TROJ_DLDELF.SMIE

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\wbem\3350\svchost.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It creates the following folders:

• %System%\wbem\3350

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Autostart Technique

This Trojan registers itself as a BHO to ensure its automatic execution every time Internet Explorer is used by adding the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\explorer\
Browser Helper Objects\{8F2263B2-2213-4391-91D7-188D720812DE}

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CLASSES_ROOT\CLSID\{8F2263B2-2213-4391-91D7-188D720812DE}

HKEY_CLASSES_ROOT\CLSID\{8F2263B2-2213-4391-91D7-188D720812DE}\
InprocServer32

HKEY_CLASSES_ROOT\tobstyvtc.QQExpTools

HKEY_CLASSES_ROOT\tobstyvtc.QQExpTools\Clsid

HKEY_CLASSES_ROOT\CLSID\{8F2263B2-2213-4391-91D7-188D720812DE}\
ProgID

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
%System%\wbem\3350\svchost.exe = "%System%\wbem\3350\svchost.exe:*:Enabled:svchost"

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
CLSID\{8F2263B2-2213-4391-91D7-188D720812DE}\InprocServer32
ThreadingModel = "Apartment"

Dropping Routine

This Trojan drops the following files:

• %System%\wbem\tobstyvtc.dll
• %System%\f873348001.dll
• %Windows%\625e62bb00.dll
• %System Root%\$$306609.bat

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://www.{BLOCKED}r.cn/plug/doSelect.asp?{random characters}
• http://www.{BLOCKED}s.cn/usersetup.asp?{random characters}

This report is generated via an automated analysis system.