Trojan.Win32.SMOKELOADER.BF

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It injects its dropped file/component to specific processes.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any proxy server routine.

It terminates itself if it detects it is being run in a virtual environment. It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\xFFgPbPjc.exe
• %Application Data%\{random name generated from system information} -> copy of embedded file in the original malware sample

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %Application Data%\{random name generated from system information} -> downloaded component
• %User Temp%\tmp{Random characters}.tmp -> XML file of scheduled task
• %User Temp%\44DA.tmp -> copy of ntdll.dll

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• hEEGiYfYVPKLqPCGdBwOGnewhnI
• {Random hash from system information}

It injects its dropped file/component to the following processes:

• explorer.exe

It injects codes into the following process(es):

• explorer.exe

It terminates itself if it finds the following processes in the affected system's memory:

• qemu-ga.exe
• qga.exe
• windanr.exe
• vboxservice.exe
• vboxtray.exe
• vmtoolsd.exe
• prl_tools.exe

Other System Modifications

This Trojan deletes the following files:

• %Application Data%\{dropped copy with random name}:Zone.Identifier

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• OllyDbg.exe
• ProcessHacker.exe
• procmon.exe
• procexp.exe
• wireshark.exe
• autoruns.exe
• idaq.exe
• tcpview.exe

Proxy Server Routine

This Trojan does not have any proxy server routine.

Information Theft

This Trojan gathers the following data:

• Computer Name
• System Volume Information
• Internet Explorer version
• User Agent String
• User Name

Stolen Information

This Trojan sends the gathered information via HTTP POST to the following URL:

• http://{BLOCKED}sky.net/

Other Details

This Trojan terminates itself if it detects it is being run in a virtual environment.

It deletes itself after execution.

It checks if the following virtual machine- or sandbox-related registry keys are present in the affected system:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Enum\IDE

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Enum\SCSI

It checks if the following virtual machine or sandbox related folder(s) or file(s) is present in the affected system:

• Checks filenames in the %System% and %System%\drivers directories for filenames with the following substrings and terminates itself if found:
  • vmci.s
  • vmusbm
  • vmmous
  • vm3dmp
  • vmrawd
  • vmmemcc
  • vboxgu
  • vboxsf
  • vboxmo
  • vboxvi
  • vboxdi
  • vioser

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It does not proceed to its malicious routine if it detects that it is being debugged.

It adds the following scheduled tasks:

• Task Name: NvNgxUpdateCheckDaily_{{random values}-{random values}-{random values}-{random values}-{random values}}
• Trigger 1: At User Logon
• Trigger 2: Every 10 minutes starting from 11/30/1999 12:00 AM
• Action: Start program "%Application Data%\{dropped copy with random name}:
• Task Name: Updates\xFFgPbPjc
• Trigger and Actions: Specified in XML file "%User Temp%\tmp{Random characters}.tmp"

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)