Virus: TR/Fakealert.qma Date discovered: 06/07/2011 Type: Trojan In the wild: Yes Reported Infections: Low Distribution Potential: Low Damage Potential: Low to medium Static file: Yes File size: 327.680 Bytes MD5 checksum: C9B684BDEB0D836BDDBBEB74142EE5D6 VDF version: 7.11.10.239 - Wednesday, July 6, 2011IVDF version: 7.11.10.239 - Wednesday, July 6, 2011
General Method of propagation: • No own spreading routine Aliases: • TrendMicro: TROJ_FAKEAV.CAB • Sophos: Mal/FakeAV-MQ • Microsoft: Rogue:Win32/FakeRean Platforms / OS: • Windows 2000 • Windows XP • Windows 2003 • Windows Vista • Windows 7 Side effects: • Blocks access to security websites • Drops files • Lowers security settings • Registry modification Right after execution the following information is displayed: Files It copies itself to the following location: • %HOME%\Local Settings\Application Data\%random character string% .exe It deletes the initially executed copy of itself. The following files are created: – %TEMPDIR% \%random character string% – %ALLUSERSPROFILE%\Application Data\%random character string% – %HOME%\Local Settings\Application Data\%random character string% – %TEMPDIR% \%random character string% – %HOME%\Templates\%random character string% Registry The following registry keys are added: – [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\ FirewallPolicy\StandardProfile] • "DoNotAllowExceptions"=dword:00000000 • "EnableFirewall"=dword:00000000 • "DisableNotifications"=dword:00000001 – [HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\ FirewallPolicy\DomainProfile] • "EnableFirewall"=dword:00000000 • "DoNotAllowExceptions"=dword:00000000 • "DisableNotifications"=dword:00000001 – [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] • "ctfmon.exe"="%SYSDIR% \ctfmon.exe" – [HKCR\.exe\shell\open\command] • "(Default)"="\"%HOME%\Local Settings\Application Data\\%random character string% .exe\" -a \"%1\" %*" • "IsolatedCommand"="\"%1\" %*" – [HKCR\exefile\shell\open\command] • "(Default)"="\"%HOME%\Local Settings\Application Data\\%random character string% .exe\" -a \"%1\" %*" • "IsolatedCommand"="\"%1\" %*" – [HKCR\exefile\shell\runas\command] • "(Default)"="\"%1\" %*" • "IsolatedCommand"="\"%1\" %*" – [HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\ command] • "(Default)"="\"%HOME%\Local Settings\Application Data\\%random character string% .exe\" -a \"%PROGRAM FILES% \Intern" The following registry key is changed: – [HKLM\SOFTWARE\Microsoft\Security Center] New value: • "AntiVirusDisableNotify"=dword:00000001 • "FirewallDisableNotify"=dword:00000001 • "FirewallOverride"=dword:00000001 • "UpdatesDisableNotify"=dword:00000001 • "AntiVirusOverride"=dword:00000001 Injection – It injects itself as a remote thread into a process. Process name: • iexplore.exe Miscellaneous Accesses internet resources: • **********yziriryvi.com/%several random digits% ; **********ipemura.com/%several random digits% ; **********awekugygil.com/%several random digits% ; **********ifyzadiby.com/%several random digits% ; **********ijinymut.com/%several random digits% ; **********uwemixonav.com/%several random digits% ; **********exynogemi.com/%several random digits% ; **********elaticik.com/%several random digits% ; **********inolecowary.com/%several random digits% ; **********ofociv.com/%several random digits% ; **********ucerybaqecy.com/%several random digits% ; **********upowibi.com/%several random digits% ; **********ujykolenuja.com/%several random digits% ; **********exyhun.com/%several random digits% ; **********oralipijago.com/%several random digits% ; **********ykacagatet.com/%several random digits% ; **********ulipum.com/%several random digits% ; **********isesyf.com/%several random digits% ; **********ityvik.com/%several random digits% ; **********ejutyhyfu.com/%several random digits% ; **********usaseda.com/%several random digits% ; **********ehiqino.com/%several random digits% ; **********idicawisos.com/%several random digits% ; **********ibipaj.com/%several random digits% ; **********ixydyf.com/%several random digits% ; **********unemymyko.com/%several random digits% ; **********upinycom.com/%several random digits% ; **********ygizeq.com/%several random digits% ; **********emolezala.com/%several random digits% ; **********ecolun.com/%several random digits%
Description inserted by Andrei Ilie on Wednesday, October 12, 2011 Description updated by Andrei Ilie on Thursday, October 13, 2011
Back
.
.
.
.