When the Trojan is executed, it copies itself as the following file:
%Windir%\AppPatch\[RANDOM FILE NAME]
Note: [RANDOM FILE NAME] may be one of the following file names and file extensions:
- ijntbx.exe
- oupcckm.exe
- smnoft.dat
- hagveo.dat
- fvvkpp.dat
- sgacpck.dat
- nobiya.exe
- fmuqwvc.dat
- tpfirc.exe
- sjnaaws.exe
It then modifies the following registry entry so that it runs every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"Userinit" =
"%System%\userinit.exe, %Windir%\AppPatch\[RANDOM FILE NAME]"
It also creates the following registry entry so that it runs every time Windows starts:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\"[RANDOM NUMBERS]" = "%Windir%\AppPatch\[RANDOM FILE NAME]"
It then creates the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\[RANDOM NUMBERS]
Note: [RANDOM NUMBERS] may be one of the following sets of numbers:
Next, the threat checks for various processes, including the following:
- ollydbg
- wireshark
- idaq
- dumpcap
- vmwaretray
It also checks for files, user names, or paths related to virtual machines or test environments.
The threat will block connections to URLs containing the following strings:
- avast.com
- kaspersky
- drweb
- eset.com
- antivir
- avira
- virustotal
- virusinfo
- z-oleg.com
- kltest.org.ru
- trendsecure
- anti-malware
- comodo.com
The Trojan then searches for system processes to inject it's malicious payload into. Once it has injected the payload into the system process, it will inject all processes on the compromised computer in order to find passwords and cryptographic certificates.
It attempts to steal information related to the following services:
- Inist Co
- IBANK
- InterBank
- Marfin Laiki Bank
- Qiwi.ru
- Yota
It gathers the information by reading the memory of the processes, accessing the clipboard, and using keylogging applications. It also steals cryptographic credentials from the user.
The Trojan then contacts the following domain to receive commands:
[http://]vopycoc.com
The commands allow the Trojan to create new files and processes on the compromised computer and/or to inject malicious payloads into processes.
Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":
