Technical Details

A trojan program that carries out destructive actions on the user's computer. It is a Windows application (PE-EXE file). 56832 bytes. Packed by an unknown packer. Unpacked size – around 53 kB. Written in C++.

Installation

Depending on the launch parameters, the trojan copies its body to the following file:

%APPDATA%\netprotocol.exe

%System%\netprotocol.exe

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"Netprotocol" = "%APPDATA%\netprotocol.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Netprotocol" = "%APPDATA%\netprotocol.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Netprotocol"="%System%\netprotocol.exe"

Payload

After launching, the trojan contacts the following servers to receive commands for further action:

http://dia***sp.in
http://los***ph.com
http://kas***seuk.com
http://krex***amdx.com

On the attacker's command, the trojan may update its executable file, loading the update from the attacker's server. It may also download the file saved in the trojan's working directory as:

%WorkDir%\netprotdrvss

1. A request to notify the attacker of the successful installation of the trojan on the user's computer:

   <serverName>/nconfirm.php?rev=350&code=11m=2&num=<uniqueNum>
   

2. A request to receive a command for further action by the trojan:

   <server>/njob.php?num=<number>&rev=350

3. A request to download the file "netprotdrvss":

   <server>/nconfirm.php?rev=350&code=11m=2&num=<uniqueNum>

To carry on working, the trojan creates a configuration file which is located at the following path:

%WorkDir%\System.log

<ZORKASITE>
<BEGUNFEED>
<REKLOSOFT>
<TEASERNET>
<SUPERPOISK>
<DIRECTST>
<LIVINETCH>
<PARKING>
<UPDATE>
<DOWNRUN>
<PRIORITYHOST>
<SETSTPAGE>
<COOKREJCT>
<DESTROY>

• "Cheat" the site visit statistics - send search requests and links to resources where the rating needs to be increased from the attacker's server.
• Replace search results;
• Change the default home page and search system for the following browsers:

  Internet Explorer
  Opera
  Mozilla Firefox
  

The trojan therefore carries out the following actions:

1. it modifies the parameter values for the following system registry keys:

   [HKCU\Software\Microsoft\Internet Explorer\Main]
   "Start Page" = "http://w***olta.ru"
   
   [HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3B}]
   "DisplayName"="Webvolta"
   "URL"="http://we***lta.ru/search.php?q={searchTerms}"
   

2. it creates a file in the Windows system directory:

   %System%\operaprefs_fixed.ini

   this file contains the following strings:

   [User Prefs]
   Startup Type=2
   Home URL= http://we***lta.ru
   

3. it modifies the following file:

   %APPDATA%\Mozilla\Firefox\Profiles\<user profile directory>.default\user.js
   

   It records the following strings to the file:

   user_pref("dom.disable_window_status_change", false);
   user_pref("startup.homepage_override_url", "http://webvolta.ru");
   user_pref("browser.startup.page", 1);
   user_pref("browser.startup.homepage", "http://webvolta.ru");
   user_pref("browser.search.selectedEngine", "Webvolta");
   

4. it creates a file at the following pathway:

   %APPDATA%\Mozilla\Firefox\Profiles\<user profile directory>.default\searchplugins\webvolta.xml
   

<SearchPlugin xmlns="http://www.mozilla.org/2006/browser/search/">
<ShortName>Webvolta</ShortName>
<Description>Webvolta search.</Description>
<InputEncoding>windows-1251</InputEncoding>
<Url type="text/html" method="GET" template="http://web***ta.ru/search.php?">
<Param name="q" value="{searchTerms}"/>
</Url>
</SearchPlugin>

http://be***n.ru

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History]

[HKLM\Software\Microsoft\Netprotocol]
"UniqueNum" = "<uniqueNum>"

[HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current]
"(Default)" = ""

[HKLM\Software\Classes\MIME\Database\Content Type\application/x-javascript]
"CLSID"="{25336920-03F9-11cf-8FD0-00AA00686F13}"

[HKLM\Software\Classes\MIME\Database\Content Type\text/javascript]
"CLSID"="{25336920-03F9-11cf-8FD0-00AA00686F13}"