Competitive Malware Analysis

URL: http://www.secureworks.com/research/threats/competitive
Date: October 19, 2004
Author: Joe Stewart

SecureWorks' research team has been researching an emerging trend in malware: the increasing tendency of new malware that destroys other malicious programs as part of its installation. No longer content to share the spoils of war, malware is now competing with each other for the lion's share of the prize. This is an analysis of a piece of malware in the Downloader.Trojan class. The executable is called loadadv50.exe. What follows is the method of infection, and a run-down of what the executable does.

Method of Infection

This piece of malware combines two methods in order to infect the host computer. The vulnerability is SimilarMethodNameRedir. This exploit allows the malicious code to be executed in the local zone. The next vulnerability is the IE Drag-N-Drop exploit. However, instead of tricking the user into dragging the image, they just need the user to click on the image. The script then pops up a new window, which has access to the startup folder of the local system. This will then cause the host to run the executable on next startup.

Details of the Executable

Once the executable starts it does a few cursory things, such as getting the command that was used to call the executable, retrieve the startup info, and obtain a handle for the Heap of the program to facilitate memory usage.

Then the program loads a list of hosts that competing malware may be trying to connect to. This list includes:

It appears to store this list for future reference.

The next step it takes is to register itself as a service process so it will be restarted on each startup.

Next the program performs a sleep, after which it gets the location of the Windows Directory. This sleep is part of a loop that the executable goes into while it checks for an Internet connection.

Once it finds that an Internet connection is available, it will begin by testing to see if it can write to the windows directory. It will attempt to write the file "test" to the Windows directory, after a successful attempt, it will continue on.

The program then crafts three URLs from the source code. It does this in quite an obfuscated manner. Instead of storing it in text in the data segment, the program builds the URL one character at a time, as seen below:

In this version of the executable the urls are:

From these URLs it retrieves at least four files, at the time of this writing. The files are seksdialer.exe, toolbar.txt, systime.txt, and dktibs.php. It renames each of these to sex.exe, toolbar.exe, systime.exe and dktibs.exe respectively and places them into the Windows directory structure. It does so using an confusing manner, keeping the function reference in a register, and then making calls to the register instead of the actual function, like as follows:

The first instruction moves the address of the InternetReadFile function into the ESI register. The code then opens a file handle for writing. After that it opens a connection to the Internet. The final instruction listed here calls the function in ESI, which is InternetReadFile.

The program seems to do only modest error checking. It checks for the initial Internet connection, and then afterwards only checks to make sure that the file seksdialer.exe was successfully obtained. If it was not obtained, it will try until it is successful.

After retrieving the files, it attempts to start running them. If it is unable to do so, it will exit the program. Since this file goes into startup, it will try again on next boot.

After this, the executable goes about removing competing executables. This list includes programs such as:

After removing these programs, it then rewrites the hosts file in the Windows directory with the hosts from above. It does the same to the /drives/etc/hosts file.

That is the run-down of the executable in a nutshell. Making a conjecture of the purpose of anti-malware parts of this code, I would assume that it removes its competitors in order to stay better hidden. It seems to target things that would give a better indicator that the host is infected, prompting the person to do a full scan of their host, and possibly finding this executable. The creator of this program did not want that to happen and so it decided not to share.

Removal Instructions

The loadadv50.exe Trojan is detectable by most leading virus scanners. To remove this Trojan, simply update the virus scanner's signatures and perform a full system scan. If detected, follow the instructions provided by the virus scanner.

*Your Name:
*Your Email:
*Their Name:
*Their Email:
Comments:

Competitive Malware Analysis

Method of Infection

Details of the Executable

Removal Instructions

Next Steps

Online Tools

Send to a Friend

Info Request

Newsletter Signup

Next Steps
	Request More Information Now
	Call Us Today 877-905-6661