Trojan:Win32/Hideproc.G

Trojan:Win32/Hideproc.G is a trojan that steals information about the computer it is currently installed in. Information it steals includes keystrokes, desktop screenshots, user credentials, and currently running processes.

Installation

Trojan:Win32/Hideproc.G may be executed in the following format:

<malware>.exe xxx /<parameters>

where <parameters> include the following:

• delme - deletes file
• v - maps components to target processes during installation
• quit - terminates the file process
• restart - restarts the file process

Trojan:Win32/Hideproc.G contains an embedded JPG file, which contains two encrypted component files: a DLL component that steals information, and an EXE component that injects the DLL code into certain processes.

Payload

Steals information

Trojan:Win32/Hideproc.G creates duplicate instances of any of the following processes, and injects its information-stealing DLL component into these processes:

• lsass.exe
• winlogon.exe
• svchost.exe

It collects the following information, which it then saves into a file named "%Temp%\~DC<random characters>.tmp" (for example, "~DQC8.tmp":

• Network resources (such as share drives, network connections, IPv4 routing table)
• User network credentials
• Drive information
• Desktop/window screenshots
• Currently running processes and active services
• Computers connected to the domain
• TCP/UDP port connections
• User keystrokes (using a keylogging routine)

It also checks for the presence of the following security processes in the computer; if found, it gathers the version of these programs:

• avp.exe
• McShield.exe
• avguard.exe
• bdagent.exe
• UmxCfg.exe
• fsdfwd.exe
• rtvscan.exe
• ccSvcHst.exe
• ekrn.exe
• tmproxy.exe
• RavmonD.exe

Analysis by Shawn Wang and Zarestel Ferrer