Trojan.Win32.REMUTIL.C

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Application Data%\Remote Utilities Agent\Logs\rut_log_{YYYY}-{MM}.html → logs of connections
• %User Temp%\restart_{GUID}.cmd → if the parameter 'restart' is present

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• {Malware Path}\javchedsvr.exe /tray /user

It creates the following folders:

• %Application Data%\Remote Utilities Agent
• %Application Data%\Remote Utilities Agent\Logs

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• Global\RMSServerGlobal
• Global\RMSServerConfig
• Global\RMSGlobalHost
• Global\RMSServerGlobalStarter
• madExceptSettingsMtx{random characters}

Other System Modifications

This Trojan deletes the following folders:

• %User Temp%\{Malware filename w/o .exe}.madExcept

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following registry entries:

HKEY_CURRENT_USER\Software\straightforward sandbox\
Host\Parameters
FUSClientPath = {Malware Path}\javchedsvr.exe

FUSClientPath = {Malware Path}\javchedsvr.exe HKEY_CURRENT_USER\Software\
straightforward sandbox\Host\Parameters
General = {hex values}

HKEY_CURRENT_USER\Software\straightforward sandbox\
Host\Parameters
InternetId = {hex values}

HKEY_CURRENT_USER\Software\straightforward sandbox\
Host\Parameters
Security = {hex values}

HKEY_CURRENT_USER\Software\straightforward sandbox\
Host\Parameters
Certificates = {hex values}

HKEY_CURRENT_USER\Software\straightforward sandbox\
Host\Parameters
CalendarRecordSettings = {hex values}

Backdoor Routine

This Trojan opens the following port(s) where it listens for remote commands:

• 5650

It connects to the following URL(s) to send and receive commands from a remote malicious user:

• {BLOCKED}.{BLOCKED}.61.146:5655
• {BLOCKED}.{BLOCKED}.14.178:5655
• {BLOCKED}.{BLOCKED}.232.18:5655

NOTES:

This Trojan does the following:

• It executes the following commands from a remote user:
  • Remote access/control
  • Remote printing
  • Install a program
  • Record the screen
  • Record the sound
  • Remote terminal
  • Chat via video, voice, or text
  • Execute a file
  • Manage files (move, copy, delete, send, receive)
  • Power control (shutdown, restart, log off, lock, hibernate)
  • See opened processes via task manager
  • View/edit registry via regedit
• It requires the following files in order for it to proceed to its intended routine:
  • javchedsvr.exe
  • libeay32.dll
  • ssleay32.dll
• It accepts the following parameters:
  • services → starts a service named javschedsvr
  • restart → creates a file and restarts itself
  • run_agent → is necessary for it to proceed to its malicious routine
  • second → is necessary for it to proceed to its malicious routine
• It adds the following processes if the parameter 'restart' is present:
  • chcp 1252
  • {Malware full path} -stop
  • ping localhost -n 5
  • taskkill /IM {Malware filename} /F /T
  • ping localhost -n 5
  • start "" {Malware full path} -start
  • del /Q %User Temp%\\restart_{GUID}.cmd