Trojan.MSIL.TNEGA.BA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Downloads%\YoruPhone
• %Downloads%\ADDMETO.exe
• Rar.exe -> if the machine does not have winrar installed

It adds the following processes:

• "C:\Program Files\WinRAR\Rar.exe" x -pMYADDTOQAZ8855 C:\Users\Public\Downloads\ADDMETO.rar C:\Users\Public\Downloads
• "C:\Users\Public\Downloads\ADDMETO.exe" C:\Users\Public\Downloads\YoruPhone.exe
• "C:\Windows\system32\cmd.exe" /c REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders " /f /v Startup /d C:\Users\Public\Downloads
• REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders " /f /v Startup /d C:\Users\Public\Downloads ;
• "C:\Windows\system32\cmd.exe" /c schtasks /create /sc minute /mo 5 /tr "C:\Users\Public\Downloads\YoruPhone.exe" /F /tn "YoruPhone"

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
User Shell Folders
Startup = %Downloads%

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Shell Folders
Startup = %Downloads%

Other Details

This Trojan does the following:

• Checks the existence of the value of the following registry keys and deletes them if they are existing:
  • HKEY_CURRENT_USER\Software\Usfile\DateInternet
  • HKEY_CURRENT_USER\Software\Usfile\DateCopy
• If C:\Users\Public\Downloads\YoruPhone does not exist:
  • Sets the value of HKEY_CURRENT_USER\Software\Usfile\ME to the bits of the malware
• Checks reg key value:
  • HKEY_CURRENT_USER\Software\Usfile\ and sets the value and data to CopyMe = 1 if it is null