TrojanSpy.Win32.ICEDID.D

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan Spy arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan Spy drops the following files:

• %User Temp%\is-{Random Alphanumeric Characters}.tmp\{Malware Name}.tmp
• %User Temp%\Tar142D.tmp → extracted from authrootstl.cab
• %AppDataLocalLow%\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
• %AppDataLocalLow%\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %AppDataLocalLow% is the LocalLow Application Data folder, which is usually C:\Users\{user name}\AppData\LocalLow on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%User Temp%\is-{Random Alphanumeric Characters}.tmp\{Malware Name}.tmp" /SL5="$140280,837550,832512,{Malware Path}\{Malware Name}.exe"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Download Routine

This Trojan Spy accesses the following websites to download files:

• http://{BLOCKED}2.us/x.cer → downloads a file named x.cer
• http://{BLOCKED}indowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7a34ff8a15e405fa → downloads a file named authrootstl.cab

It saves the files it downloads using the following names:

• x.cer saved as:
  • %AppDataLocalLow%\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
• authrootstl.cab saved as:
  • %User Temp%\Cab142C.tmp
  • %AppDataLocalLow%\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

(Note: %AppDataLocalLow% is the LocalLow Application Data folder, which is usually C:\Users\{user name}\AppData\LocalLow on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)