Analysis by: Jasen Sumalapao
ALIASES:

Rogue:Win32/Winwebsec (Microsoft), Trojan-FakeAV.Win32.Agent.rph (Kaspersky), Trojan.Gen (Symantec), PWS-Zbot.gen.akj (NAI), Mal/FakeAV-KL (Sophos), Trojan.Win32.Generic!BT (Sunbelt), Trojan.Generic.KD.694336 (Bitdefender), W32/Agent.KL!tr (Fortinet), Trojan.Win32.FakeAV (Ikarus), a variant of Win32/Kryptik.AJZF trojan (NOD32), Trojan W32/FakeAV.BGDR (Norman)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be manually installed by a user.

It displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to a website asking for sensitive information, such as credit card numbers.

  TECHNICAL DETAILS

File Size: 434,176 bytes
File Type: EXE
Initial Samples Received Date: 15 Aug 2012

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be manually installed by a user.

Installation

This Trojan drops a copy of itself in the following folders using different file names:

  • %System Root%\Documents and Settings\All Users\Application Data\6F638C1200771EBE0009A1AE7B07D287\6F638C1200771EBE0009A1AE7B07D287.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It drops the following component file(s):

  • %System Root%\Documents and Settings\All Users\Application Data\6F638C1200771EBE0009A1AE7B07D287\6F638C1200771EBE0009A1AE7B07D287.ico
  • %User Profile%\Desktop\Live Security Platinum.lnk
  • %Start Menu%\Programs\Live Security Platinum\Live Security Platinum.lnk

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

It creates the following folders:

  • %System Root%\Documents and Settings\All Users\Application Data\6F638C1200771EBE0009A1AE7B07D287
  • %System Root%\Documents and Settings\All Users\Application Data\6F638C1200771EBE0009A1AE7B07D287\6F638C1200771EBE0009A1AE7B07D287
  • %User Profile%\Application Data\Microsoft\Protect\S-1-5-21-1614895754-436374069-682003330-1003\1cc9ebfa-cf99-4554-8a6f-085f28fd928a
  • %Start Menu%\Programs\Live Security Platinum
  • System%\Microsoft\Protect\S-1-5-18\User\7bfca1b5-23cc-482b-8834-2e3c17172dd9

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following lines or registry entries as part of its routine:

  • HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\6F638C5A00771F060009A1F67B07D2CF

It creates the following registry entries to enable automatic execution of dropped component at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
6F638C1200771EBE0009A1AE7B07D287 = %System Root%\Documents and Settings\All Users\Application Data\6F638C1200771EBE0009A1AE7B07D287\6F638C1200771EBE0009A1AE7B07D287.exe

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum
DisplayName = Live Security Platinum

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum
UninstallString = %System Root%\Documents and Settings\All Users\Application Data\6F638C1200771EBE0009A1AE7B07D287\6F638C1200771EBE0009A1AE7B07D287.exe -u

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum
ShortcutPath = %System Root%\Documents and Settings\All Users\Application Data\6F638C1200771EBE0009A1AE7B07D287\6F638C1200771EBE0009A1AE7B07D287.exe -u

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
Live Security Platinum
DisplayIcon = %System Root%\Documents and Settings\All Users\Application Data\6F638C1200771EBE0009A1AE7B07D287\6F638C1200771EBE0009A1AE7B07D287.ico,0

Backdoor Routine

This Trojan connects to the following URL(s) to send and receive commands from a remote malicious user:

  • {BLOCKED}s.{BLOCKED}ies.com

Rogue Antivirus Routine

This Trojan displays fake alerts that warn users of infection. It also displays fake scanning results of the affected system. It then asks for users to purchase it once scanning is completed. If users decide to purchase the rogue product, users are directed to the following website asking for sensitive information, such as credit card numbers:

  • Live Security Platinum