Trojan.Win32.Oficla.w

Technical Details
Payload

Technical Details

This malicious program is intended for the unauthorized downloading and launching of other malware on a computer.

Installation

When launched, the malicious program extracts from itself and creates a windows file in the system folder which is a dynamic-link library (.dll file) containing the following main malicious features:

%system%\thxr.wgo

To ensure that it is launched automatically when the system is rebooted, the Trojan adds a link to the created file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe rundll32.exe thxr.wgo nwfdtx"

Payload

When installed the program contacts the command server:

http://hu*********.ru /images/bb.php

where it receives the command line with the following commands and parameters:

"runurl"

- downloads the file to the %temp% folder using the indicated url and launches it.

"taskid"

– indicates the task number.

"delay"

– indicates the period the server was contacted.

"backurls"

– a list of additional addresses of command servers which the malicious program then connects to. Addresses are saved in the registry key:

[HKL\SOFTWARE\Classes\idid]

"reporturls"

– after this command the program contacts additional command servers to receive other commands.

Thus, the actions of this program may lead to the installation of other malware on the computer. At the time of writing, the program was receiving a command to download and launch the file:

http://russ**nmomds.ru/dogma.exe

The criminal may also use these commands to continually re-customize the malicious program to be used on new command servers.