TROJ_UPATRE.FMS

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It modifies certain registry entries to disable Security Center functions. Doing this allows this malware to execute its routines without being detected. It modifies registry entries to disable the Windows Firewall settings. This action allows this malware to perform its routines without being deteted by the Windows Firewall.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %User Temp%\Xulantar.exe

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Other System Modifications

This Trojan modifies the following registry entries:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\SharedAccess
Start = "4"

(Note: The default value data of the said registry entry is {User defined}.)

It modifies the following registry entries to disable Security Center functions:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

(Note: The default value data of the said registry entry is {User defined}.)

It modifies the following registry entries to disable the Windows Firewall settings:

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\PublicProfile
EnableFirewall = "0"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\PublicProfile
DoNotAllowExceptions = "0"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\PublicProfile
DisableNotifications = "1"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
EnableFirewall = "0"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DoNotAllowExceptions = "0"

(Note: The default value data of the said registry entry is {User defined}.)

HKEY_LOCAL_MACHINE\System\CurrenControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\DomainProfile
DisableNotifications = "1"

(Note: The default value data of the said registry entry is {User defined}.)

Process Termination

This Trojan terminates the following services if found on the affected system:

• MpsSvc
• WinDefend

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• {BLOCKED}.{BLOCKED}.186.106/cat22.png
• {BLOCKED}.{BLOCKED}.104.15/cat22.png
• {BLOCKED}.{BLOCKED}.211.242/cat22.png
• {BLOCKED}.{BLOCKED}.210.122/cat22.png
• {BLOCKED}.{BLOCKED}.215.35/cat22.png
• {BLOCKED}.{BLOCKED}.124.103/cat22.png
• {BLOCKED}.{BLOCKED}.7.219/cat22.png
• {BLOCKED}.{BLOCKED}.175.7/cat22.png
• {BLOCKED}.{BLOCKED}.161.47/cat22.png
• {BLOCKED}.{BLOCKED}.104.170/cat22.png
• {BLOCKED}.{BLOCKED}.142.189/cat22.png
• {BLOCKED}.{BLOCKED}.144.101/cat22.png
• {BLOCKED}.{BLOCKED}.194.212/cat22.png
• {BLOCKED}.{BLOCKED}.19.13/cat22.png
• {BLOCKED}.{BLOCKED}.26.136/cat22.png
• {BLOCKED}.{BLOCKED}.129.214/cat22.png

It saves the files it downloads using the following names:

• %User Temp%\{random filename}.exe - detected as TSPY_DYRE.XMS

(Note: %User Temp% is the user's temporary folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Temp on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.)

Information Theft

This Trojan gathers the following data:

• Computer name
• Operating system version
• Service pack installed

Other Details

This Trojan connects to the following URL(s) to get the affected system's IP address:

• icanhazip.com

It deletes the initially executed copy of itself

NOTES:

This Trojan connects to the following URL to report infection of the affected system:

• {BLOCKED}.{BLOCKED}.17.201:{port}/{infection ID}/{computer name}/{number}/{OS version}-{service pack installed}/{number}/{string}