TR/Proxy.Cimuz.BG.1 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Proxy.Cimuz.BG.1
Date discovered:	19/10/2005
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	39.281 Bytes
MD5 checksum:	F09B6F7DB845AF2C7B013D2E848DDDC2
VDF version:	6.32.00.43 - Mon, 26 Sep 2005 13:40 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: Trojan.Repsamo
   • Kaspersky: Trojan-Proxy.Win32.Cimuz.bg
   • TrendMicro: TROJ_REPSAMO.D
   • Bitdefender: Trojan.MZU

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Disable security applications
   • Downloads files
   • Lowers security settings
   • Registry modification

Files It copies itself to the following location:
   • %SYSDIR%\mdms.exe

It deletes the following files:
   • C:\ccccccccccccccccoemrciermicomeriocmeiormcioermo
   • C:\cc5y456 455 4 54cccccccoemrciermicomeriocmeiormcioermo
   • C:\zzzzzzzzzzzzzzzzzzzzzzz222

It may corrupt the following files:
   • %PROGRAM FILES%\McAfee.com\Personal Firewall\MpfUi.Dll"
   • %PROGRAM FILES%\Kaspersky Lab\Kaspersky Anti-Hacker\perfiloc.dll"
   • %PROGRAM FILES%\Tiny Firewall Pro\SnortImp.dll"
   • %PROGRAM FILES%\McAfee.com\Personal Firewall\Localized.DLL"
   • %PROGRAM FILES%\Agnitum\Outpost Firewall\Engine.dll"
   • %PROGRAM FILES%\Norton Internet Security Professional\FRERules.dll"
   • %PROGRAM FILES%\Kerio\Personal Firewall 4\kfe.dll"
   • %PROGRAM FILES%\Zone Labs\ZoneAlarm\vsruledb.dll"

The following file is created:

– %SYSDIR%\winacpi.dll Used to hide the process from Task Manager. Detected as: TR/Drop.Agen.bd.A.1

– The locations are the following:
   • http://ozonung.biz/**********/?%random character string%
   • http://votreenton.biz/**********/?%random character string%
   • http://troonety.biz/**********/?%random character string%
   • http://breenten.biz/**********/?%random character string%
   • http://zurrusco.com/**********/?%random character string%
   • http://freelife4ever.com/**********/?%random character string%
   • http://213.21.215.186/**********/?%random character string%
It is saved on the local hard drive under: %unknown% This file may contain further download locations and might serve as source for new threats.

Registry The following registry key is continuously in an infinite loop added in order to run the process after reboot.

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "SysMemory manager"="%SYSDIR%\mdms.exe"

It creates the following entry in order to bypass the Windows XP firewall:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile\AuthorizedApplications\List]
   • "%SYSDIR%\mdms.exe"="%SYSDIR%\mdms.exe:*:Enabled:mdm_sysag"

The following registry keys are added:

– [HKCR\*\shellex\ContextMenuHandlers\sysacpildap]
   • @="{5E2121EE-0300-11D4-8D3B-444553540000}"

– [HKCU\Software\mzs]
– [HKCU\Software\mzs\mdms]
– [HKCU\Software\mzs\mdms\mzu]
   • "cid"=%hex number%
   • "newhost"=dword:00000001
   • "pt"=dword:%hex number%
   • "fc"=dword:%hex number%
   • "fu"="http://213.21.215.**********/zubox429/gotcha.php"
   • "fa"=dword:00000001

– [HKCR\acpi.acpi.1]
   • @="acpi Class"

– [HKCR\acpi.acpi.1\CLSID]
   • @="{5E2121EE-0300-11D4-8D3B-444553540000}"

– [HKCR\acpi.ext]
   • @="acpi Class"

– [HKCR\acpi.ext\CLSID]
   • @="{5E2121EE-0300-11D4-8D3B-444553540000}"

– [HKCR\acpi.ext\CurVer]
   • @="acpi.acpi.1"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}]
   • @="acpi"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\InprocServer32]
   • @="%SYSDIR%\winacpi.dll"
   • "ThreadingModel"="Apartment"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\ProgID]
   • @="acpi.1"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\Programmable]
– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\TypeLib]
   • @="{5E2121E1-0300-11D4-8D3B-444553540000}"

– [HKCR\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}\
   VersionIndependentProgID]
   • @="acpi"

– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}]
– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0]
   • @="SimpleExt 1.0 Type Library"

– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0\0]
– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0\0\win32]
   • @="%SYSDIR%\winacpi.dll"

– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0\FLAGS]
   • @="0"

– [HKCR\TypeLib\{5E2121E1-0300-11D4-8D3B-444553540000}\1.0\HELPDIR]
   • @="%SYSDIR%\"

– [HKCR\Interface\{5E2121ED-0300-11D4-8D3B-444553540000}]
   • @="ISimpleShlExt"

– [HKCR\Interface\{5E2121ED-0300-11D4-8D3B-444553540000}\
   ProxyStubClsid]
   • @="{00020424-0000-0000-C000-000000000046}"
   •

– [HKCR\Interface\{5E2121ED-0300-11D4-8D3B-444553540000}\
   ProxyStubClsid32]
   • @="{00020424-0000-0000-C000-000000000046}"

– [HKCR\Interface\{5E2121ED-0300-11D4-8D3B-444553540000}\TypeLib]
   • @="{5E2121E1-0300-11D4-8D3B-444553540000}"
   • "Version"="1.0"

Process termination List of processes that are terminated:
   • ehmas.exe; gcasServ.exe; gcasDtServ.exe; kpf4gui.exe; NPROTECT.EXE;
      MpfService.exe; outpost.exe; ZAPRO.EXE; amon.exe; kpf4ss.exe;
      firewall.exe; zonealarm.exe

Rootkit Technology It is a malware-specific technology. The malware hides its presence from system utilities, security applications and in the end, from the user.

Hides the following:
– Its own process

File details Programming language:
The malware program was written in Borland C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• FSG

See a brief description here.

Description inserted by Andrei Gherman on Mon, 24 Oct 2005 09:43 (GMT+1)
Description updated by Andrei Gherman on Fri, 28 Oct 2005 16:00 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back