TROJ_ZLOB.SMFM
Information Stealer
Windows
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives via removable drives. It may be dropped by other malware.
TECHNICAL DETAILS
Arrival Details
This Trojan arrives via removable drives.
It may be dropped by other malware.
Installation
This Trojan drops the following files:
- {removable drive}:\__d__.lnk (detected as EXPL_CPLINK.SM)
- { removable drive}:\__e__.lnk (detected as EXPL_CPLINK.SM)
- { removable drive}:\__f__.lnk (detected as EXPL_CPLINK.SM)
- { removable drive}:\__g__.lnk (detected as EXPL_CPLINK.SM)
- { removable drive}:\__h__.lnk (detected as EXPL_CPLINK.SM)
- { removable drive}:\__i__.lnk (detected as EXPL_CPLINK.SM)
- { removable drive}:\__j__.lnk (detected as EXPL_CPLINK.SM)
- %systemroot%\system32\WSPDll.dll
- %systemroot%\system32\ECELP4.ACM (detected as TROJ_AGENT.IAAN)
- %systemroot%\system32\shelldoc.dll detected as TROJ_FANNY.AA)
- %temp%\msupdate.exe (detected as TROJ_FANNY.AC)
- %systemroot%\MSAgent\AGENTCPD.DLL (detected as TROJ_FANNY.AB)
- %systemroot%\system32\__d__.lnk (detected as EXPL_CPLINK.SM)
- %systemroot%\system32\__e__.lnk (detected as EXPL_CPLINK.SM)
- %systemroot%\system32\__f__.lnk (detected as EXPL_CPLINK.SM)
- %systemroot%\system32\__g__.lnk (detected as EXPL_CPLINK.SM)
- %systemroot%\system32\__h__.lnk (detected as EXPL_CPLINK.SM)
- %systemroot%\system32\__i__.lnk (detected as EXPL_CPLINK.SM)
- %systemroot%\system32\__j__.lnk (detected as EXPL_CPLINK.SM)
It drops the following copies of itself into the affected system:
- %systemroot%\system32\comhost.dll
- %systemroot%\system32\mscorwin.dll
- %systemroot%\system32\RCX16A.tmp
It adds the following mutexes to ensure that only one of its copies runs at any one time:
- GlobalRPCMutex25
Other System Modifications
This Trojan adds the following registry entries:
HKEY_Local_Machine\Software\Microsoft\
MsNetMng
COM = %systemroot%\system32\comhost.dll
HKEY_Local_Machine\Software\Microsoft\
MsNetMng
Version = 0
HKEY_Local_Machine\Software\Microsoft\
MsNetMng
Status = 01 00 00 00
HKEY_Local_Machine\Software\Microsoft\
MsNetMng
Policy = 00 00 00 00
It adds the following registry entries as part of its installation routine:
HKEY_Local_Machine\System\CurrentControlSet\
Control\MediaResources\acm\
ECELP4
filter8 = lsass#%systemroot%\system32\mscorwin.dll
HKEY_Local_Machine\System\CurrentControlSet\
Control\MediaResources\acm\
ECELP4
filter3 = explorer#%systemroot%\system32\shelldoc.dll
HKEY_Local_Machine\System\CurrentControlSet\
Control\MediaResources\acm\
ECELP4
filter2 = winlogon#%systemroot%\MSAgent\AGENTCPD.DLL
HKEY_Local_Machine\System\CurrentControlSet\
Control\MediaResources\acm\
ECELP4
DevNode = 0
HKEY_Local_Machine\System\CurrentControlSet\
Control\MediaResources\acm\
ECELP4
Driver = %systemroot%\system32\ECELP4.ACM
Download Routine
This Trojan connects to the following website(s) to download and execute a malicious file:
- http://{BLOCKED}upplystore.mooo.com/ads/QueryRecord200586_f2ahx.html
- http://{BLOCKED}upplystore.mooo.com/results/QueryRecord200586_f2ahx.eot
Information Theft
This Trojan gathers the following data:
- Host Name
- Username
- Running Processes
- Adapter Type
- MAC Address
- IP Address
NOTES:
If the infection is from USB drives, the malware is seen fanny.bmp and is usually bundled with malicious LNK files related to CVE-2010-2568. We detect this as EXPL_CPLINK.SM.
These malicious LNK files enable the execution and spread of the malware to removable drives even if Autorun feature is disabled.
It exploits the vulnerability addressed in CVE-2009-1123 to escalate privileges.
After the privilege escalation, it connects to its C&C URLs where the response from the connection is another URL.
The malware connects to the received URL where it sends the stolen system information. The URL response is a binary executable file which is downloaded and executed as part of the infection chain on the affected system as %System Root%\system32\msregstr.exe.
It has the ability to do SSDT Hook on NT!ShutdownSystem that allows the malware to be persistent on the system.
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Search and delete this file
Step 3
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
Step 4
Delete this registry value
Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.
Step 5
Scan your computer with your Trend Micro product to delete files detected as TROJ_ZLOB.SMFM. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Did this description help? Tell us how we did.