TROJ_CUTWAIL.BU

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %System%\drivers\wcscd.sys - TROJ_AGENT.SMC1

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It drops the following copies of itself into the affected system:

• %User Profile%\wuaucldt.exe
• %System%\wuaucldt.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It injects threads into the following normal process(es):

• svchost.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
wuaucldt = %User Profile%\wuaucldt.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
wuaucldt = %System%\wuaucldt.exe

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}5.{BLOCKED}4.239.87.{BLOCKED}dr.arpa
• {BLOCKED}3.{BLOCKED}m.com.ua
• {BLOCKED}8.{BLOCKED}0.80.34.{BLOCKED}servers.com
• {BLOCKED}8.{BLOCKED}0.80.35
• {BLOCKED}8.{BLOCKED}0.80.36
• {BLOCKED}3.{BLOCKED}0.36.70.{BLOCKED}dr.arpa
• 3.{BLOCKED}0.74.65.{BLOCKED}dr.arpa
• 3.{BLOCKED}0.74.65.{BLOCKED}ic.{BLOCKED}esdata.net
• {BLOCKED}9.{BLOCKED}8.{BLOCKED}1.212.{BLOCKED}dr.arpa
• {BLOCKED}0.{BLOCKED}6.100.242
• {BLOCKED}0.{BLOCKED}6.100.243
• {BLOCKED}0.{BLOCKED}6.100.244
• {BLOCKED}4.{BLOCKED}2.4.12
• {BLOCKED}4.{BLOCKED}2.4.13
• {BLOCKED}records.com.br
• {BLOCKED}8.iptp.net
• {BLOCKED}tal.com
• {BLOCKED}el.{BLOCKED}ngquest.com
• {BLOCKED}xrecords.com.br
• {BLOCKED}k.{BLOCKED}hantom.com
• {BLOCKED}ash.com
• {BLOCKED}tion.{BLOCKED}er.com.br
• {BLOCKED}3.{BLOCKED}t2.com.br
• {BLOCKED}05.{BLOCKED}re.ne.jp
• {BLOCKED}ng.{BLOCKED}rg.com.ua
• {BLOCKED}r.{BLOCKED}hima-u.ac.jp
• {BLOCKED}2.{BLOCKED}p.km.ua
• {BLOCKED}ja.{BLOCKED}ay.com.br
• {BLOCKED}mba.{BLOCKED}da.com.ua
• {BLOCKED}rkey.com.ua
• {BLOCKED}1.{BLOCKED}pamer.com
• {BLOCKED}2.{BLOCKED}pamer.com
• {BLOCKED}s.org.ua
• {BLOCKED}oprint.com
• {BLOCKED}v.{BLOCKED}ndd.jp
• {BLOCKED}dor165.{BLOCKED}ting.com.br
• {BLOCKED}l.{BLOCKED}kro.ua
• {BLOCKED}76.{BLOCKED}eb.com.br
• {BLOCKED}ic.{BLOCKED}1.20.35.41.{BLOCKED}nter1.com.br
• {BLOCKED}ic.{BLOCKED}1.20.45.207.{BLOCKED}enter1.com.br
• {BLOCKED}w1.{BLOCKED}t2.com.br
• {BLOCKED}rvers.net
• www.{BLOCKED}dd.jp
• www.{BLOCKED}oxrecords.com.br
• www.{BLOCKED}er.com.br
• www.{BLOCKED}eshop.com.br
• www.{BLOCKED}folheados.com.br
• www.{BLOCKED}gistics.co.jp
• www.{BLOCKED}uryislandcasino.com.ua

However, as of this writing, the said sites are inaccessible.