Installation
We have seen Trojan:Win32/Lecpetex.A downloaded or injected into clean system processes by the following threats:
Trojan:Win32/Lecpetex.A creates a copy of itself as an alternate data stream in %TEMP%\rnd.dat.
It modifies the following registry entry so that it runs each time you start your PC:
In subkey: HKCU\software\microsoft\windows\currentversion\run
Sets value: svchost = "regsvr32 /s"
With data: "%TEMP%\<random>.dat."
In subkey: HKLM\software\microsoft\windows\currentversion\run
Sets value: "svchost"
With data: "regsvr32 /s %TEMP%\random>.dat"
Payload
Connects to a command and control center
Once installed, Trojan:Win32/Lecpetex.A connects to a website or email account to receive instructions from a command and control center. We have seen it log in to email accounts on the following mail servers:
- mailcatch.com/en/temporary-inbox
- mailnesia.com/mailbox
- spamavert.com/mail/
- tempinbox.com/cgi-bin/checkmail.pl
- www.dispostable.com/inbox/
- www.koszmail.pl/koszmail/mailBox.php?mailBox=
It uses different signatures to get the encrypted bot command to execute. If it belongs to a bot owner it requires the string <!-- Designed by the SkyNet Team --> as an initial identifier check.
We have seen it receive the commands to:
- Update itself
- Download files, including other malware
- Inject components into other processes
- Download a component that sends messages with malicious links on Facebook
Injects code into Windows Explorer
The trojan runs explorer.exe and injects component files into it so that it runs in stealth mode.
Collects system information
We have seen this threat collect the following system information:
- Disk volume serial number
- File system name and type
- OS version
- PC name
The collected information is sent to the following IP address:
Trojan:Win32/Lecpetex.A performs the payloads listed above every 15 minutes. It stops performing these behaviors after 20,000 times.
Installs bitcoin miner and password stealer
We have seen this trojan install a bitcoin miner and password stealer.
Additional information
The name Lecpetex is based on the mutex name the threat creates. The following string format used to generate the mutex was found in the code:
Trojan:Win32/Lecpetex.A checks to test if the system it is running in is being monitored for security analysis or being debugged.
It also checks if it is running in a sandbox environment by checking the user name logged into the system. It does this by comparing the logged-in user with any of the following:
- ANUBIS
- MALWR
- SANDBOX
- VIRUS
It also inspects the filename and path used when it runs to check if it matches any of the following:
- ANUBIS
- MALWR
- SANDBOX
- \SAMPLE
- \VIRUS
The trojan checks for the following security analysis systems and tools:
- Sandbox files:
sbiedll.dll
%system%\drivers\VBoxMouse.sys
%system%\drivers\vmmouse.sys
%system%\drivers\vmhgfs.sys
- Export name wine_get_unix_file_name in kernel32.dll
- Value of registry entry HKCU\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id\Identifier if it is:
VBOX
VMWARE
QEMU
- Value of registry entry HKCU\HARDWARE\Description\System\SystemBiosVersion if it is:
VBOX
QEMU
- Registry keys:
HKCU\SOFTWARE\Oracle\VirtualBox Guest Additions
HKCU\SOFTWARE\VMware, Inc.\VMware Tools
Analysis by Zarestel Ferrer