Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\tmb] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\tmb] 'ImagePath' = '"%WINDIR%\libevent\saps.exe" --nt-service "-f" "%WINDIR%\libevent\trp.efx"'
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im saps.exe
Modifies file system:
Creates the following files:
- <Current directory>\TRDP.bat
- C:\Documents and Settings\LocalService\Application Data\tor\state.tmp
- %WINDIR%\libevent\zlib1.dll
- %WINDIR%\libevent\trp.efx
- %WINDIR%\libevent\ssleay32.dll
- %WINDIR%\libevent\saps.exe
- %WINDIR%\libevent\libssp-0.dll
- %WINDIR%\libevent\libgcc_s_sjlj-1.dll
- %WINDIR%\libevent\libevent_extra-2-0-5.dll
- %WINDIR%\libevent\libevent_core-2-0-5.dll
- %WINDIR%\libevent\libevent-2-0-5.dll
- %WINDIR%\Debug\WIA\private_key.tmp
- %WINDIR%\libevent\libeay32.dll
- <Current directory>\event\zlib1.dll
- <Current directory>\event\ssleay32.dll
- <Current directory>\event\libssp-0.dll
- <Current directory>\event\libgcc_s_sjlj-1.dll
- <Current directory>\event\libevent_extra-2-0-5.dll
- <Current directory>\event\libevent_core-2-0-5.dll
- <Current directory>\event\libevent-2-0-5.dll
- <Current directory>\event\libeay32.dll
- <Current directory>\sfxd.exe
- <Current directory>\event\saps.exe
- <Current directory>\event\trp.efx
- %WINDIR%\Debug\WIA\hostname.tmp
Deletes the following files:
- C:\Documents and Settings\LocalService\Application Data\tor\state
Moves the following files:
- from C:\Documents and Settings\LocalService\Application Data\tor\state.tmp to C:\Documents and Settings\LocalService\Application Data\tor\state
- from %WINDIR%\Debug\WIA\private_key.tmp to %WINDIR%\Debug\WIA\private_key
- from %WINDIR%\Debug\WIA\hostname.tmp to %WINDIR%\Debug\WIA\hostname
Substitutes the following files:
- C:\Documents and Settings\LocalService\Application Data\tor\state.tmp
- C:\Documents and Settings\LocalService\Application Data\tor\state
Network activity:
Connects to:
- 'localhost':1038
- 'localhost':1040
- '16#.#72.157.213':443
- '21#.#39.217.18':1337
- '18#.#0.128.246':9001
- '37.##7.102.186':9001
- '19#.#09.206.212':443
- '17#.#3.183.251':443
- '20#.#3.164.118':443
- '14#.#85.177.103':9030
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%WINDIR%\libevent\saps.exe' --service install -options -f "%WINDIR%\libevent\trp.efx"
- '%WINDIR%\libevent\saps.exe' --nt-service "-f" "%WINDIR%\libevent\trp.efx"
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""<Current directory>\TRDP.bat" "
- '<SYSTEM32>\sc.exe' config tmb obj= localSystem
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\CurrentControlSet\Services\tmb" /v "ObjectName" /t REG_SZ /d "LocalSystem" /f
- '<SYSTEM32>\net.exe' start tmb
- '<SYSTEM32>\net1.exe' start tmb
