TROJ_ZACCESS.RUI

This Trojan connects to certain URLs to send and receive commands from a remote malicious user. It terminates processes, some of which are related to system security.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan injects itself into the following processes running in the affected system's memory:

• svchost.exe

It creates the following folders:

• %Application Data%\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}
• %Application Data%\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\L
• %Application Data%\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\U
• %Windows%\Installer\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}
• %Windows%\Installer\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\L
• %Windows%\Installer\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\U

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Classes\
CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32
(Default) = "%Application Data%\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\n."

It modifies the following registry entries:

HKEY_CLASSES_ROOT\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\
InProcServer32
(Default) = "%Application Data%\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\n."

(Note: The default value data of the said registry entry is %SystemRoot%\system32\shdocvw.dll.)

HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\
InprocServer32
(Default) = "\.\globalroot\systemroot\Installer\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\n."

(Note: The default value data of the said registry entry is %System%\wbem\wbemess.dll.)

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Dropping Routine

This Trojan drops the following files:

• %Application Data%\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\@ - detected by Trend Micro as MAL_XIN12
• %Windows%\Installer\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\@ - detected by Trend Micro as MAL_XIN12
• %Application Data%\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\n - detected by Trend Micro as TROJ_SIREFEF.YP
• %Windows%\Installer\{b7c1dda7-fb2c-9bfa-9fc6-8da7b93982d2}\n - detected by Trend Micro as TROJ_SIREFEF.YP

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Information Theft

This Trojan does not have any information-stealing capability.

Other Details

This Trojan deletes itself after execution.

NOTES:

This Trojan accesses the following site to know its location:

• http://{BLOCKED}s.fling.com/geo/txt/city.php

It may connect to a peer using port 16464 to download other malware or update copies of itself.

It does not have rootkit capabilities.

It does not exploit any vulnerability.