PE_MUSTAN.B

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It creates certain registry entries to disable applications related to security.

It infects by appending its code to target host files. It adds infection markers to files.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This file infector arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This file infector adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\_PPIftSvc

It injects codes into the following process(es):

• svchost.exe
• lsass.exe

Other System Modifications

This file infector adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\Select
rmt = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\Select
tst = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Control\Windows
NoPopUpsOnBoot = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\Windows Error Reporting
DontshowUI = "1"

HKEY_LOCAL_MACHINE\SYSTEM\Select
plg = {hex values}

HKEY_LOCAL_MACHINE\SYSTEM\Select
v = "{virus code}

HKEY_LOCAL_MACHINE\SYSTEM\Select
p = {User Password}

HKEY_LOCAL_MACHINE\SYSTEM\Select
pu = {Current User - Current User's Password}

HKEY_LOCAL_MACHINE\SYSTEM\Select
ext = {hex values}

It creates the following registry entries to disable applications related to security:

HKEY_LOCAL_MACHINE\CurrentControlSet\Services
{Security Service} = "4"

It deletes the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{Anti-Virus Autostart} =

File Infection

This file infector infects the following file types:

• .exe

It infects by appending its code to target host files.

It adds infection markers to files.

It avoids infecting folders containing the following strings:

• qq
• Outlook
• winnt
• windows
• RECYCLER
• Messenger
• Movie Maker
• Microsoft
• Internet Explorer
• System Volume Information
• Common Files

This is the Trend Micro detection for files infected by:

• PE_MUSTAN.B

Download Routine

This file infector connects to the following malicious URLs:

• e.{BLOCKED}t.in
• e.{BLOCKED}t.com
• e.{BLOCKED}t.net

NOTES:

Where {Security Service} are the following:

• 360rp
• zhudongfangyu
• ekrn
• MsMpSvc
• avp
• V3 Service
• AntiVirService
• a2AntiMalware
• FSORSPClient
• FSMA
• F-Secure Gatekeeper Handler Starter
• kxescore
• kxesapp
• AVGIDSAgent
• Nis
• AVGwd
• avast! Antivirus
• vsserv
• mcshield
• mcods
• amsp
• RsRavMon
• SavService
• PavFnSvr
• pavsrv

The malware copies %System%\wscript.exe as %System%\wmicuclt.exe. It then infects the file %System%\wmicuclt.exe by injecting itself into the last section of the file.

It adds the following infection marker:

• PPIF

It attempts to open the Remote Desktop Protocol (RDP) connection on computers in the local network by brute-forcing the administrator login using the following user and password combinations:

User:

• admin
• administrator
• test
• user

Password:

• !@#$%
• &*()g
• 1002t
• 110110
• 112233
• 123321
• 123654
• 123qwe
• 168168
• 198612
• 1q2w3e
• 1qaz2wsx
• 2003)-
• 20070315
• 2222d
• 23abc
• 31415926
• 4567890
• 47258k)123h?
• 520520
• 59357
• 7 !@#
• 7758521
• 789456
• Internetd
• P@ssW0rd
• PASSWORD
• abcdh
• adm1n
• admin
• alpha
• az456p
• batman
• computp
• database
• dragon
• enable
• f2tyh*
• fangyou
• foobar
• fuckme
• ghjkl
• godblesslK
• harley
• ihavenol
• ilovec
• istratoyrx
• iwantu
• jennifer
• jordan
• kill}
• letmein
• login
• masdY
• michaelm
• mim~Assb
• monkey
• mustang
• n pwv
• oracle
• owner
• password
• patrick
• princess
• pussy
• qazp.
• ranger
• robert
• rockyou
• secret
• server
• shadow
• super
• tasklist
• testl
• thomas
• trustno1
• tyuiop
• windows
• woaini
• wojia
• zxcvbnm

Once successfully connected, it attempts to infect files on all shared folders through the following directory:

• \\tsclient\{a-z}