Analysis by: Miguel Carlo Ang
ALIASES:

Crypt3.BZHO(AVG);Trojan-Ransom.Win32.Blocker.gmug(Kaspersky);VirTool:Win32/CeeInject.gen!KK(Microsoft)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan deletes the initially executed copy of itself.

  TECHNICAL DETAILS

File Size: 225,341 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 07 Feb 2015

Installation

This Trojan drops the following copies of itself into the affected system:

  • %System Root%\(8 random characters)\{8 random characters}.exe
  • %Application Data%\(8 random characters).exe
  • %User Startup%\(8 random characters).exe

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{8 random characters} = "%System Root%\(8 random characters)\{8 random characters}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{8 random characters}c = "%Application Data%\{8 random characters}.exe"

It drops the following file(s) in the Windows User Startup folder to enable its automatic execution at every system startup:

  • %User Startup%\(8 random characters).exe

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Other System Modifications

This Trojan modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\BITS
Start = 4

(Note: The default value data of the said registry entry is 3.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\ERSvc
Start = 4

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wscsvc
Start = 4

(Note: The default value data of the said registry entry is 2.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\wuauserv
Start = 4

(Note: The default value data of the said registry entry is 2.)

Other Details

This Trojan connects to the following possibly malicious URL:

  • {BLOCKED}s.com/img4.php
  • {BLOCKED}flymedia.az/img2.php
  • {BLOCKED}rniainsuranceco.com/img4.php
  • {BLOCKED}seniordogfood.com/img2.php
  • {BLOCKED}nblowdri.com/img4.php
  • {BLOCKED}lassn.com/volunteer/img1.php
  • {BLOCKED}.net/plus/img1.php
  • {BLOCKED}voplasma.com/televisa/img1.php
  • {BLOCKED}-score-repair-help.com/img4.php
  • {BLOCKED}rack.com/img2.php
  • {BLOCKED}ctor.com/img3.php
  • {BLOCKED}members.com/img4.php
  • {BLOCKED}ondock.com/img2.php
  • {BLOCKED}utions.net/img5.php
  • {BLOCKED}chluy.net/utf.php
  • {BLOCKED}shersreviews.org/img3.php
  • {BLOCKED}olve.com/img2.php
  • {BLOCKED}igninc.net/img3.php
  • {BLOCKED}ligames.org/img1.php
  • {BLOCKED}ithere.com/tools/img2.php
  • {BLOCKED}wncarandlimousine.com/img1.php
  • {BLOCKED}eaparchitects.com/img4.php
  • {BLOCKED}ashlaundry.com/wp-content/img1.php
  • {BLOCKED}lawoffice.com/img1.php
  • {BLOCKED}ski.com/img5.php
  • {BLOCKED}ideosonline.net/img2.php
  • {BLOCKED}.com/img3.php
  • {BLOCKED}apan.com/img3.php
  • {BLOCKED}sm.net/img4.php
  • {BLOCKED}bo.org/img5.php
  • {BLOCKED}up.net/img5.php
  • {BLOCKED}ns.com/img4.php
  • {BLOCKED}olistic.com/img1.php
  • {BLOCKED}f.com/img4.php
  • {BLOCKED}ngela.com/img5.php
  • {BLOCKED}-club.net/img3.php
  • {BLOCKED}ldakariri.net/img2.php
  • {BLOCKED}rt.net/img2.php
  • {BLOCKED}alestateinvestor.com/img1.php
  • {BLOCKED}com/img5.php
  • {BLOCKED}usmetalsrarecoininvestments.com/img2.php
  • {BLOCKED}a.com/img1.php
  • {BLOCKED}orseoservices.com.au/img5.php

It deletes the initially executed copy of itself

NOTES:

This Trojan drops the following files in the folder where encrypted files are:

  • HELP_DECRYPT.TXT
  • HELP_DECRYPT.HTML
  • HELP_DECRYPT.URL
  • HELP_DECRYPT.PNG