TROJ_KOVTER.YAFD

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies the Internet Explorer Zone Settings.

It connects to certain websites to send and receive information. It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\{random string}\{random string}.exe

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It drops the following files:

• %AppDataLocal%\{random foldername}\{random filename}.lnk - shortcut to Batch file
• %AppDataLocal%\{random foldername}\{random filename}.bat - starts Encrypted file
• %AppDataLocal%\{random foldername}\{random filename}.{random extension} - Encrypted file

(Note: %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It adds the following processes:

• regsvr32.exe

It creates the following folders:

• %Application Data%\{random string}
• %AppDataLocal%\{random foldername}

(Note: %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %AppDataLocal% is the Application Data folder found in Local Settings, where it is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

It injects codes into the following process(es):

• created regsvr32.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Classes\
{random key 2}\shell\open\
command
(Default) = ""%System%\mshta.exe" javascript:{random}="{random}";{variable 1}=new%20ActiveXObject("WScript.Shell");{random}="{random}";{variable 2}={variable 1}.RegRead("HKCU\software\{random key 1}\{random valuename 2}");{random}="{random}";eval({variable 2});{random}="{random}";"

HKEY_CURRENT_USER\Software\Classes\
.{random extension}
(Default) = "{random key 2}"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
(Default) = ""%System%\mshta.exe" javascript:{random}="{random}";{variable 1}=new%20ActiveXObject("WScript.Shell");{random}="{random}";{variable 2}={variable 1}.RegRead("HKCU\software\{random key 1}\{random valuename 2}");{random}="{random}";eval({variable 2});{random}="{random}";"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
(Default) = ""%System%\mshta.exe" javascript:{random}="{random}";{variable 1}=new%20ActiveXObject("WScript.Shell");{random}="{random}";{variable 2}={variable 1}.RegRead("HKLM\software\{random key 1}\{random valuename 2}");{random}="{random}";eval({variable 2});{random}="{random}";"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
(Default) = "%Application Data%\{random string}\{random string}.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
(Default) = "%AppDataLocal%\{random foldername}\{random filename}.lnk" ← shortcut to Batch file

Other System Modifications

This Trojan adds the following registry keys:

HKEY_CURRENT_USER\Software\{random key 1}

HKEY_LOCAL_MACHINE\SOFTWARE\{random key 1}

HKEY_CURRENT_USER\Software\Classes\
.{random extension}

HKEY_CURRENT_USER\Software\Classes\
{random key 2}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\{random key 1}
{random valuename 1} = "{Encrypted Data}"

HKEY_CURRENT_USER\Software\{random key 1}
{random valuename 2} = "{Loader Script}"

HKEY_CURRENT_USER\Software\{random key 1}
{random valuename 3} = "{User-Agent}"

HKEY_CURRENT_USER\Software\{random key 1}
{random valuename 4} = "{3 random number}"

HKEY_CURRENT_USER\Software\{random key 1}
{random valuename 5} = "{16 hex numbers}"

HKEY_CURRENT_USER\Software\{random key 1}
{random valuename 6} = "{10 random numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\{random key 1}
{random valuename 1} = "{Encrypted Data}"

HKEY_LOCAL_MACHINE\SOFTWARE\{random key 1}
{random valuename 2} = "{Loader Script}"

HKEY_LOCAL_MACHINE\SOFTWARE\{random key 1}
{random valuename 3} = "{User-Agent}"

HKEY_LOCAL_MACHINE\SOFTWARE\{random key 1}
{random valuename 4} = "{3 random number}"

HKEY_LOCAL_MACHINE\SOFTWARE\{random key 1}
{random valuename 5} = "{16 hex numbers}"

HKEY_LOCAL_MACHINE\SOFTWARE\{random key 1}
{random valuename 6} = "{10 random numbers}"

Web Browser Home Page and Search Page Modification

This Trojan modifies the Internet Explorer Zone Settings.

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.72.90/upload.php - inaccessible
• {random generated ip address} → used for click-fraud activity

It does the following:

• It may download and install the following software on the affected system:
  • Microsoft .Net Framework
  • Microsoft Powershell
  • Adobe Flash Player
• Connects to certain IP address for its click-fraud activity.
• Uses power shell to execute the obfuscated javascript codes in the registry.

It deletes the initially executed copy of itself