Trojan.Win32.BABUK.A

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

• %User Temp%\is-{random}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %User Temp%\is-{random}.tmp\{Malware Name}.tmp
• {Specified Installation Path}\Temp\logon.bat → detected as Trojan.BAT.BABUK.YACGY
• {Specified Installation Path}\Temp\svchost.exe → detected as Ransom.Win32.BABUK.YACGY
• {Specified Installation Path}\Temp\HelpPane.exe → detected as Trojan.Win32.KILLAV.WLEBB
• {Specified Installation Path}\Temp\mhyprot2.sys → deleted afterwards

It adds the following processes:

• "%User Temp%\is-{random}.tmp\{Malware Name}.tmp" /SL5="{random},{random},{random},{Malware Path and Name}"
• %System%\cmd.exe /C "{Specified Installation Path}\Temp\logon.bat"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Information Theft

This Trojan accepts the following parameters:

• /HELP or /? - displays a window that shows a complete list of the possible arguments that can be used
• /SP - Disables the "This will install... Do you wish to continue?" prompt at the beginning of Setup
• /SILENT, /VERYSILENT - causes installation to be silent or very silent
• /SUPPRESSMSGBOXES - suppresses message boxes upon installation
• /LOG - create a log file in the user's TEMP directory
• /LOG={filename} - creates a log file using a specified file path/filename
• /NOCANCEL - prevents the user from cancelling during the installation process
• /NORESTART - prevents setup from restarting the system following a successful installation, or after a Preparing to Install failure that requests a restart
• /RESTARTEXITCODE={exit code} - specifies a custom exit code that setup is to return when the system needs to be restarted
• /CLOSEAPPLICATIONS - closes applications using files that need to be updated upon installation
• /NOCLOSEAPPLICATIONS - prevents from closing applications using files that need to be updated upon installation
• /FORCECLOSEAPPLICATIONS - force closes applications that needs to be terminated upon installation
• /FORCENOCLOSEAPPLICATIONS - prevents from force closing applications
• /LOGCLOSEAPPLICATIONS - creates extra logging when closing applications for debugging purposes
• /RESTARTAPPLICATIONS - restart applications if possible or needed
• /NORESTARTAPPLICATIONS - prevents from restarting applications
• /LOADINF={filename} - loads the settings from the specified file after having checked the command line
• /SAVEINF={filename} - save installation settings to the specified file
• /LANG={language} - specifies the internal name of the language to use
• DIR={x:\dirname} - overrides the default directory name
• /GROUP={folder name} - overrides the default folder name
• /NOICONS - initially checks the "Don't create a Start Menu folder" check box
• /TYPE={type name} - overrides the default setup type
• /COMPONENTS={comma separated list of component names} - overrides the default component settings
• /TASKS={comma separated list of task names} - specifies a list of tasks that should be initially selected
• /MERGETASKS={comma separated list of task names} - like the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been selected by default.
• /PASSWORD={password} - apecifies the password to use.

Other Details

This Trojan does the following:

• It will display a fake AVG Installer Security System Setup which lets the user choose the installation path