Trojan.PWS.Banker1.2551

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'Cleanup' = 'C:\cleanup.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Persistence ! System' = '<Full path to virus>'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\pnekaxij] 'Start' = '00000000'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<Full path to virus>' = '<Full path to virus>:*:Enabled:<Virus name>'

Creates and executes the following:

%TEMP%\gbieh.exe /nogui %TEMP%\KB2187450.txt

Executes the following:

<SYSTEM32>\netsh.exe firewall set logging droppedpackets = ENABLE
<SYSTEM32>\netsh.exe firewall set logging connections = ENABLE
<SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="Area de trabalho remota" protocol=TCP dir=in localport=3389 action=allow
<SYSTEM32>\netsh.exe firewall set notifications mode = ENABLE profile=all
<SYSTEM32>\netsh.exe firewall add portopening protocol = TCP port=443 NAME="VPN006" mode=ENABLE scope=ALL profile=ALL
<SYSTEM32>\netsh.exe firewall add portopening protocol = TCP port=22 NAME="VPN007" mode=ENABLE scope=ALL profile=ALL
<SYSTEM32>\netsh.exe firewall set opmode mode=ENABLE exceptions=enable profile=Standard
<SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN005" protocol=UDP dir=in localport=1701 action=allow
<SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN006" protocol=TCP dir=in localport=443 action=allow
<SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN007" protocol=TCP dir=in localport=22 action=allow
<SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN004" protocol=TCP dir=in localport=1723 action=allow
<SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN001" protocol=UDP dir=in localport=47 action=allow
<SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN002" protocol=UDP dir=in localport=500 action=allow
<SYSTEM32>\netsh.exe advfirewall firewall add rule NAME="VPN003" protocol=UDP dir=in localport=4500 action=allow
<SYSTEM32>\netsh.exe firewall add portopening protocol = UDP port=1701 NAME="VPN005" mode=ENABLE scope=ALL profile=ALL
<SYSTEM32>\reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Licensing Core" /v EnableConcurrentSessions /d 1 /t REG_DWORD /f
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /d 1 /t REG_SZ /f
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v EnableConcurrentSessions /d 1 /t REG_DWORD /f
<SYSTEM32>\reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fSingleSessionPerUser /d 0 /t REG_DWORD /f
<SYSTEM32>\netsh.exe firewall add allowedprogram <Full path to virus> "<Virus name>" ENABLE
<SYSTEM32>\cmd.exe /c <Current directory>\<Virus name>.bat
<SYSTEM32>\reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /d 0 /t REG_DWORD /f
<SYSTEM32>\netsh.exe firewall add portopening protocol = UDP port=500 NAME="VPN002" mode=ENABLE scope=ALL profile=ALL
<SYSTEM32>\netsh.exe firewall add portopening protocol = UDP port=4500 NAME="VPN003" mode=ENABLE scope=ALL profile=ALL
<SYSTEM32>\netsh.exe firewall add portopening protocol = TCP port=1723 NAME="VPN004" mode=ENABLE scope=ALL profile=ALL
<SYSTEM32>\netsh.exe firewall add portopening protocol = UDP port=47 NAME="VPN001" mode=ENABLE scope=ALL profile=ALL
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AllowMultipleTSSessions /d 1 /t REG_DWORD /f
<SYSTEM32>\reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v MaxInstanceCount /d 10 /t REG_DWORD /f
<SYSTEM32>\netsh.exe firewall add portopening protocol = TCP port=3389 NAME="Area de trabalho remota" mode=ENABLE scope=ALL profile=ALL

Modifies file system :

Creates the following files:

C:\zip.exe
<DRIVERS>\tqli.sys
<SYSTEM32>\jsunv.txt
%WINDIR%\pfirewall.log
C:\cleanup.exe
C:\cleanup.bat
C:\termsrv.zip
%TEMP%\KB2187450.txt
<Current directory>\<Virus name>.bat
%TEMP%\gbieh.exe
%TEMP%\gbieh.zip
C:\termsrv.dll

Sets the 'hidden' attribute to the following files:

<Full path to virus>

Deletes the following files:

%TEMP%\gbieh.zip
C:\termsrv.zip

Network activity:

Connects to:

'bc#####.#ultimarcasprint.com':80
'pr######.multimarcasprint.com':80

TCP:

HTTP GET requests:

bc#####.#ultimarcasprint.com/
pr######.multimarcasprint.com/

HTTP POST requests:

pr######.multimarcasprint.com/

UDP:

DNS ASK bc#####.#ultimarcasprint.com
DNS ASK pr######.multimarcasprint.com

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial