マイライブラリ
マイライブラリ

+ マイライブラリに追加

電話

お問い合わせ履歴

電話(英語)

+7 (495) 789-45-86

Profile

Trojan.Kasidet.1

Added to the Dr.Web virus database: 2016-07-26

Virus description added:

Trojan.Kasidet.1

SHA1:

  • 79b863bd3148c84229e81d6c5aed65390a2cba18 rar_sfx.scr
  • e37f808d6147022f0ee79c34f80697af86ab571e entroentry.exe
  • a673eec895f7009873c400247d056c325935be76 entroentry.unp
  • a9e2c692887ad9732d566e6818e32a6a7466d593 payload

A Trojan for POS terminals. It is a modification of Trojan.MWZLesson.

The Trojan is distributed as a ZIP archive that contains a SCR file, which is a self-extracting SFX-RAR archive. This file then extracts, runs entroentry.exe, a malicious application, and saves an empty file named indexoid.txt.

Once launched, the Trojan checks the system for its copy and tries to detect one of the following running processes:

  • prl_cc.exe
  • prl_tools.exe
  • vmwaretray.exe
  • vmwareuser.exe
  • vboxservice.exe
  • vboxtray.exe
  • vmsrvc.exe
  • vmusrvc.exe

The Trojan attempts to find the following modules in its process:

  • api_log.dll
  • dir_watch.dll
  • pstorec.dll
  • vmcheck.dll
  • wpespy.dll
  • sbiedll.dll

In addition, the Trojan determines whether a debugger or virtual machines are present on the system. If it finds a program that can somehow hinder the Trojan’s operation, Trojan.Kasidet.1 executes the following command in CMD:

ping 127.0.0.1 -n 3 & del “<full path to the Trojan>"

And then it terminates and deletes itself from the system.

To start its malicious activity, it is run with administrator privileges executing the following command for wmic.exe:

process call create < full path to the Trojan >

Even though the User Accounts Control (UAC) system demonstrates a warning on the screen, the victim is put off their guard because the running application (wmic.exe) is allegedly developed by Microsoft:

screen Trojan.Kasidet.1 #drweb

Then wmic.exe runs the Trojan’s executable file.

In Microsoft Windows 8, the Trojan disables SmartScreen and modifies the system registry branch:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"SmartScreenEnabled"="Off"

Then it deletes the following value:

HKLM\SOFTWARE\Policies\Microsoft\Windows\System, EnableSmartScreen

The Trojan modifies the Windows registry to ensure running of its copy.

Like Trojan.MWZLesson, this Trojan executes the following functions:

  • Checks the infected computer's RAM for bank card data and sends all acquired bank card data to the command and control server.
  • Steals passwords for Outlook, Foxmail, and Thunderbird email applications.
  • Incorporates itself into Mozilla Firefox, Google Chrome, Microsoft Internet Explorer, and Maxthon browsers in order to intercept GET and POST requests.
  • Upon a command, searches for a particular file on disks—if the file is found, it is sent to the server.
  • Updates itself by downloading an executable file from the specified URL. Then the Trojan saves the file to its folder under a random name and runs it. If launched successfully, it removes data, necessary for its autorun, from the registry and tries to delete the original file.
  • Saves and removes parameters specified in the system registry.
  • Downloads and runs an executable file or a dynamic library that is then loaded to the memory with the help of the regsvr32 /s <file name> command.
  • Executes specified commands in CMD.

Unlike Trojan.MWZLesson, C&C server addresses of Trojan.Kasidet.1 are placed in a decentralized domain zone—.bit (Namecoin). It is a system of alternative root DNS servers, which is based on the Bitcoin technology.

News about the Trojan

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android