Win32/Pramro is a trojan that acts as a SOCKS proxy on an infected PC. Proxy servers may be used by attackers to hide the origin of malicious activity. In this case, this proxy may be used to relay spam and HTTPtraffic. In the wild, Win32/Pramro has been observed to be downloaded by variants of the Win32/Sality family.
Installation
Win32/Pramro runs from where it is run. It may create the mutex "qiwuyeiu2983" to avoid running multiple instances of itself.
Payload
Changes firewall settings
Win32/Pramro adds itself to the Windows Firewall exclusion list by changing the following registry entry:
In subkey: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Sets value: "<malware file name>"
With data: "<path to the malware executable>:*:enabled:ipsec"
Downloads and runs files
Variants of Win32/Pramro can be instructed to download and run files. Files are written with random file names to the %TEMP% folder, with the prefix "win", for example:
-
%Temp%\winkfunt.exe
-
%Temp%\winkrulih.exe
Acts as a SOCKS proxy
Win32/Pramro may initially attempt to contact the following hosts via port 25 to test for Internet connectivity.
-
c.mx.mail.yahoo.com
-
d.mx.mail.yahoo.com
-
imx1.rambler.ru
-
maila.microsoft.com
-
mailin-01.mx.aol.com
-
mailin-02.mx.aol.com
-
mailin-03.mx.aol.com
-
mailin-04.mx.aol.com
-
mx1.yandex.ru
-
mx2.yandex.ru
-
mxs.mail.ru
If it is unable to connect to any of these hosts using port 25, a connection to a specific IP address on port 80 is made. The IP address may be one of the following:
-
216.185.103.3
-
92.48.119.164
-
94.76.206.19
Otherwise, it randomly selects an IP address from a hard-coded list and attempts to connect to this IP address via port 80 or 1080. The following are examples of IP addresses that the trojan has been observed to communicate with:
-
193.104.186.32:80
-
212.117.175.9:80
-
212.117.185.10:80
-
50.23.171.18:80
-
50.23.171.19:80
-
50.97.219.131:80
-
85.234.141.72:80
-
94.76.206.216:80
-
94.76.218.18:80
-
94.76.225.131:80
-
94.76.246.83:1080
-
66.235.184.134:80
Variants of Win32/Pramro open and listen on a random TCP port between 1179 and 8178 (inclusive), except for ports 6665, 6666, and 6667. Older variants may listen to a random port between 1179 and 11178 (inclusive), with the same exceptions.
Win32/Pramro may then be used to relay spam email or HTTP traffic through the open port.
Analysis by Scott Molenkamp
