TROJ_RAMNIT.BZ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following file(s)/component(s):

• {All Users' Profile}\Application Data\{random 1}.log
• %Application Data%\{random 2} .log
• %Application Data%\{random 3} .log
• %User Temp%\{random}.sys

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %Application Data%\{random folder name}\{random file name}.exe
• %User Temp%\{random file name}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %Application Data%\{random folder name}

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%Application Data%\{random folder name}\{random file name}.exe"

It modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%System%\userinit.exe,,%Application Data\{random folder name}\{random file name}.exe"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

It drops the following file(s) in the Windows Startup folder to enable its automatic execution at every system startup:

• %Start Menu%\Programs\Startup\{random file name}.exe

(Note: %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Other System Modifications

This Trojan adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Micorsoft Windows Service
Type = "1"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Micorsoft Windows Service
Start = "3"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Micorsoft Windows Service
ErrorControl = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Micorsoft Windows Service
DisplayName = "Micorsoft Windows Service"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Micorsoft Windows Service\Security
"Security" =

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Micorsoft Windows Service
DeleteFlag = "1"

Other Details

This Trojan connects to the following URL(s) to check for an Internet connection:

• http://bing.com
• http://google.com
• http://yahoo.com

It connects to the following possibly malicious URL:

• {BLOCKED}.{BLOCKED}.12.103
• {BLOCKED}.{BLOCKED}.21.21
• {BLOCKED}.{BLOCKED}.210.173
• {BLOCKED}.{BLOCKED}.128.139
• {BLOCKED}.{BLOCKED}.128.138
• {BLOCKED}.{BLOCKED}.128.102
• {BLOCKED}.{BLOCKED}.128.101
• {BLOCKED}.{BLOCKED}.128.100
• {BLOCKED}.{BLOCKED}.128.113
• {BLOCKED}.{BLOCKED}.51.230
• {BLOCKED}.{BLOCKED}.244.103
• {BLOCKED}.{BLOCKED}.55.1
• {BLOCKED}.{BLOCKED}.62.76
• {BLOCKED}.{BLOCKED}.0.22
• {BLOCKED}.{BLOCKED}.128.102

It adds and runs the following services:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Micorsoft Windows Service
ImagePath = "\??\%User Temp%\{random}.sys"