Trojan.InstallMonster.1094

Added to the Dr.Web virus database: 2014-12-13

Virus description added: 2014-12-13

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\services\sppsvc] 'Start' = '00000002'

Malicious functions:

Executes the following:

'<SYSTEM32>\slui.exe' -Embedding
'<SYSTEM32>\sppsvc.exe'
'<SYSTEM32>\Wat\WatAdminSvc.exe' /run
'<SYSTEM32>\Wat\WatAdminSvc.exe'

Modifies file system :

Creates the following files:

<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\bullet[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\background_gradient[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\bullet[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\info_48[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\bullet[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\info_48[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\background_gradient[1]
%WINDIR%\Temp\tmp7722.tmp
%WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\CabA765.tmp
%WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\CabA7F4.tmp
\Device\Mup\BVNSEUHJ*\MAILSLOT\NET\NETLOGON
%WINDIR%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C24EC5BDAF13613245B4CECC3DE91DC6
%WINDIR%\ServiceProfiles\LocalService\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C24EC5BDAF13613245B4CECC3DE91DC6
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\navcancl[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\navcancl[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\ErrorPageTemplate[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\search[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\search[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\UEWNTWLX\search[2]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\errorPageStrings[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\errorPageStrings[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\httpErrorPagesScripts[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\info_48[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\23BUYPX5\ErrorPageTemplate[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\3U23MFC9\errorPageStrings[1]
<LS_APPDATA>\Microsoft\Windows\Temporary Internet Files\Content.IE5\YIF7DGLM\httpErrorPagesScripts[1]

Deletes the following files:

%WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\CabA7F4.tmp
%WINDIR%\ServiceProfiles\NetworkService\AppData\Local\Temp\CabA765.tmp
%WINDIR%\Temp\tmp7722.tmp

Network activity:

Connects to:

'ct###.#indowsupdate.com':80
'20#.#6.232.182':80
'www.bing.com':80
'm1#####x7na.seojee.com':80
'12#.#25.114.144':80

TCP:

HTTP GET requests:

20#.#6.232.182/pki/crl/products/microsoftrootcert.crl
ct###.#indowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?30##############
www.bing.com/search?q=###################################
ct###.#indowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c2##############
20#.#6.232.182/fwlink/?Li###########
20#.#6.232.182/pki/crl/products/WinPCA.crl
www.bing.com/search?q=#####################################################################################################################################################################################################
m1#####x7na.seojee.com/new/one.txt
m1#####x7na.seojee.com/new/dxc.txt
m1#####x7na.seojee.com/new/info.txt
www.bing.com/search?q=###############################################################################################################################################################
12#.#25.114.144/special/time/
m1#####x7na.seojee.com/new/ip.asp

UDP:

DNS ASK crl.microsoft.com
DNS ASK www.microsoft.com
DNS ASK go.###rosoft.com
DNS ASK ct###.#indowsupdate.com
DNS ASK m1#####x7na.seojee.com
DNS ASK op##.baidu.com
DNS ASK www.bing.com

Miscellaneous:

Searches for the following windows:

ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial