Installation
Trojans in the Win32/Sathurbot family are Dynamic Link Library (.dll) files that are injected into running processes to perform their malicious routines.
They are usually bundled with other third-party installers and keygens. They can also be downloaded from malicious or hacked websites, and through peer-to-peer file sharing applications.
We have seen variants bundled with installers and keygens using file names designed to look like legitimate programs. Some of the installers we have seen include:
-
64bit_vuex91.exe
-
adobe.cs6.all.products.activator.(x32.y.x64)_up01-MPT.exe
-
Awave Studio 10.6.exe
-
codec.exe
-
elfbowl.exe
-
Flash Player 11.0.1.60 Beta 1 (IE).exe
-
fo-gpp2.exe
-
idman612b.exe
-
IPNetCheckerSetup-x64.exe
-
Joboshare iPhone Rip Setup.exe
-
Keymaker.exe
-
K-Lite Codec Pack 9.0.exe
-
Mega Codec Pack 9.X.exe
-
PATCH.exe
-
Platinum Hide IP Setup.exe
-
PowerISO5.exe
-
SCANNER.EXE
-
Setup.exe
-
Setup.RemoteDesktopManager.6.1.7.0.exe
-
Sknote KickHaas VST v1.09.exe
-
sysrc.exe
-
typing.master.pro.v7.0.1.763.exe
-
uiso9_pe.exe
-
Wedding Album Maker Gold 3.50 Portable Serial Key.exe
-
WGA Patcher Cyclone 4.0 Setup.exe
-
Windows 7 Anytime Upgrade Keygen.exe
-
Windows.Loader.v2.1.3.exe
-
winrar-32Bit.exe
-
x264 Video Codecs XP-Win7.exe
-
xf-adsk2013_xXX.exe
-
Youtube Video Downloader PRO.exe
The installer could look like one of the following:
We have seen Win32/Sathurbot variants installed with the following file names and folders:
The trojans drop a malicious .dll and run it via rundll32.exe, using the following format:
Where <path> is the folder and file name the trojan was installed to.
They change the following registry entries:
In subkey: HKEY_CLASSES_ROOT\CLSID\{1EC23CFF-4C58-458f-924C-8519AEF61B32}\InprocServer32
Sets value: "<default>"
With data: "<path>"
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1EC23CFF-4C58-458f-924C-8519AEF61B32}\InprocServer32
Sets value: "<default>"
With data: "<path>"
In subkey: HKEY_CLASSES_ROOT\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}\InprocServer32
Sets value: "<default>"
With data: "<path>"
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B82655E9-B81D-4A97-8154-0D84A4C048E4}\InprocServer32
Sets value: "<default>"
With data: "<path>"
In subkey: HKEY_CLASSES_ROOT\CLSID\{24808826-C2BF-4269-B3BA-89D1D5F431A4}\InprocServer32
Sets value: "<default>"
With data: "<path>"
In subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24808826-C2BF-4269-B3BA-89D1D5F431A4}\InprocServer32
Sets value: "<default>"
With data: "<path>"
Win32/Sathurbot is injected to any of the following processes.
-
explorer.exe
-
explorer64.exe
-
regsvr32.exe
-
regsvr64.exe
-
rundll32.exe
Payload
Contacts a remote server and opens a backdoor
We have seen variants in this family contact a remote server for a possible backdoor routine.
The server is random, but we have seen variants use the following servers:
-
aerofix.eu
-
cuptstech.eu
-
djigurda.eu
-
hujpizda.eu
-
inuxland.eu
-
prosmartraff.eu
-
qwertytraff.org
The backdoor can allow a hacker to perform the following actions on your PC:
- Run files
- Update the copy of the trojan
- Get information about your PC
Makes changes to security settings
Win32/Sathurbot can add themselves to your firewall exception list.
We have also seen variants stop the following security programs and services from running:
-
MpsSvc
-
msascui.exe
-
MSC
-
MsMpSvc
-
msseces.exe
-
SharedAccess
-
WinDefend
-
Windows Defender
-
wscsvc
-
wuauserv
Downloads other malware
Win32/Sathurbot variants can act as a peer-to-peer client.
It may do this to communicate with the command and control server as part of its backdoor payload.
Analysis by Ric Robielos