Virus.Win32.RAMNIT.DSO

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It infects certain file types by inserting code in the said files.

Arrival Details

This Virus arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Virus adds the following folders:

• %Program Files%\Microsoft -> if its filename is not DesktopLayer.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• {Path of injected process}\dmlconf.dat -> contains current system date and time
• {Removable Drive Letter}:\autorun.inf -> runs dropped copy
• %Program Files%\Microsoft\DesktopLayer.exe -> if its filename is not DesktopLayer.exe
• {Removable Drive Letter}:\RECYCLER\S-{Random}\{Random}.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• %Program Files%\Microsoft\DesktopLayer.exe -> if its filename is not DesktopLayer.exe
• %Program Files%\Internet Explorer\iexplore.exe -> will only inject if its filename is DesktopLayer.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• KyUffThOkYwRRtgPP

It injects codes into the following process(es):

• spawned iexplore.exe
• chrome.exe

File Infection

This Virus infects files with the following file extensions by inserting code in the said files:

• .exe
• .dll
• .htm
• .html

It avoids infecting folders containing the following strings:

• %System%
• %Windows%
• RMNetwork

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Other Details

This Virus does the following:

• Checks if HKEY_LOCAL_MACHINE\SOFTWARE\WASAntidot has "disable" registry value and terminate itself if found
• It adds .rmnet section to the infected binaries (.exe and .dll)
• It adds malicious Visual basic script to the infected scripts (.html and .htm)