Installation
This malware copies and runs itself from the following locations:
It changes the following registry entry so that it runs each time you start your PC:
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Google Chromium"
With data: "%APPDATA%\Chromium.exe"
It also modifies the following registry entries to lower your PC security settings:
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "EnableLUA"
With data: "0"
In subkey: HKLM\Software\Policies\Google\Update
Sets value: "UpdateDefault"
With data: "0"
Payload
Downloads other malware
This threat contacts three hardcoded servers to determine which one is online. It waits for a "server_ok" reply from the active server.
It checks which version of the Chrome web browser is installed on your PC. If you have a version other than 30.0.1573.2 the malware will download this version from its server. It then stops the chrome.exe process and replaces this file with the version of Chrome that the malware downloaded.
It then downloads and installs a Chrome plug-in that uses one of the following names:
- AdBlock Pro
- Raw manager
- Rawded Pro
We have seen the malware contact the following servers to downloading malware or malware updates:
- alsancakgaming.com
- facebookcheaplikes.net
- filmver.com
- filmverme.com
- joojlee.com
- likedealers.com
- pagesphp.net
- schedulesapps.com
- sosyaljs.com
- sosyaljss.com
- sosyalpatron.com
- tmobilevideo.mobi
- togd.org
- videotroppy.info
- voltaj.org
- windowsjava.com
- www.5lf.net
- www.filmver.com
- www.helpcdn.com
- www.jscmd.net
- www.kaplanphp.com
- www.kasarporno.com
- www.kingcdn.net
- www.kplncodes.info
- www.neran.net
- www.pagesphp.net
- www.pornokan.com
- www.rapfoto.com
- www.sosyaljs.com
- www.sosyaljss.com
- www.sosyaljssss.com
- www.sshup.com
- www.wjetphp.com
- www.yorcdn.com
- xmobilevideo.mobi
- yorcdn.com
The plug-in is installed as public.js and is detected as Trojan:JS/Kilim.AA. The plugin ID will be randomly generated.
The malware modifies the preferences of the downloaded plug-in to grant the following permissions:
- clipboardRead
- clipboardWrite
- contentSettings
- cookies
- history
- idle
- management
- notifications
- notifications
- storage
- tabs
- unlimitedStorage
- webNavigation
- webRequest
- webRequestBlocking
- webRequestInternal
Stops update services
This threat can stop Google update services from running on your PC. It does this by deleting the following file:
It also deletes the following scheduled tasks:
- GoogleUpdateTaskMachineCore
- GoogleUpdateTaskMachineUA
Redirects your web browser
The malware can redirect your web browser from www.google.com to localhost by modifying the hosts file for any of the following update URLs:
- clientsX.google.com
- dl.google.com
- tools.google.com
It can also block access to security related websites, and stop Windows and browser updates by redirecting traffic to localhost. We have seen it redirect traffic from the following websites:
2-viruses.com aavar.org adwarereport.com agnitum.com agnitum.de agnitum.ru allnod.com allnod.info amtso.org analysis.avira.com answers.microsoft.com anti-malware.com anti-malware-test.com antirootkit.com anti-spyware.com.au antivir.de antivir.ru antivir-2012.com antiviraldp.com antivirus.about.com anti-virus.by antivirus.cai.com antivirus.comodo.com antivirus.startpagina.nl antivirus-online.de anti-virus-software-review.com antivirusvergelijk.nl anubis.iseclab.org au.norton.com auditmypc.com authentium.com av.eu avast.com avast.com.au avast.ru avastav.nl av-comparatives.org av-desk.com avertlabs.com avg.com avg.com.au avg.cz avg-antivirus.com.au avg-antivirus-plus-firewall.en.softonic.com avgfrance.com avira.com avira.com.au avirus.com.ua avirus.ru avp.ru avsoft.ru av-test.de av-test.org bestantivirusreviewed.com bitdefender.co.uk bitdefender.com bitdefender.com.au bitdefender.com.ua bitdefender.de bitdefender.nl |
bitdefender.ru bobbear.co.uk camas.comodo.com ca-store.com.au centralops.net check-mark.com checkvir.com clamav.dyndns.org clamav.net clamsupport.sourcefire.com clamwin.com cleanallspyware.com cleanuninstall.com clients1.google.com clients10.google.com clients2.google.com clients3.google.com clients4.google.com clients5.google.com clients6.google.com clients7.google.com clients8.google.com clients9.google.com cnet.com comodo.com comodogroup.com companies-house.gov.uk cybercrime.ch cybercrime.gov cyprotect.com data.kaspersky.ru db.local.clamav.net defenx.nl dialognauka.ru diamondcs.com.au dl1.agnitum.com dl2.agnitum.com dnsstuff.com domaintools.com download.drweb.com download.eset.com download.nai.com download.norman.no download1.avast.com download2.avast.com download3.avast.com download4.avast.com download5.avast.com download7.avast.com downloads.kaspersky-labs.com drweb.com drweb.com.ua drweb.imshop.de drweb.net drweb.ru dr-web.ru drweb-antivir.it dw.com edgesuite.net emlx.net |
emsisoft.com enisa.europa.eu escanav.com eset.co.uk eset.com eset.com.au eset.eu eset.sk esetindia.com esetnod32.ru eu.shopmcafee.com europe.f-secure.com files.avast.com files.f-prot.com finjan.com firewallguide.com forum.avira.com forum.bitdefender.com f-prot.com fraudaid.com free.avg.com free.grisoft.com freeantivirushelp.com free-av.com free-av.de freedrweb.com free-firewall.org freespaceinternetsec urity.com fsa.gov.uk f-secure.co.uk f-secure.com f-secure.de f-secure.ru ftp.bitdefender.com ftp.ca.co ftp.drweb.com ftp.esafe.com ftp.f-secure.com ftp.f-secure.de ftp.kaspersky.ru ftp.kasperskylab.ru ftp.kaspersky-labs.com ftp.microworldsystems.com ftp.nai.com gdata.nl gdatasoftware.co.uk gietl.com gmer.net gratissoftware.nu gratissoftwaresite.nl grisoft.com grisoft.cz hackerguardian.com harveynorman.com.au hijackthis.de home.mcafee.com housecall.trendmicro.com icsalabs.com ika-rus.com ikarus-software.at |
inline-software.de interpol.int iopus.com iseclab.org joebox.org joojlee.com kaspersky.co.uk kaspersky.com kaspersky.ru kaspersky-antivirus.ru kasperskyanz.com.au kasperskyclub.com kasperskyclub.ru kavdumps.kaspersky.com kerio.com kingsoftsecurity.com k-otik.com krebsonsecurity.com lavasoft.com lavasoft.com.au lavasoft.nu lavasoftusa.com lavasoftusa.de liveupdate.symantec.com lurker.clamav.net majorgeeks.com malekal.com malwarebytes.org mcafee.com mcafee.free-trials.net mcafeesecure.com mcafeesecurity.com mcafeestore.com met.police.uk microbe.com.au misec.net model-fx.com moosoft.com msecn.net mwcollect.org myaccount.bitdefender.com myantispyware.com my-etrust.com nai.com nbi.gov.ph netfreighters.com.au noadware.net nod32.com nod32.com.au nod32.com.ua nod32.it nod32.nl nod-32.ru nod32.su nod32eset.org nordnet.com norman.com norton.com nortonantiviruscenter.com novirus.ru |
nsclean.com nsslabs.com offensivecomputing.net onecare.live.com onlinescan.avast.com openantivirus.org outpostfirewall.com panda-antivirus.en.softonic.com pandasecurity.com.au pandasoftware.com pccreg.antivirus.com pchelpforum.com pcpro.co.uk pcthreat.com pctools.com pcworld.com personalfirewall.comodo.com pestpatrol.com police.gov.hk prevx.com projecthoneypot.org protectstar-testlab.org ravantivirus.com removevirus.org ripe.net robtex.com rokop-security.de safeweb.norton.com sald.com sandbox.norman.no sandboxie.com santivirus.com scambusters.org scanwith.com schoonepc.nl sectools.org secure.nai.com securesoft.com.au securetec.com.au securitoo.com security.symantec.com securityresponse.symantec.com secuser.com service.mcafee.com service1.symantec.com shop.ca.com shop.mcafee.com simplysup.com siteadvisor.com softonic.com sophos.com spamcop.net spamhaus.org spamtrackers.eu spyblocker-software.com spywareguide.com spywarewarrior.com staples.com staysafeonline.info sunbelt-software.com |
superantispyware.com superantispyware.com.au support.drweb.com support.f-secure.com support.f-secure.de sygate.com symantec.com symantec-norton.com tds.diamondcs.com.au techsupportforum.com threatexpert.com threatfire.com threatmetrix.com tinysoftware.com tools.google.com treasury.gov trendmicro.com trendmicro.com.au trendmicro.nl trendmicro-europe.com trojan-killer.ne trustdefender.com tucows.com tuwien.ac.at update.eset.com update.microsoft.com updates.sald.com uploadmalware.com us.mcafee.com v4.windowsupdate.microsoft.com v5.windowsupdate.microsoft.com vba32.de vergelijk.nl vet.com.au virscan.org virusall.ru virusblokada.ru virusbtn.com virus-help.net virusinfo.info viruslab.ru viruslist.com virusscan.jotti.org virussen.upc.nl virustotal.com visualizesoftware.com vupen.com webroot.co.uk webroot.com webroot.nl wepawet.iseclab.org wilderssecurity.com wildlist.org windows.microsoft.com windowsupdate.microsoft.com www.dl.google.com www.tools.google.com zeustracker.abuse.ch z-oleg.com zonealarm.com zonelabs.com zonelog.co.uk |
Analysis by Daniel Chipiristeanu