TROJ_QBOT.DA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It creates registry entries to enable its automatic execution at every system startup.

It prevents users from visiting antivirus-related websites that contain specific strings. It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

• %User Profile%\Application Data\Microsoft\{Random}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %User Profile%\Application Data\Microsoft\{Random}\{Random}.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It adds the following possibly malicious files or file components:

• %User Profile%\APPLICATION DATA\MICROSOFT\{Random}\{Random}.dll

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe
• iexplore.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{Random} = "%User Profile%\Application Data\Microsoft\{Random}\{Random}.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
ctfmon.exe = "%User Profile%\Application Data\Microsoft\{Random}\{Random}.exe" /c %System%\ctfmon.exe"

(Note: The default value data of the said registry entry is "%System%\ctfmon.exe".)

It drops the following shortcut pointing to its copy in the User Startup folder to enable its automatic execution at every system startup:

• %User Startup%\{Random}.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• msdev.exe
• dbgview.exe
• mirc.exe
• ollydbg.exe
• ctfmon.exe

Information Theft

This Trojan monitors the Internet Explorer (IE) activities of the affected system, specifically the address bar or title bar. It recreates a legitimate website with a spoofed login page if a user visits banking sites with the following strings in the address bar or title bar:

• .webcashmgmt.com;
• /achupload
• /achupload;
• /cashman/;
• /cashplus/;
• /cmserver/
• /cmserver/;
• /corpach/
• /corpach/;
• /payments/ach
• /payments/ach;
• /stbcorp/
• /stbcorp/;
• /wcmpr/
• /wcmpr/;
• /wcmpw/
• /wcmpw/;
• /wcmtr/
• /wcmtr/;
• /wires/;
• /wiret
• /wiret;
• abnamro.nl;
• access.jpmorgan.com;
• accessonline.abnamro.com;
• achbatchlisting
• achbatchlisting;
• business-eb.ibanking-services.com;
• businessaccess.citibank.citigroup.com;
• businessbankingcenter.synovus.com;
• businessinternetbanking.synovus.com;
• businessonline.huntington.com
• businessonline.huntington.com;
• businessonline.tdbank.com
• businessonline.tdbank.com;
• cashproonline.bankofamerica.com;
• cbs.firstcitizensonline.com
• cbs.firstcitizensonline.com;
• chsec.wellsfargo.com
• chsec.wellsfargo.com;
• commercial.wachovia.com
• commercial.wachovia.com;
• commercial2.wachovia.com
• commercial2.wachovia.com;
• commercial3.wachovia.com
• commercial3.wachovia.com;
• commercial4.wachovia.com
• commercial4.wachovia.com;
• corporatebanking;
• cpw-achweb.bankofamerica.com;
• directline4biz.com;
• directpay.wellsfargo.com;
• e-facts.org;
• e-moneyger.com;
• each.bremer.com;
• ebanking-services.com;
• essaccess.citibank.citigroup.com
• express.53.com;
• firstmeritib.com/defaultcorp.aspx;
• firstmeritib.com;
• goldleafach.com
• goldleafach.com;
• iachwellsprod.wellsfargo.com
• iachwellsprod.wellsfargo.com;
• ibc.klikbca.com;
• iris.sovereignbank.com;
• itreasury.regions.com;
• itreasurypr.regions.com;
• ktt.key.com;
• moneymanagergps.com;
• netconnect.bokf.com;
• ocm.suntrust.com;
• onlineserv/CM;
• otm.suntrust.com;
• paylinks.cunet.org;
• premierview.membersunited.org;
• providentnjolb.com;
• scotiaconnect.scotiabank.com
• scotiaconnect.scotiabank.com;
• securentrycorp.amegybank.com;
• singlepoint.usbank.com;
• svbconnect.com;
• tcfexpressbusiness.com
• tcfexpressbusiness.com
• tmconnectweb;
• treas-mgt.frostbank.com;
• treasury.pncbank.com;
• trz.tranzact.org
• trz.tranzact.org;
• tssportal.jpmorgan.com;
• ub-businessonline.blilk.com
• ub-businessonline.blilk.com;
• wc.wachovia.com
• wc.wachovia.com;
• wcp.wachovia.com
• wcp.wachovia.com;
• web-cashplus.com;
• webexpress.tdbank.com
• webexpress.tdbank.com;
• wellsoffice.wellsfargo.com
• wellsoffice.wellsfargo.com;

Stolen Information

This Trojan sends the gathered information via HTTP POST to the following URL:

• {BLOCKED}ysgtap.co.in
• {BLOCKED}istr.in
• {BLOCKED}vtkn.in.ua
• {BLOCKED}son.in
• {BLOCKED}uytdk.info
• {BLOCKED}mentis.org

Other Details

This Trojan prevents users from visiting antivirus-related websites that contain the following strings:

• explabs.
• sanasecurity
• phishtank.com
• hautesecure.com
• truste.com
• clearclouddns
• webroot.
• agnitum
• ahnlab
• arcabit
• avast
• avg
• avira
• avp
• bitdefender
• bit9
• castlecops
• centralcommand
• clamav
• comodo
• computerassociates
• cpsecure
• defender
• drweb
• emsisoft
• esafe
• .eset
• etrust
• ewido
• fortinet
• f-prot
• f-secure
• gdata
• grisoft
• hacksoft
• hauri
• ikarus
• jotti
• k7computing
• kaspersky
• malware
• mcafee
• networkassociates
• nod32
• norman
• norton
• panda
• pctools
• prevx
• quickheal
• rising
• rootkit
• securecomputing
• sophos
• spamhaus
• spyware
• sunbelt
• symantec
• threatexpert
• trendmicro
• virus
• wilderssecurity
• windowsupdate
• update.microsoft.
• download.microsoft.
• download.microsoft.

It deletes itself after execution.

NOTES:

This Trojan iis capable of connecting to a certain Internet Relay Chat (IRC) server using a certain port and joins a channel where it receives commands from a malicious user. It sends the following information to its C&C server:

• dnsname
• domain
• ex_addr
• ex_code
• ex_module
• ex_module_base
• ext_ip
• hostname
• install_time
• is_admin
• nick
• os
• qbot_version
• th_args
• th_flags
• th_title
• time
• user

It gathers passwords by monitoring the following files:

• firefox.exe
• iexplore.exe
• msmsgs.exe
• msnmsgr.exe
• opera.exe
• outlook.exe
• skype.exe
• wscntfy.exe
• wuauclt.exe
• yahoomessenger.exe