TROJ_HDROP.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %User Temp%\HwpLib.dll - detected as TSPY_GRABBER.A

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Download Routine

This Trojan accesses the following websites to download files:

• http://ts-c.{BLOCKED}a.ne.jp:80/mt/php/0.css
• http://{BLOCKED}f.net:80/mt/php/0.css
• http://{BLOCKED}ya.co.kr:80/bbs/imgFd/0.css
• http://milk-cb.{BLOCKED}a.ne.jp:80/menu/0.css

It saves the files it downloads using the following names:

• {common path of Hanggul Word Processor}\0.css
  • such as %System Root%\HNC\Hwp70\0.css

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Information Theft

This Trojan gathers the following data:

• Processor Information
• List of documents (.hwp, .doc, .docx, .xls, .xlsx)
• List of running services
• IP configuration
• Environment Variable values
  • ALLUSERSPROFILE
  • APPDATA
  • CLIENTNAME
  • CommonProgramFiles
  • COMPUTERNAME
  • ComSpec
  • FP_NO_HOST_CHECK
  • HOMEDRIVE
  • HOMEPATH
  • J2D_D3D
  • LOGONSERVER
  • NUMBER_OF_PROCESSOR
  • OS
  • Path
  • PATHEXT
  • PROCESSOR_ARCHITECT
  • PROCESSOR_IDENTIFIE
  • PROCESSOR_LEVEL
  • PROCESSOR_REVISION
  • ProgramFiles
  • PROMPT
  • SESSIONNAME
  • SystemDrive
  • SystemRoot
  • TEMP
  • TMP
  • USERDOMAIN
  • USERNAME
  • USERPROFILE
  • windir

Stolen Information

This Trojan saves the stolen information in the following file:

• {common path of Hanggul Word Processor}\{random characters}.gif
  • such as %System Root%\HNC\Hwp70\{random characters}.gif

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It sends the gathered information via HTTP POST to the following URL:

• http://ts-c.{BLOCKED}a.ne.jp:80/mt/php/mt2.php
• http://{BLOCKED}f.net:80/mt/php/lib/function.mbbstring.php
• http://{BLOCKED}ya.co.kr:80/bbs/imgFd/m1.php
• http://milk-cb.{BLOCKED}a.ne.jp:80/menu/a_9.php

Other Details

However, as of this writing, the said sites are inaccessible.

NOTES:

This Trojan gathers information by executing commands through cmd.exe.