: [RemovableDrive]\autorun.inf
And the Trojan drops an autorun.inf file into the root of all removable drives and mapped drives in an attempt to autorun an executable when the drive is accessed.
The file "AutoRun.inf" is pointing to the malware binary executable, when the removable or networked drive is accessed from a machine supporting the Autorun feature, the malware is launched automatically.
The autorun.inf is configured to launch the Trojan file via the following shell commands.
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
[autorun]
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
open=G:\hYDguxl\hYDguxl.exe
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
icon=%SystemRoot%\system32\SHELL32.dll,7
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
UseAutoPlay=1
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
shell\Explore\Command=G:\hYDguxl\hYDguxl.exe
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
shell\open\command=G:\hYDguxl\hYDguxl.exe
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
XAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOyXAÇ6EXë<1+M&}VàpÏ8C:Mx+ºÿ,3Ç7ÇV7ÿ[!Q]k!e×+º&UqI!XM7óYY}p^&zîkZ].}©}e+2^HñH0aÿQm}mãPOy
The following registry values have been added to the system.
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Lqgalabfiybgjcdw.exe"%Appdata%Lqgalabfiybgjcdw.exe"
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lqgalabfiybgjcdw.exe
- "%Appdata%Lqgalabfiybgjcdw.exe"
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Windows Manager
- %Appdata%con64.exe
The above mentioned registry ensures that the Trojan registers run entry with the compromised system and execute itself upon every reboot.
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable :0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass:1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable:0
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings\ProxyEnable:0
The above registry entries confirm that the Trojan tries to disable the proxy settings.
Below are the commands used by the remote attacker in order to collect system information from the compromised machine.
- GetSystemInfo
- GetNativeSystemInfo
-----------------------------------------------------------------------------------------------------------------------------------------------------