Trojan.MSIL.TNEGA.BA

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %Downloads%\YoruPhone
• %Downloads%\ADDMETO.exe
• Rar.exe -> if the machine does not have winrar installed

Agrega los procesos siguientes:

• "C:\Program Files\WinRAR\Rar.exe" x -pMYADDTOQAZ8855 C:\Users\Public\Downloads\ADDMETO.rar C:\Users\Public\Downloads
• "C:\Users\Public\Downloads\ADDMETO.exe" C:\Users\Public\Downloads\YoruPhone.exe
• "C:\Windows\system32\cmd.exe" /c REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders " /f /v Startup /d C:\Users\Public\Downloads
• REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders " /f /v Startup /d C:\Users\Public\Downloads ;
• "C:\Windows\system32\cmd.exe" /c schtasks /create /sc minute /mo 5 /tr "C:\Users\Public\Downloads\YoruPhone.exe" /F /tn "YoruPhone"

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
User Shell Folders
Startup = %Downloads%

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Shell Folders
Startup = %Downloads%

Otros detalles

Hace lo siguiente:

• Checks the existence of the value of the following registry keys and deletes them if they are existing:
  • HKEY_CURRENT_USER\Software\Usfile\DateInternet
  • HKEY_CURRENT_USER\Software\Usfile\DateCopy
• If C:\Users\Public\Downloads\YoruPhone does not exist:
  • Sets the value of HKEY_CURRENT_USER\Software\Usfile\ME to the bits of the malware
• Checks reg key value:
  • HKEY_CURRENT_USER\Software\Usfile\ and sets the value and data to CopyMe = 1 if it is null