PE_VIRUX.AA

Puede haberlo infiltrado otro malware. Puede haberlo descargado inadvertidamente un usuario mientras visitaba sitios Web maliciosos.

Detalles de entrada

Puede haberlo infiltrado otro malware.

Puede haberlo descargado inadvertidamente un usuario mientras visitaba sitios Web maliciosos.

Instalación

Este malware inyecta códigos en el/los siguiente(s) proceso(s):

• WINLOGON.EXE

Otras modificaciones del sistema

Crea la(s) siguiente(s) entrada(s) de registro para evitar el cortafuegos de Windows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile\AuthorizedApplications\
List
\??\%System%\winlogon.exe = \??\%System%\winlogon.exe:*:enabled:@shell32.dll,-1

Infección de archivo

Infecta los siguientes tipos de archivo:

• .EXE
• .SCR

Evita infectar archivos que contienen las cadenas siguientes en sus nombres:

• OTSP
• WC32
• WCUN
• WINC

Evita infectar archivos que no usan iconos específicos.

• .DLL files
• PE Files with "_win" section name
• Files with infection marker

Otros detalles

Según el análisis de los códigos, tiene las siguientes capacidades:

• Connects to any of the following IRC servers using port 80:
  • {BLOCKED}c.zief.pl
  • {BLOCKED}m.ircgalaxy.pl
• Connects to the said servers using 8-randomly generated character for its NICK and 1-randomly generated character for its USER. Once connected, it joins a certain channel to receive and execute commands on the affected system. As of this writing, the servers reply with a command to download the following file:
  • http://{BLOCKED}a.com/kb9.txt - detected by Trend Micro as TROJ_DLOAD.JKZQ
  This file is saved as temp files in %User Temp% folder. This file infector then executes the downloaded file. As a result, malicious routines of the downloaded file are exhibited on the affected system.
• Performs DNS request to the following site which is inaccessible as of writing:
  • {BLOCKED}ns.pl
• Hooks the following APIs so that when these APIs are called, the malware code is executed which then infects files:
  • NtCreateFile
  • NtOpenFile
  • NtCreateProcess
  • NtCreateProcessEx
  • NtQueryInformationProcess
• Infects script files by first checking if the target script file's extension name is any of the following:.
  • ASP
  • .HTM
  • .PHP
• Once it finds target script files, it creates a flag for the file for iFrame infection. It opens flagged files, then checks for a certain string in the file. If it finds that string, it skips the file. If not, then it proceeds with the infection of the file.
• Looks for the string < /BODY > in the target script file. Once found, it infects script files by inserting the malicious IFRAME code below:
  • 
  Infected script files are detected as HTML_IFRME.QAWA. Trend Micro detects the infected files (EXE/SCR) as either PE_VIRUX.J, PE_VIRUX.N-3, and PE_VIRUX.AA.
• Returns execution to the HOST file's original code after execution of its routines.