TROJ_FKEAV.SME3

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a certain website asking for sensitive information, such as credit card numbers.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• TROJ_FAKEAV.ARL

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Security Protection = "{malware path and file name}"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\816F02B495A60B5B347F805530F40E10

It adds the following registry entries:

HKEY_CURRENT_USER\Software\816F02B495A60B5B347F805530F40E10
FRun = "0"

HKEY_CURRENT_USER\Software\816F02B495A60B5B347F805530F40E10
O`ld = "{random characters}"

HKEY_CURRENT_USER\Software\816F02B495A60B5B347F805530F40E10
Q`ui = "{random characters}"

Rogue Antivirus Routine

This Trojan displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a certain website asking for sensitive information, such as credit card numbers.

NOTES:

It terminates all running processes in the affected system except the following:

• audiodg.exe
• consent.exe
• control.exe
• csrss.exe
• ctfmon.exe
• defender.exe
• dllhost.exe
• dwm.exe
• dwwin.exe
• explorer.exe
• full_version.exe
• internat.exe
• logonui.exe
• lsass.exe
• lsm.exe
• mcagent.exe
• mcmscsvc.exe
• MpfAlert.exe
• MpfSrv.exe
• msfeedssync.exe
• msimn.exe
• rundll32.exe
• SCRemover.exe
• SearchFilterHost.exe
• SearchIndexer.exe
• SearchProtocolHost.exe
• services.exe
• sim.exe
• SLsvc.exe
• smss.exe
• spoolsv.exe
• svchost.exe
• System
• taskeng.exe
• taskhost.exe
• TrustedInstaller.exe
• userinit.exe
• VMwareService.exe
• VMwareTray.exe
• VMwareUser.exe
• wininit.exe
• winlogon.exe
• winmgmt.exe
• WmiPrvSE.exe
• wscntfy.exe
• wuauclt.exe

If any process is started other than the ones mentioned above, it terminates that process and displays the following notification:

It displays the following fake alerts:

It displays the following window and pretends to scan the system:

It displays the following summary window leaving the user the option to activate the fake anti-virus software to remove all threats:

If the user agrees to activate the software, the user is redirected to the URL http://mw-{BLOCKED}tion.com/buy-now.php?bid=117. The following window is displayed containing the returned webpage:

However, as of this writing, the said site is inaccessible.