PE_VIRUX.AA

Wird möglicherweise von anderer Malware eingeschleust. Wird möglicherweise unwissentlich von einem Benutzer beim Besuch bösartiger Websites heruntergeladen.

Übertragungsdetails

Wird möglicherweise von anderer Malware eingeschleust.

Wird möglicherweise unwissentlich von einem Benutzer beim Besuch bösartiger Websites heruntergeladen.

Installation

Injiziert Code in die folgenden Prozesse:

• WINLOGON.EXE

Andere Systemänderungen

Erstellt den oder die folgenden Registrierungseinträge, um die Windows Firewall zu umgehen:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
\??\%System%\winlogon.exe = \??\%System%\winlogon.exe:*:enabled:@shell32.dll,-1

Dateiinfektion

Infiziert die folgenden Dateitypen:

• .EXE
• .SCR

Vermeidet es, Dateien zu infizieren, deren Name diese Zeichenfolgen enthält:

• OTSP
• WC32
• WCUN
• WINC

Vermeidet es, die folgenden Dateien zu infizieren:

• .DLL files
• PE Files with "_win" section name
• Files with infection marker

Andere Details

Ausgehend von der Analyse des Codes verfügt die Malware über die folgenden Fähigkeiten:

• Connects to any of the following IRC servers using port 80:
  • {BLOCKED}c.zief.pl
  • {BLOCKED}m.ircgalaxy.pl
• Connects to the said servers using 8-randomly generated character for its NICK and 1-randomly generated character for its USER. Once connected, it joins a certain channel to receive and execute commands on the affected system. As of this writing, the servers reply with a command to download the following file:
  • http://{BLOCKED}a.com/kb9.txt - detected by Trend Micro as TROJ_DLOAD.JKZQ
  This file is saved as temp files in %User Temp% folder. This file infector then executes the downloaded file. As a result, malicious routines of the downloaded file are exhibited on the affected system.
• Performs DNS request to the following site which is inaccessible as of writing:
  • {BLOCKED}ns.pl
• Hooks the following APIs so that when these APIs are called, the malware code is executed which then infects files:
  • NtCreateFile
  • NtOpenFile
  • NtCreateProcess
  • NtCreateProcessEx
  • NtQueryInformationProcess
• Infects script files by first checking if the target script file's extension name is any of the following:.
  • ASP
  • .HTM
  • .PHP
• Once it finds target script files, it creates a flag for the file for iFrame infection. It opens flagged files, then checks for a certain string in the file. If it finds that string, it skips the file. If not, then it proceeds with the infection of the file.
• Looks for the string < /BODY > in the target script file. Once found, it infects script files by inserting the malicious IFRAME code below:
  • 
  Infected script files are detected as HTML_IFRME.QAWA. Trend Micro detects the infected files (EXE/SCR) as either PE_VIRUX.J, PE_VIRUX.N-3, and PE_VIRUX.AA.
• Returns execution to the HOST file's original code after execution of its routines.