Home / malware

PDF

Trojan.Inject.WX

First posted on 21 November 2011.
Source: BitDefender

Aliases :

Trojan.Inject.WX is also known as Trojan.Win32.Buzus.dfer;, Trojan.Siggen.64270.

Explanation :

When executed the malware verifies if it is being debugged and searches the list of running processes for different tools that can unmask his presence/behavior (like Process Monitor, Vbox.exe, VMWareService.exe, etc). If the malware finds such a process it will display the message box below and then it will exit.



If debugging or monitoring tools were not found, it will continue its execution by making a copy of itself inside %windir%system32wcoredg.exe (hidden) and then it will delete the original file. Next it will run the copied file as a hidden process and it will inject foreign code into the memory space of the explorer.exe process .

* In order to avoid detection:
- it will disable services associated to various firewall and anti-virus products(like KPF4, SophosClientFirewall, Nod32krn,etc) if they are present;
- it will add itself in the Windows Firewall's exceptions list under the name "LAN Router";
- it will try to end the following processes(if found):
WITSETUP.EXE
AVINSTALL.EXE
K7TS_SETUP.EXE
P08PROMO.EXE
ISSDM_EN_32.EXE
VIPRE.EXE
UNLOCKER.EXE
UNLOCKERASSISTANT.EXE
UNLOCKER1.8.7.EXE
REGUNLOCKER.EXE
COMPAQ_PROPIETARIO.EXE
ATF-CLEANER.EXE
SAFEBOOTKEYREPAIR.EXE
OTMOVEIT3.EXE
HOSTSXPERT.EXE
DAFT.EXE
VIRUS.EXE
HIJACK-THIS.EXE
MRT.EXE
MRTSTUB.EXE
WINDOWS-KB890930-V2.2.EXE
HJ.EXE
ELISTA.EXE
PENCLEAN.EXE
MBAM-SETUP.EXE
MBAM.EXE
AVZ.EXE
JAJA.EXE
OTMOVEIT.EXE
MBAM-SETUP.EXE
REGMON.EXE
COMBO-FIX.EXE
COMBOFIX.BAT
COMBOFIX.SCR
COMBOFIX.COM
NTVDM.EXE
GUARD.EXE
LISTO.EXE
TCPVIEW.EXE
REGEDIT.COM
REGEDIT.SCR
FOLDERCURE.EXE
KILLAUTOPLUS.EXE
MYPHOTOKILLER.EXE
REG.EXE
TASKKILL.EXE
AUTORUNS.EXE
SRENGPS.EXE
COMBOFIX.EXE
SDFIX.EXE
CATCHME.EXE
GMER.EXE
MBR.EXE
CF9409.EXE
REGUNLOCKER.EXETSNTEVAL.EXE
XP_TASKMGRENAB.EXE
SUPERANTISPYWARE.EXE
BOOTSAFE.EXE
SRESTORE.EXE
MSNCLEANER.EXE
BUSCAREG.EXE
KAKASETUPV6.EXE
SUPERKILLER.EXE
DUBATOOL_AV_KILLER.EXE
DELAYDELFILE.EXE
SEEM.EXE
BC5CA6A.EXE
ROOTALYZER.EXE
ROOTKITBUSTER.EXE
HELIOS.EXE
DARKSPY105.EXE
HOOKANLZ.EXE
PAVARK.EXE
SRENGLDR.EXE
APORTS.EXE
FPORT.EXE
PORTDETECTIVE.EXE
PORTMONITOR.EXE
NETSTAT.EXE
OLLYDBG.EXE
HJTINSTALL.EXE
HJTSETUP.EXE
HIJACKTHIS_SFX.EXE
HIJACKTHIS.EXE
HIJACKTHIS_V2.EXE
MSNFIX.EXE
PROCEXP.EXE
TASKMAN.EXE
TASKLIST.EXE
TASKMON.EXE
PSKILL.EXE
ROOTKITREVEALER.EXE
FSBL.EXE
FSB.EXE
AVGARKT.EXE
ROOTKIT_DETECTIVE.EXE
UNHACKME.EXE
HACKMON.EXE
RKD.EXE
ROOTKITNO.EXE
REANIMATOR.EXE
HOOKANLZ.EXE
ROOTREPEAL.EXE
ICESWORD.EXE
LORDPE.EXE
PG2.EXE
PROCDUMP.EXE
PROCESSMONITOR.EXE
SPYBOTSD160.EXE
TEATIMER.EXE
SPYBOTSD.EXE
WIRESHARK.EXE
APM.EXE
APT.EXE
ASVIEWER.EXE
CPORTS.EXE
CPROCESS.EXE
DLLCOMPARE.EXE
A2HIJACKFREESETUP.EXE
EULALYZERSETUP.EXE
FILEALYZ.EXE
FILEFIND.EXE
FIXPATH.EXE
HOSTSFILEREADER.EXE
IEFIX.EXE
AVENGER.EXE
INSTALLWATCHPRO25.EXE
KILLBOX.EXE
NETALYZ.EXE
OBJMONSETUP.EXE
PGSETUP.EXE
FIXBAGLE.EXE
CUREIT.EXE
PROCMON.EXE
PROJECTWHOISINSTALLER.EXE
REGALYZ.EXE
REGCOOL.EXE
REGISTRAR_LITE.EXE
REGSCANNER.EXE
REGSHOT.EXE
REGX2.EXE
SPF.EXE
SRENGLDR.EXE
STARTDRECK.EXE
SYSANALYZER_SETUP.EXE
UNIEXTRACT.EXE
UNLOCKER1.8.7.EXE
RAVP.EXE
MBAM.EXE
USBGUARD.EXE
AVZ.EXE
OTL.EXE
CPF.EXE
ZLCLIENT.EXE

- If it finds but cannot kill a process from the above list the computer will be shutdown.

* It modifies the following registry values:
-for automatic execution at windows start-up:
HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunconime.exe (clean file)
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsconime.exeDebugger = wcoredg.exe

-for disabling SystemRestore:
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionSystemRestoreDisableSR = 1

-for hiding antivirus and firewall security related warnings:
HKLMSOFTWAREMicrosoftSecurity CenterFirewallDisableNotify = 1
HKLMSOFTWAREMicrosoftSecurity CenterAntiVirusDisableNotify = 1

* It modifies the hosts file in order to redirect various anti-malware sites to the address 203.151.73.99:

* Spreading capabilities:
-USB drives: it has the capability to infect USB drives by using the autorun.inf technique.
-Network: through network shares and IM (Microsoft Messenger);
It can download newer versions of itself from the following URL:

http://secure.u[removed]24.org.uk/net/debug.zip

This malware has also backdoor capabilities.It contains an IrcBot which allows a remote attacker to connect to the affected computer and to run various remote commands.

Last update 21 November 2011

 

TOP