About:
Troj/Agent-RNY is a Trojan for the Windows platform.
We are currently seeing cybercriminals spamming out the Trojan in large numbers right now, using a variety of sleazy subject lines advertising "sexy cities," among others, to trick the unwary into opening the attachment.
This particular piece of malware has multiple components, including a downloader. The sample attempts to download further files from:
211 . 154 . 153 . 49 : 80 - Blocked as Malware/Repository
And attempts to make a GET request from:
http://net . com/2/1.php?q=2 - Blocked as Malware/Repository
http://net . com/2/1.php?q=1 - Blocked as Malware/Repository
The sample will attempt to drop these files (including a copy of itself) to "%userprofile%\Application Data\"
To make sure the sample can establish a link to its Call Home Address (CHA), Troj/Agent-RNY will add an exception for itself in the Windows Firewall, by modifying the registry entry:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List:*:Enabled:ldrsoft
The sample creates the following directory:
"%userprofile%\Application Data\<Random letters and numbers>\"
It then drops the following file to this directory:
"%userprofile%\Application Data\<Random letters and numbers>\svcnost.exe"
(Notice the "svcNost.exe," instead of "svchost.exe.")
The sample crates the following registry run key for its dropped files:
entry_location = "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
entry = "mssend"
description = "Java(TM) Platform SE binary"
publisher = "Sun Microsystems, Inc."
image = "c:\documents and settings\support\application data\xf3bmwvelhz2wushramwvaxyucokodgv2\svcnost.exe"
launch_string = """C:\Documents and Settings\support\Application Data\xf3bmwvelhz2wushramwvaxyucokodgv2\svcnost.exe"""
The sample has also been seen dropping the following files:
%userprofile%\application data\<4-7random chars="">\<4-6random chars="">.exe
%userprofile%\application data\<4-7random chars="">\<4-6random chars="">.tmp
%userprofile%\application data\<4-7random chars="">\<4-6random chars="">.ozr
%userprofile%\application data\<4-7random chars="">\<4-6random chars="">.tmp
%userprofile%\application data\<4-7random chars="">\<4-6random chars="">.gie
%userprofile%\application data\<4-7random chars="">\<4-6random chars="">.gie.0
Interestingly, this malware seems to open "%userprofile%\application data\Desktop.ini" for writing and injects dll code into it. This dll appears to be BTREE.dll and contains a series of exports for creating and verifying SSL certsa and also connecting with and disconnecting from an SSL pipe.