TrojanDownloader:Win32/Renos.EN

TrojanDownloader:Win32/Renos.EN is a trojan that connects to certain websites in order to download other malware. This may include other TrojanDownloader:Win32/Renos components, and rogue antivirus software such as Trojan:Win32/FakeSecSen or Trojan:Win32/FakeXPA.

When executed, TrojanDownloader:Win32/Renos.EN runs from its original location, and creates a registry entry to ensure that it runs on system startup:

 

Under key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Adds value: MSFox
With data: <full pathname of malware>

 

It also creates a number of registry entries similar to the following example:

 

Under key: HKLM\Software\Mozilla\MSFox
Adds values: Str<digit>
With data: <base64 encoded string> (for example, "zbZdFr5/CbjyPkNQIrNnqAuuDXWXEv+yhwYIMvYIWoHwgiUTaU8Jbx==")

Downloads and Executes Arbitrary Malware
Once installed, the trojan may connect to one of a number of servers, from which it may download and execute other malware. This may include other TrojanDownloader:Win32/Renos components, and rogue antivirus software such as Trojan:Win32/FakeSecSen or Trojan:Win32/FakeXPA.

 

These servers may include the following:

 

With some of these servers, it may post some system information to the server before downloading the malware, while with others it simply downloads the malware without posting any information.

 

The downloaded malware is generally saved to the %temp% directory, using filenames such as ~tmpa.exe.

 

The following example shows one variant of the malware downloading another Win32/Renos component, which at the time of publication led to the downloading and installation of Trojan:Win32/FakeXPA. Note that malware from different rogue antivirus families (such as Trojan:Win32/FakeSecSen) may be downloaded by different TrojanDownloader:Win32/Renos.EN variants, or at different times. The method in which the malware is installed may also differ.

 

The malware first downloads a further TrojanDownloader:Win32/Renos component, which places an icon in the system tray. This component will not run unless the original malware is also present. It periodically displays a balloon indicating a security problem:

 

 

 

If this balloon is ignored, the following message is eventually displayed:

 

 

Should the user click the balloon or the Yes button of the dialogue box, a number of web pages are downloaded, which display a few more dialogue boxes before simulating a web-based antivirus scanner in the user’s browser.

 

The browser may appear similar to that shown in the example below during the simulated scanning process. Regardless of whether there is any other malware on the system, it will report a number of possible threats.

 

 

Once the scanning process has finished, a page is displayed that may appear similar to the following example:
 

Regardless of whether the user clicks the “Remove All” or “Ignore” buttons, the malware downloads and installs Trojan:Win32/FakeXPA. If the user attempts to dismiss the window using the red X, the following dialogue boxes are displayed before the malware is downloaded:

 

 

 

 

The rogue antivirus software is then launched. For more details, please see the Trojan:Win32/FakeXPA description.