Trojan.PS1.PCASTLE.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %User Temp%\{Random Numbers}.bat
• %User Temp%\{Random}.log
• %User Temp%\{Random}.exe
• %User Temp%\{Random}.tmp
• %User Startup%\{Random}.exe
• %Windows%{Random}.exe
• %Application Data%\{Random}.exe
• %Application Data%\Microsoft\cred.ps1
• %Temp%\appdatad.ini

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.. %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows XP, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %Temp% is the Windows temporary folder, where it usually is C:\Windows\Temp on all Windows operating system versions.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\
RFC1156Agent

HKEY_LOCAL_MACHINE\Software\Microsoft\
RFC1156Agent\CurrentVersion

HKEY_LOCAL_MACHINE\Software\Microsoft\
RFC1156Agent\CurrentVersion\Parameters

Other Details

This Trojan connects to the following possibly malicious URL:

• http://p.{BLOCKED}h.com/upgrade.php?ver=3&mac={MAC Address}&av=&ver=6.1.7601&bit={32 or 64 BIT}
• http://{BLOCKED}.{BLOCKED}.128.144/install.exe
• http://ii.{BLOCKED}g.com/t.php?ID={Computer Name}&GUID={GUID}&MAC={MAC Address}&OS=W{OS Version}&CARD={Card Information}&_T=1553225127
• http://info.{BLOCKED}y.com/e.png?id={Computer Name}&mac={MAC Address}&OS={OS Version}&BIT={32 or 64 BIT}&IT={Date and Time of Installation}&c=1&VER=8&d=0&from=&mpass=123456&size=6966528&num=0&sa=&dig=0&mdl=0
• http://{BLOCKED}.{BLOCKED}.107.137/status.json?allv2&mac={MAC Address}&av=&ver=6.1.7601&bit=32-bit&flag2=True&domain={Domain}&user={Username}
• http://ip.{BLOCKED}2.pl/raw
• http://{BLOCKED}p.com/

It adds the following scheduled tasks:

• Name: Credentials
  Trigger: At 7:00 AM on {date of Installation} - After triggered, repeat every 1 hour indefinitely
  Action: powershell –nop –w hidden –ep bypass –f %Application Data%\Microsoft\cred.ps1
• Name: {Random Name}
  Trigger: At 7:00 AM on {date of Installation} - After triggered, repeat every 00:05:00 indefinitely
  Action: cmd.exe /c %Windows%\{Random}.exe
• Name: {Random Name}
  Trigger: At 7:00 AM on {date of Installation} - After triggered, repeat every 00:05:00 indefinitely
  Action: cmd.exe /c %Windows%\{Random}.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, and 8.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)