SHA1 42f1bd3653cb134685307eb9a83766f05efb4442
A Trojan designed to install affiliate software on the system and employed by some developers of free applications to generate income. The program is written in Delphi and is not packed. Trojan.RoboInstall.1 is built using RAD Studio XE3, contains two libraries for interaction with OpenSSL, and is distributed though file-sharing resources created by cybercriminals.
Once launched, the Trojan checks integrity of configuration data stored in the overlay. If the file with configuration data is damaged or missing, the Trojan terminates its work displaying an appropriate message:
If the Trojan is launched successfully, it sends the command and control server, whose address is retrieved from the configuration file, POST requests without specifying their types. All information forwarded to the server is compressed with ZLIB and consists of two following parts: signature and data in JSON format (JavaScript Object Notation) implemented as a serialized Delphi object.
The reply that comes from the server is also compressed with ZLIB and contains data in JSON format. The data includes information about downloadable executables and settings on display of installation check boxes. In some cases, such check boxes are missing, and files downloaded by the Trojan get installed without any additional conditions.