep.sys.new
<SYSTEM32>\dllcache\spoolsv.exe with <SYSTEM32>\dllcache\spoolsv.exe.new
<SYSTEM32>\dllcache\ctfmon.exe with <SYSTEM32>\dllcache\ctfmon.exe.new
<SYSTEM32>\ctfmon.exe with <SYSTEM32>\ctfmon.exe.new
<SYSTEM32>\spoolsv.exe with <SYSTEM32>\spoolsv.exe
<DRIVERS>\beep.sys with <DRIVERS>\beep.sys.new
<SYSTEM32>\spoolsv.exe with <SYSTEM32>\spoolsv.exe.new

Creates the following files on removable media:

<Drive name for removable media>:\autorun.inf
<Drive name for removable media>:\ЎЎЎЎЎЎ.exe

Malicious functions:

To complicate detection of its presence in the operating system,

forces the system hide from view:

hidden files

Creates and executes the following:

%TEMP%\032.exe
%TEMP%\setup_1027281.exe
%TEMP%\8.exe
<DRIVERS>\suchost.exe
<SYSTEM32>\Com\ie.exe
<SYSTEM32>\config.txt
%WINDIR%\system\zhahss081202.exe i
%TEMP%\yoyo1182.exe
%TEMP%\1019.exe
%TEMP%\9874.exe
%TEMP%\ok1.exe
<SYSTEM32>\vmdetdhc.exe -Start
%TEMP%\setup1500.exe
%WINDIR%\windows.ext
<SYSTEM32>\config.txt (downloaded from the Internet)

Executes the following:

<SYSTEM32>\cmd.exe /c %TEMP%\del75$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del7$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del2$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del60$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del49$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del38$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del97$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del80$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del18$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del77$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del11$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del5$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del66$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del95$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del79$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del14$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del99$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del86$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del20$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del40$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del55$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del36$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del48$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del93$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del81$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del39$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del42$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del4$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del85$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del52$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del53$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del3$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del12$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del64$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del22$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del62$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del21$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del70$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del74$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del30$$.bat
<SYSTEM32>\cmd.exe /c <SYSTEM32>\copy2090000.bat
<SYSTEM32>\ping.exe -n 3 127.0.0.1
<SYSTEM32>\cmd.exe /c %TEMP%\del19$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del68$$.bat
<SYSTEM32>\net1.exe share Z$ /del /y
<SYSTEM32>\net1.exe share E$ /del /y
<SYSTEM32>\ctfmon.exe
<SYSTEM32>\wbem\wmiadap.exe /R /T
<SYSTEM32>\cmd.exe /c <SYSTEM32>\Ee6486.bat
<SYSTEM32>\ntsd.exe -c q -p 1528
<SYSTEM32>\cmd.exe /c %TEMP%\45$$.bat
<SYSTEM32>\spoolsv.exe -Start
<SYSTEM32>\ntvdm.exe -f -i1
<SYSTEM32>\rundll32.exe <SYSTEM32>\fIDi.dll,DllRegisterServer
<SYSTEM32>\rundll32.exe %WINDIR%\system\zhnahsdf081202c.dll a16zhqb
<SYSTEM32>\rundll32.exe <SYSTEM32>\fIDi.dll,DllUnregisterServer
<SYSTEM32>\attrib.exe +s +h "%WINDIR%\system\zhahss081202.exe"
<SYSTEM32>\attrib.exe +s +h "%WINDIR%\system\zhnahsdf081202c.dll"
<SYSTEM32>\net1.exe share C$ /del /y
<SYSTEM32>\cmd.exe /c %TEMP%\del13$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del94$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del16$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del69$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del17$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del91$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del6$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del50$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del76$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del98$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del47$$.bat
<SYSTEM32>\cmd.exe /c ""c:\dfDelmlljy.bat" "
<SYSTEM32>\net1.exe share A$ /del /y
<SYSTEM32>\net1.exe share admin$ /del /y
<SYSTEM32>\cmd.exe /c %TEMP%\del37$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del35$$.bat
<SYSTEM32>\ping.exe 127.0.0.1
<SYSTEM32>\cmd.exe /c %TEMP%\del34$$.bat
<SYSTEM32>\cmd.exe /c %TEMP%\del41$$.bat

Injects code into

the following system processes:

<SYSTEM32>\svchost.exe
<SYSTEM32>\spoolsv.exe

the following user processes:

360tray.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\ctfmon.exe

the following user processes:

AVP.EXE

Searches for windows to

bypass different anti-viruses:

ClassName: 'AVP.TrafficMonConnectionTerm' WindowName: ''
ClassName: 'AVP.Product_Notification' WindowName: ''
ClassName: 'AVP.AlertDialog' WindowName: ''

Hides the following processes:

Forces autoplay for removable media.

Modifies file system :

Creates the following files:

%TEMP%\del11$$.bat
%TEMP%\del5$$.bat
%TEMP%\del79$$.bat
%TEMP%\del6$$.bat
%TEMP%\del66$$.bat
%TEMP%\del95$$.bat
%TEMP%\del86$$.bat
%TEMP%\del77$$.bat
%TEMP%\del2$$.bat
%TEMP%\del60$$.bat
%TEMP%\del20$$.bat
%TEMP%\del14$$.bat
%TEMP%\del99$$.bat
%TEMP%\del91$$.bat
C:\Far2\Addons\XLat\Russian\Desk_top_.ini
C:\Far2\Documentation\Desk_top_.ini
%TEMP%\del94$$.bat
C:\Far2\Addons\SetUp\Desk_top_.ini
C:\Far2\Addons\Shell\Desk_top_.ini
C:\Far2\Addons\XLat\Desk_top_.ini
C:\Far2\Documentation\eng\Desk_top_.ini
%TEMP%\del50$$.bat
%TEMP%\33$$.Ico
%TEMP%\del76$$.bat
%TEMP%\del17$$.bat
C:\Far2\Documentation\rus\Desk_top_.ini
C:\Far2\Encyclopedia\Desk_top_.ini
%TEMP%\del75$$.bat
%TEMP%\del48$$.bat
%TEMP%\del93$$.bat
%TEMP%\del55$$.bat
%TEMP%\del62$$.bat
%TEMP%\del21$$.bat
%TEMP%\del52$$.bat
%TEMP%\del36$$.bat
%TEMP%\del39$$.bat
%TEMP%\del42$$.bat
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\mydown[1].asp
%TEMP%\del81$$.bat
%TEMP%\del4$$.bat
%TEMP%\del85$$.bat
%TEMP%\del74$$.bat
%TEMP%\del18$$.bat
%TEMP%\del38$$.bat
%TEMP%\del97$$.bat
%TEMP%\del7$$.bat
%TEMP%\del49$$.bat
%TEMP%\del80$$.bat
%TEMP%\del40$$.bat
%TEMP%\del3$$.bat
%TEMP%\del22$$.bat
%TEMP%\del70$$.bat
%TEMP%\del12$$.bat
%TEMP%\del64$$.bat
%TEMP%\del53$$.bat
%TEMP%\del13$$.bat
<SYSTEM32>\fIDi.dll
<DRIVERS>\suchost.exe
<DRIVERS>\dauqhm.sys
%TEMP%\45$$.bat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\Жф¶Ї Internet Explorer дЇААЖч.lnk
%HOMEPATH%\Favorites\НшЦ·µјєЅ.url
%WINDIR%\system\zhahss081202.exe
C:\go.sys
C:\zhqbdf16d.bat
<Current directory>\Desk_top_.ini
%ALLUSERSPROFILE%\hsyhdf16.ini
%WINDIR%\system\zhnahsdf081202c.dll
<SYSTEM32>\Ee6486.bat
%WINDIR%\Temp\scs2.tmp
%TEMP%\setup1500.exe
%TEMP%\setup_1027281.exe
%TEMP%\yoyo1182.exe
%TEMP%\8.exe
%TEMP%\032.exe
%TEMP%\9874.exe
%TEMP%\OYJN02.EXE
<SYSTEM32>\vmdetdhc.exe
%WINDIR%\Temp\scs1.tmp
%WINDIR%\ResetTest.txt
%TEMP%\ok1.exe
%TEMP%\1019.exe
%WINDIR%\windows.ext
%TEMP%\61$$.Ico
%TEMP%\del35$$.bat
%TEMP%\del98$$.bat
C:\Far2\Desk_top_.ini
%TEMP%\del37$$.bat
%TEMP%\del34$$.bat
%TEMP%\del41$$.bat
C:\Far2\Addons\Desk_top_.ini
%TEMP%\del16$$.bat
C:\Far2\Addons\Macros\Desk_top_.ini
%TEMP%\del69$$.bat
C:\Far2\Addons\Colors\Desk_top_.ini
C:\Far2\Addons\Colors\Custom Highlighting\Desk_top_.ini
C:\Far2\Addons\Colors\Default Highlighting\Desk_top_.ini
%TEMP%\del47$$.bat
<SYSTEM32>\copy2090000.bat
C:\ЎЎЎЎЎЎ.exe
%TEMP%\del68$$.bat
%TEMP%\del19$$.bat
%TEMP%\del30$$.bat
<SYSTEM32>\Com\ie.exe
C:\autorun.inf
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\config[1].txt
<SYSTEM32>\config.txt
C:\dfDelmlljy.bat
%WINDIR%\system\lljyn081204.exe
%ALLUSERSPROFILE%\lljyndf16.ini
%WINDIR%\system\llbjyn32bb.dll

Sets the 'hidden' attribute to the following files:

C:\Far2\Addons\SetUp\Desk_top_.ini
C:\Far2\Addons\Shell\Desk_top_.ini
C:\Far2\Addons\Macros\Desk_top_.ini
C:\Far2\Addons\Colors\Custom Highlighting\Desk_top_.ini
C:\Far2\Addons\Colors\Default Highlighting\Desk_top_.ini
C:\Far2\Addons\XLat\Desk_top_.ini
C:\Far2\Documentation\rus\Desk_top_.ini
C:\Far2\Encyclopedia\Desk_top_.ini
C:\Far2\Documentation\eng\Desk_top_.ini
C:\Far2\Addons\XLat\Russian\Desk_top_.ini
C:\Far2\Documentation\Desk_top_.ini
<Current directory>\Desk_top_.ini
<Drive name for removable media>:\ЎЎЎЎЎЎ.exe
%WINDIR%\system\zhnahsdf081202c.dll
<SYSTEM32>\vmdetdhc.exe
%WINDIR%\system\zhahss081202.exe
<Drive name for removable media>:\autorun.inf
C:\Far2\Addons\Desk_top_.ini
C:\Far2\Addons\Colors\Desk_top_.ini
C:\Far2\Desk_top_.ini
C:\ЎЎЎЎЎЎ.exe
C:\autorun.inf

Deletes the following files:

%WINDIR%\Tasks\spoolsv.ext
%TEMP%\setup_1027281.exe
%TEMP%\61$$.Ico
%TEMP%\9874.exe
%TEMP%\33$$.Ico
%TEMP%\8.exe
<SYSTEM32>\ctfmon.exe.tmp
%WINDIR%\Temp\scs2.tmp
%WINDIR%\Temp\scs1.tmp
%TEMP%\1019.exe
%TEMP%\setup1500.exe
C:\go.sys
%TEMP%\ok1.exe
%TEMP%\032.exe

Moves the following files:

from <SYSTEM32>\dllcache\ctfmon.exe.new to <SYSTEM32>\dllcache\ctfmon.exe
from <SYSTEM32>\ctfmon.exe to <SYSTEM32>\ctfmon.exe.tmp
from %TEMP%\setup1500.exe.exe to %TEMP%\setup1500.exe

Network activity:

Connects to:

'localhost':1389
'44#.#r18.com':80
'id#.#kaka.com':80
'localhost':1431
'<Private IP address>':445
'aa.#234.net':82
'www.bu#####nchang.com.cn':80
'<Private IP address>':139

TCP:

HTTP GET requests:

id#.#kaka.com/idc1/mydown.asp?ve#########################################
44#.#r18.com/config.txt
www.bu#####nchang.com.cn/api.php?bX##################################################################################################

UDP:

DNS ASK www.da###ng08.com
DNS ASK id#.#kaka.com
DNS ASK www.wo#####idongxi.com.cn
DNS ASK aa.#234.net
DNS ASK www.bu#####nchang.com.cn
DNS ASK 44#.#r18.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Indicator' WindowName: ''
ClassName: '' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'ATL:028644E0' WindowName: '??????????????????????????????'
ClassName: 'msctls_statusbar32' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: 'Progman' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'Afx:400000:0' WindowName: ''
ClassName: 'CabinetWClass' WindowName: ''
ClassName: 'ConsoleWindowClass' WindowName: 'ntvdm-a60.a70.380001'
ClassName: 'EDIT' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}' WindowName: '{F03B79CC-5B19-4D71-9EDD-FFDD44B441BF}'
ClassName: '#32770' WindowName: '???????????????????? - IE??????'
ClassName: '#32770' WindowName: '????????'
ClassName: '#32770' WindowName: 'IE????????'
ClassName: '#32770' WindowName: 'IE ????????'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней