Trojan-Spy:W32/Shiotob

Infection Vector

Commonly downloaded via malicious document that arrives as an attachment in a spam email.

Behavior

Shiotob injects malicious code into explorer.exe or iexplorer.exe and executes from there.

Stealth capability

The sample's execution will be terminated if the following conditions are met:

• Running in debugger by checking the "Isdebuggerpresent" API
• Running in VMware by checking the "VMWARE" string
• The sample name is "SAMPLE", "VIRUS" or "SANDBOX"
• If the processor of the computer is 'Xeon'
• If the sample is run with command line and the arguments are either -aurnato or -udpid. If yes, it will then set a flag.

Dropped files

Shiotob creates a file in the location "C:\Program Files (x86)\Windows NT\<random>.exe"

(random filename based on these keywords: win, video, def, mem, dns, setup, user, logon, hlp, mixer, pack, mon, srv, exec, and play)

Registry changes

• HKEY_LOCAL_MACHINE\SOFTWARE\<random name>:

  • REG_BINARY: {BINARY DATA}

Created Mutex

• Global\Uz[A-Za-z0-9]{8}

Check proxy

Checks the proxy setting by searching \Mozilla\Firefox\Profiles\prefs.js

Network Activities

• Checking internet connection by connecting to www[.]google[.]com
• Connects to C2 server: olkerona[.]com/auth
• C2 format:

  • olkerona[.]com/auth/?tver=[data]&vcmd=[data]&cc=[data]&hh=[data]&ipcnf=[data]&sckport=[data]&pros=[data]&keret=[data]&email=[data]

    • ipcnf = IP address
    • sckport = Sock port (proxy)
    • keret = Keyboard layout
    • email = Email address if any
    • Other fields &vcmd, &hh, &tver, &cc are related to C&C

Analysis based on sample: 0d8fd93b0b59ab2c3b41e2eadb1d9ea6f4dce9ea