RTKT_NECURS.B

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• BKDR_NECURS.BGSJ

Installation

This Trojan drops the following copies of itself into the affected system:

• %System%\drivers\{random}.sys

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
DisplayName = "{random}"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
Group = "Boot Bus Extender"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
ImagePath = "%System%\drivers\{random}.sys"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
Start = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
Tag = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}
Type = "1"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\{random}

Rootkit Capabilities

This Trojan is used by other malware for its rootkit functionalities.

NOTES:

This Trojan disables services used by the following companies by modifying its code to return to unsuccessful status:

• ALWIL Software
• Agnitum Ltd
• Anti-Virus
• Avira GmbH
• BITDEFENDER LLC
• Beijing Jiangmin
• Beijing Rising
• BitDefender SRL
• BullGuard Ltd
• CJSC Returnil Software
• Check Point Software Technologies Ltd
• Comodo Inc
• Comodo Security Solutions
• Doctor Web Ltd
• ESET, spol. s r.o.
• FRISK Software International Ltd
• G DATA Software
• GRISOFT, s.r.o.
• Immunet Corporation
• K7 Computing
• KProcessHacker
• Kaspersky Lab
• NovaShield Inc
• PC Tools
• Panda Software International
• Quick Heal Technologies
• SUNBELT SOFTWARE
• Sophos Plc
• Sunbelt Software
• VirusBuster Ltd
• WinDefend

It disables drivers with the following names by modifying its code to return to unsuccessful status:

• a2acc.sys
• a2acc64.sys
• a2gffi64.sys
• a2gffx64.sys
• a2gffx86.sys
• ahnflt2k.sys
• AhnRec2k.sys
• AhnRghLh.sys
• amfsm.sys
• amm6460.sys
• amm8660.sys
• AntiLeakFilter.sys
• antispyfilter.sys
• AntiyFW.sys
• ArfMonNt.sys
• AshAvScan.sys
• aswmonflt.sys
• AszFltNt.sys
• ATamptNt.sys
• AVC3.SYS
• AVCKF.SYS
• avgmfi64.sys
• avgmfrs.sys
• avgmfx64.sys
• avgmfx86.sys
• avgntflt.sys
• avmf.sys
• BdFileSpy.sys
• bdfm.sys
• bdfsfltr.sys
• caavFltr.sys
• catflt.sys
• cmdguard.sys
• csaav.sys
• cwdriver.sys
• dkprocesshacker.sys
• drivesentryfilterdriver2lite.sys
• dwprot.sys
• eamonm.sys
• eeCtrl.sys
• eeyehv.sys
• eeyehv64.sys
• eraser.sys
• EstRkmon.sys
• EstRkr.sys
• fildds.sys
• fortimon2.sys
• fortirmon.sys
• fortishield.sys
• fpav_rtp.sys
• fsfilter.sys
• fsgk.sys
• ggc.sys
• HookCentre.sys
• HookSys.sys
• ikfilesec.sys
• ino_fltr.sys
• issfltr.sys
• issregistry.sys
• K7Sentry.sys
• klbg.sys
• kldback.sys
• kldlinf.sys
• kldtool.sys
• klif.sys
• kmkuflt.sys
• KmxAgent.sys
• KmxAMRT.sys
• KmxAMVet.sys
• KmxStart.sys
• lbd.sys
• MaxProtector.sys
• mbam.sys
• mfehidk.sys
• mfencoas.sys
• MiniIcpt.sys
• mpFilter.sys
• NanoAVMF.sys
• NovaShield.sys
• nprosec.sys
• nregsec.sys
• nvcmflt.sys
• NxFsMon.sys
• OADevice.sys
• OMFltLh.sys
• PCTCore.sys
• PCTCore64.sys
• pervac.sys
• PktIcpt.sys
• PLGFltr.sys
• PSINFILE.SYS
• PSINPROC.SYS
• pwipf6.sys
• PZDrvXP.sys
• Rtw.sys
• rvsmon.sys
• sascan.sys
• savant.sys
• savonaccess.sys
• SCFltr.sys
• SDActMon.sys
• SegF.sys
• shldflt.sys
• SMDrvNt.sys
• snscore.sys
• Spiderg3.sys
• SRTSP.sys
• SRTSP64.SYS
• SRTSPIT.sys
• ssfmonm.sys
• ssvhook.sys
• STKrnl64.sys
• strapvista.sys
• strapvista64.sys
• THFilter.sys
• tkfsavxp.sys
• tkfsavxp64.sys
• tkfsft.sys
• tkfsft64.sys
• tmevtmgr.sys
• tmpreflt.sys
• UFDFilter.sys
• v3engine.sys
• V3Flt2k.sys
• V3Flu2k.sys
• V3Ift2k.sys
• V3IftmNt.sys
• V3MifiNt.sys
• Vba32dNT.sys
• vcdriv.sys
• vchle.sys
• vcMFilter.sys
• vcreg.sys
• vradfil2.sys
• ZxFsFilt.sys

It has anti-virtual machine routine that causes virtual machines to hang.