PWS:Win32/Simda.AF is a password-stealing trojan that may also allow backdoor access and control of your computer. Its main purpose is to steal passwords and system information from your computer.
Installation
When run, PWS:Win32/Simda.AF copies itself with random file name to the "%windir%\AppPatch" folder.
It creates the following registry entries to make sure that its copy runs every time Windows starts:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "userinit"
With data: "%windir%\AppPatch\<random name>.exe"
In subkey: HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
Sets value: "run"
With data: "%windir%\AppPatch\<random name>.exe"
In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "load"
With data: "%windir%\AppPatch\<random name>.exe"
In subkey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows
Sets value: "System"
With data: "%windir%\AppPatch\<random name>.exe"
In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Modifies value: "userinit"
With data: "c:\windows\system32\userinit.exe,%windir%\AppPatch\<random name>.exe,"
It also creates the following mutex to make sure only one instance of itself is running in your computer:
Global\MicrosoftSysenterGate7
Payload
Allows backdoor access and control
PWS:Win32/Simda.AF attempts to connect to certain servers to wait for commands. The following are examples of servers that it attempts to connect to:
- cihunemyror.eu
- vofozymufok.eu
- digivehusyd.eu
- fodakyhijyv.eu
- gatedyhavyd.eu
- rynazuqihoj.eu
- kemocujufys.eu
- nopegymozow.eu
- divywysigud.eu
- jewuqyjywyv.eu
- marytymenok.eu
- dikoniwudim.eu
- jepororyrih.eu
- qetoqolusex.eu
- nofyjikoxex.eu
Using this backdoor access, an attacker can perform several actions on your computer, including the following:
- Download and upload files
- Delete files and registry entries
- Restart your computer
- Start and stop applications
- Log keystrokes
- Modify your computer's settings
Steals information
PWS:Win32/Simda.AF has been observed to steal the following information, which it sends to a remote server:
- List of all currently running processes
- Internet Explorer, Opera, and Firefox history of visited websites
- Window titles of and URLs visited by every process
- FTP user names and passwords
- Network packets
- Autocomplete passwords
- Dial-up passwords
- Logged keystrokes
- Plain text traffic information pertaining to FTP, NNTP, POP3, and POP2 protocols
- Computer information, such as your user name, computer name, hardware information, and network information
It may store its stolen information in files that have the following names:
- keylog.txt
- links.log
- pass.log
- passwords.txt
- sniff.log
- sysinfo.log
Once loaded, PWS:Win32/Simda.AF attempts to inject itself into the following processes if they are running in your computer:
- svchost.exe
- opera.exe
- iscc.exe
- clmain.exe
- wclnt.exe
- chrome.exe
- core.exe
- iexplore.exe
- firefox.exe
- explorer.exe
Depending on the process, it injects itself either as part of its information stealing process, to stay resident in memory, or to hide itself from other processes.
It also tries to hook the following APIs as part of its information stealing routines:
- AddPSEPrivateKeyEx
- AddSigner
- CallWindowProcA
- CallWindowProcW
- CloseClipboard
- CountClipboardFormats
- CreateFileW
- DefDlgProcA
- DefDlgProcW
- DefFrameProcA
- DefFrameProcW
- DefMDIChildProcA
- DefMDIChildProcW
- DefWindowProcA
- DefWindowProcW
- DnsQuery_A
- DnsQuery_UTF8
- DnsQuery_W
- EmptyClipboard
- FlashWindow
- FlashWindowEx
- GetCapture
- GetClipboardData
- GetCursorPos
- GetFileAttributesW
- gethostbyname
- GetMessageA
- GetMessagePos
- GetMessageW
- GetPriorityClipboardFormat
- GetUpdatedClipboardFormats
- GetWindowTextA
- HttpSendRequestA
- HttpSendRequestExA
- HttpSendRequestExW
- HttpSendRequestW
- InternetCloseHandle
- InternetQueryDataAvailable
- InternetReadFile
- InternetReadFileExA
- InternetReadFileExW
- IsClipboardFormatAvailable
- MessageBeep
- OpenDesktopA
- OpenDesktopW
- OpenInputDesktop
- PeekMessageA
- PeekMessageW
- PlaySoundA
- PlaySoundW
- PR_Close
- PR_GetError
- PR_GetNameForIdentity
- PR_OpenTCPSocket
- PR_Read
- PR_SetError
- PR_Write
- Query_Main
- RCN_R50Buffer
- recv
- ReleaseCapture
- send
- SendInput
- SetCapture
- SetClipboardData
- SetCursorPos
- SetDIBitsToDevice
- SetThreadDesktop
- sndPlaySoundA
- sndPlaySoundW
- SSL_write
- SwitchDesktop
- TrackPopupMenuEx
- TranslateMessage
- vb_pfx_import
- WSARecv
- WSASend
- ZwQuerySystemInformation
Blocks access to certain websites
PWS:Win32/Simda.AF checks the URL of websites you visit if they contain any of the following strings:
- .comodo.com
- 93.191.13.100
- anti-malware
- antivir
- avast.com
- avira
- drweb
- eset.com
- kaspersky
- kltest.org.ru
- trendsecure
- virusinfo
- virustotal
- z-oleg.com
If it finds that you are visiting websites that contain any of these strings, it may redirect you to "google.com".
Analysis by Jonathan San Jose
