Trojan.DownLoader24.63346

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'CGServiSign' = '"%ProgramFiles%\Changingtec\CGServiSign\CGServiSignKeeper.exe" -keep'

Malicious functions:

Executes the following:

'<SYSTEM32>\cmd.exe' /c importCACertFirefox.bat
'%ProgramFiles%\Changingtec\CGServiSign\CGServiSignMonitor.exe'
'<SYSTEM32>\cmd.exe' /c DIR "%APPDATA%\Mozilla\Firefox\Profiles" /A:D /B
'<SYSTEM32>\cmd.exe' /c DIR "C:\Documents and Settings" /A:D /B
'<SYSTEM32>\taskkill.exe' /im CGServiSignKeeper.exe /F
'<SYSTEM32>\taskkill.exe' /im CGServiSignMonitor.exe /F
'%ProgramFiles%\Changingtec\CGServiSign\CGServiSignKeeper.exe' -keep
'<SYSTEM32>\taskkill.exe' /im CGServiSign.exe /F

Modifies file system:

Creates the following files:

%WINDIR%\FirefoxLib\certutil.exe
%WINDIR%\importCACertFirefox.bat
%WINDIR%\FirefoxLib\ServiSignCA_EC.crt
%WINDIR%\FirefoxLib\freebl3.dll
%WINDIR%\FirefoxLib\ServiSignCA_RSA.crt
%ALLUSERSPROFILE%\Start Menu\Programs\Changingtec\CGServiSign\CGServiSignStop.lnk
%ProgramFiles%\Changingtec\CGServiSign\ServiSignIPC.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Changingtec\CGServiSign\CGServiSignStart.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Changingtec\CGServiSign\CGServiSignMonitor.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Changingtec\CGServiSign\CGServiSignReStart.lnk
%WINDIR%\FirefoxLib\smime3.dll
%WINDIR%\FirefoxLib\nssutil3.dll
%WINDIR%\FirefoxLib\softokn3.dll
%WINDIR%\FirefoxLib\msvcr100.dll
%WINDIR%\FirefoxLib\sqlite3.dll
%WINDIR%\FirefoxLib\libplc4.dll
%WINDIR%\FirefoxLib\libnspr4.dll
%WINDIR%\FirefoxLib\libplds4.dll
%WINDIR%\FirefoxLib\nssdbm3.dll
%WINDIR%\FirefoxLib\nss3.dll
%ProgramFiles%\Changingtec\CGServiSign\nanomsg.dll
%ProgramFiles%\Changingtec\CGServiSign\CGServiSignWorker.exe
%ProgramFiles%\Changingtec\CGServiSign\CGServiSignMonitor.exe
%ProgramFiles%\Changingtec\CGServiSign\CGServiSignUninstall.exe
%ProgramFiles%\Changingtec\CGServiSign\libffi-6.dll
%ProgramFiles%\Changingtec\CGServiSign\iconv.dll
%WINDIR%\pthreadVC1.dll
%TEMP%\nsf2.tmp\System.dll
%ProgramFiles%\Changingtec\CGServiSign\TestPutFile
%ProgramFiles%\Changingtec\CGServiSign\CGServiSign.exe
%TEMP%\nsf2.tmp\KillProcDLL.dll
%ProgramFiles%\Changingtec\CGServiSign\libidn-11.dll
%ProgramFiles%\Changingtec\CGServiSign\libhogweed-4.dll
%ProgramFiles%\Changingtec\CGServiSign\libnettle-6.dll
%ProgramFiles%\Changingtec\CGServiSign\libwinpthread-1.dll
%ProgramFiles%\Changingtec\CGServiSign\libp11-kit-0.dll
%ProgramFiles%\Changingtec\CGServiSign\libgcrypt.dll
%ProgramFiles%\Changingtec\CGServiSign\libgcc_s_sjlj-1.dll
%ProgramFiles%\Changingtec\CGServiSign\libgmp-10.dll
%ProgramFiles%\Changingtec\CGServiSign\libgpg-error-0.dll
%ProgramFiles%\Changingtec\CGServiSign\libgnutls-30.dll

Sets the 'hidden' attribute to the following files:

%ProgramFiles%\Changingtec\CGServiSign\libnettle-6.dll
%ProgramFiles%\Changingtec\CGServiSign\libidn-11.dll
%ProgramFiles%\Changingtec\CGServiSign\libhogweed-4.dll
%ProgramFiles%\Changingtec\CGServiSign\libp11-kit-0.dll
%ProgramFiles%\Changingtec\CGServiSign\ServiSignIPC.dll
%ProgramFiles%\Changingtec\CGServiSign\nanomsg.dll
%ProgramFiles%\Changingtec\CGServiSign\libwinpthread-1.dll
%ProgramFiles%\Changingtec\CGServiSign\libgcc_s_sjlj-1.dll
%ProgramFiles%\Changingtec\CGServiSign\libffi-6.dll
%ProgramFiles%\Changingtec\CGServiSign\iconv.dll
%ProgramFiles%\Changingtec\CGServiSign\libgcrypt.dll
%ProgramFiles%\Changingtec\CGServiSign\libgpg-error-0.dll
%ProgramFiles%\Changingtec\CGServiSign\libgnutls-30.dll
%ProgramFiles%\Changingtec\CGServiSign\libgmp-10.dll

Deletes the following files:

%ProgramFiles%\Changingtec\CGServiSign\TestPutFile

Moves the following files:

from %ProgramFiles%\Changingtec\CGServiSign\CGServiSignWorker.exe to %ProgramFiles%\Changingtec\CGServiSign\ServiSignWorker.exe
from %ProgramFiles%\Changingtec\CGServiSign\CGServiSignWorker.exe to %ProgramFiles%\Changingtec\CGServiSign\CGServiSignKeeper.exe

Miscellaneous:

Adds a root certificate

Searches for the following windows: