JAVA_ADWIND.FLB

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It executes commands from a remote malicious user, effectively compromising the affected system. However, as of this writing, the said sites are inaccessible.

It gathers information and reports it to its servers.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\Ygr\Eci.jar

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %User Profile%\.oracle_jre_usage\{random}.timestamp -> time usage of oracle
• %User Temp%\hsperfdata_{username}\{random} -> contains details of the malware
• %Application Data%\Ygr\Desktop.ini

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It creates the following folders:

• %Application Data%\Ygr
• %User Temp%\hsperfdata_{username}
• %User Profile%\.oracle_jre_usage
• %User Profile%\.Dhm

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

Autostart Technique

This Trojan modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Fqc = “"%Program Files%\Java\jre1.8.0_77\bin\javaw.exe" -jar "%Application Data%\Ygr\Eci.jar"”

Backdoor Routine

This Trojan executes the following commands from a remote malicious user:

• Download Plug-ins
• Download and Execute Files
• Update itself
• Uninstall itself
• Reset Connection

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}ingiller.com:54264

However, as of this writing, the said sites are inaccessible.

Other Details

This Trojan gathers the following information and reports it to its servers:

• Local IP
• Mac Address
• Size of RAM
• Country
• User Name
• OS Name
• OS Version
• If User is Admin
• Java Version

NOTES:

This malware drops the file %Application Data%\Ygr\Desktop.ini so that the folder %Application Data%\Ygr is treated by the computer as the default Recycle Bin folder.

It sets the following folder's attribute to hidden:

• %User Profile%\.Dhm

It sets the following folder's attributes to system, hidden, and read-only:

• %Application Data%\Ygr

It also sets the following files' attributes to system, hidden, and read-only:

• %Application Data%\Ygr\Desktop.ini
• %Application Data%\Ygr\Eci.jar