TROJ_REGIN.A

REGIN is a sophisticated malware that has been used to target high profile victims. REGIN uses a variety of advanced evasion techniques. such as the use of multiple infection chains and modules, to avoid detection in order to steal information.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

NOTES:

This is the Trend Micro detection for malicious files that belong to malware group Regin. This is a multi-component malware that uses different files for its functionalities and payload.

Installation

The initial load file is responsible for initializing the routines. This file is usually found in the "System32" folder and may use any of the following filenames:

• abiosdsk.sys
• adpu160.sys
• atdisk.sys
• cdaudio.sys
• floppy.sys
• ndisips.sys
• parclass.sys
• pciclass.sys
• pcidump.sys
• pciport.sys
• rasprt.sys
• rdpmdd.sys
• Ser8UART.sys
• serial.sys
• usbclass.sys

This malware does not store files using the usual file system for its installation. Rather, it stores components in the NTFS Extended Attributes or a registry blob:

• Extended Attrbibutes:
  • %Windows%
  • %Windows%\fonts
  • %Windows%\cursors
  • %Windows%\system32
  • %Windows%\system32\drivers

  (Notes: %Windows% is the Windows folder, which is usually C:\Window.)

• Registry Subkey:
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RestoreList
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{39399744-44FC-AD65-474B-E4DDF-8C7FB97}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{3F90B1B4-58E2-251E-6FFE-4D38C5631A04}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4F20E605-9452-4787-B793-D0204917CA58}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4F20E605-9452-4787-B793-D0204917CA5A}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{9B9A8ADB-8864-4BC4-8AD5-B17DFDBB9F58}
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RestoreList\VideoBase

It creates the following files as markers to identify infected machines:

• %System%\nsreg1.dat
• %System%\bssec3.dat
• %System%\msrdc64.dat

(Notes: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Payload

This malware stores its payloads in encrypted file storage known as Virtual File Systems (VFS). The payload may be stored in the following files/directories:

• %System%\config\SystemAudit.Evt
• %System%\config\SecurityAudit.Evt
• %System%\config\SystemLog.evt
• %System%\config\ApplicationLog.evt
• %Windows%\ime\imesc5\dicts\pintlgbs.imd
• %Windows%\ime\imesc5\dicts\pintlgbp.imd

(Notes: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions. %Windows% is the Windows folder, which is usually C:\Window.)

Functionalities and Information Stealing

This malware group have the following capabilities:

• Rootkit
• Network Port Blocker
• Network Capture
• Credential Stealing
• C&C Communication
• Cryptography Functions
• Gather System Information
• UI manipulation (Screenshot,Log Keystrokes,Click Functionalities)
• File System Manipulation (Create/Read/Write/Delete)
• Process and Module Manipulation
• IIS Web Server Log Theft
• GSM Activity Log

It connects to the following Command & Control (C&C) servers to send and received information:

• {BLOCKED}.{BLOCKED}.114.73
• {BLOCKED}.{BLOCKED}.144.113
• {BLOCKED}.{BLOCKED}.89.80
• {BLOCKED}.{BLOCKED}.237.145