TROJ_ZLOB.ALH

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %System Root%\DOCUME~1
• %System Root%\DOCUME~1\ADMINI~1
• %User Profile%\LOCALS~1
• %User Temp%\nsg3.tmp
• %Program Files%\GimMePorn
• %System Root%\Documents and Settings\Administrator
• %Start Menu%\Programs\GimMePorn

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.)

Other System Modifications

This Trojan deletes the following files:

• %User Temp%\nsg1.tmp
• %User Temp%\nsg3.tmp
• %User Temp%\tmp5.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_CURRENT_USER\Software\GimMePorn

HKEY_CLASSES_ROOT\GimMePorn\CLSID

HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\Uninstall\
GimMePorn

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GimMePorn
UninstallString = "%Program Files%\GimMePorn\Uninstall.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GimMePorn
InstallLocation = "%Program Files%\GimMePorn"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GimMePorn
DisplayName = "GimMePorn"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Uninstall\
GimMePorn
DisplayIcon = "%Program Files%\GimMePorn\Uninstall.exe,0"

HKEY_CURRENT_USER\Software\GimMePorn
Start Menu Folder = "GimMePorn"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Tcpip\Parameters\
Interfaces\{0D50FF2A-9D59-41C1-A9AC-EB2C659D36FE}
NameServer = "85.255.116.86,85.255.112.82"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Tcpip\Parameters\
Interfaces\{0D50FF2A-9D59-41C1-A9AC-EB2C659D36FE}
DhcpNameServer = "85.255.116.86,85.255.112.82"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Tcpip\Parameters\
Interfaces\{6D128ACA-CE90-4D8D-B04F-CD01DBA59CE2}
NameServer = "85.255.116.86,85.255.112.82"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Tcpip\Parameters\
Interfaces\{6D128ACA-CE90-4D8D-B04F-CD01DBA59CE2}
DhcpNameServer = "85.255.116.86,85.255.112.82"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
kdrtx.exe = "{random values}"

It modifies the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Tcpip\Parameters
DhcpNameServer = "85.255.116.86 85.255.112.82"

(Note: The default value data of the said registry entry is 192.168.239.2.)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Services\Tcpip\Parameters
NameServer = "85.255.116.86 85.255.112.82"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
System = "kdrtx.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
ProxyEnable = "0"

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\
Hardware Profiles\0001\Software\
Microsoft\windows\CurrentVersion\
Internet Settings
ProxyEnable = "0"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Connections
SavedLegacySettings = "{random values}"

(Note: The default value data of the said registry entry is {random values}.)

Dropping Routine

This Trojan drops the following files:

• %User Temp%\nsg2.tmp
• %User Temp%\notepad.exe.dat
• %User Temp%\calc.exe.dat
• %User Temp%\vidxcore.dll
• %User Temp%\freebsd.exe.dat
• %User Temp%\linux
• %User Temp%\nsg3.tmp\DcryptDll.dll
• %User Temp%\notepad.exe
• %User Temp%\calc.exe
• %User Temp%\freebsd.exe
• %User Temp%\nsg3.tmp\modern-header.bmp
• %Program Files%\GimMePorn\Uninstall.exe
• %Start Menu%\Programs\GimMePorn\Uninstall.lnk
• %User Temp%\nsg3.tmp\StartMenu.dll
• %User Temp%\tmp4.tmp
• %System%\kdrtx.exe
• %User Temp%\tmp5.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Program Files% is the default Program Files folder, usually C:\Program Files.. %Start Menu% is the current user's Start Menu folder, which is usually C:\Windows\Profiles\{user name}\Start Menu on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu on Windows NT and C:\Windows\Start Menu or C:\Documents and Settings\{User name}\Start Menu on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}175.24/gather.php

This report is generated via an automated analysis system.