Win32/Winsec

Installation

Malware in this family can create the following files on your PC:

• %SystemRoot%\winsec.dll - main component dropped by the malware
• %SystemRoot%\dayipmr.tbl - configuration file
• %TEMP%\msvcrt.bat - self-delete batch file

The malware adds the following registry entries to add itself as a service:

In subkey: HKLM\SYSTEM\ControlSet001\Services\Windows Security\Parameters
Sets value: "ServiceDll"
With data: "%SystemRoot%\system32\winsec.dll"

In subkey: HKLM\SYSTEM\ControlSet001\Services\Windows Security\Parameters
Sets value: "Windows Security"
With data: "windows security"

It allows a port for communication through the Windows Firewall settings using the following Group Policy:

• HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List  

Payload

Allows backdoor access and control

This threat can give a malicious hacker access and control of your PC. They can then perform a number of different actions, including:

• Acting as a proxy server
• Copying files and sending them to a remote IP address
• Downloading files remotely onto the infected system, including malware from Win32/Escad, Win32/Brambul and Win32/Joanap malware families.
• Enumerating files in any folder
• Gathering machine information, such as your PC name, TCP connections, free disk space, and network adapter information
• Modifying firewall settings
• Modifying your IP settings

Analysis by Jireh Sanico