Trojan:BAT/Startpage.GVC

Trojan:BAT/Startpage.GVC is a trojan that modifies the start page and search page of the Internet Explorer without a user's consent.

Installation

Trojan:BAT/Startpage.GVC creates the following files, after which it executes then deletes them:

• %Temp%\RarSFX*\MyHome.cmd - detected as Trojan:BAT/Startpage.GVC
• %Temp%\DefOpen.reg

It is present as a WinRAR SFX archive, and uses a picture as its file icon to trick the affected user into running it, as seen below:

Payload

Modifies browser settings

The malware changes the start page for Internet Explorer to babaw.net by making the following registry modification:

In subkey: HKCU\Software\Microsoft\Internet Explorer\Main
Sets value: "Start Page"
With data: "www<removed>babaw.net"
Sets value: "Default_Page_URL"
With data: "www<removed>babaw.net"

In subkey: HKCU\Software\Microsoft\Internet Explorer\SearchScopes
Sets value: "DefaultScope"
With data: "{2153705A-F2F9-4220-83D8-EC1CEB581D21}"
Sets value: "Version"
With data: "dword:00000001"

In subkey: HKCR\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\command
Sets value: "@"
With data: "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE www<removed>babaw.net"

In subkey: HKCR\http\shell\open\command
Sets value: "@"
With data: "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE www<removed>babaw.net"

It makes the following changes to the registry to modify the default search in Internet Explorer:

In subkey: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2153705A-F2F9-4220-83D8-EC1CEB581D21}
Sets value: "DisplayName"
With data" "百度搜索" (translates to "Baidu search")
Sets value: "URL"
With data: "http://www<removed>baidu.com/s?tn=ax5008_dg&wd={searchTerms}&ie=utf-8"

In subkey: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{12C12F0D-3E90-4638-9F19-803214C2AE8C}
Sets value: "DisplayName"
With data: "腾讯搜搜" (translates to "Tencent SOSO search")
Sets value: "URL"
With data: "http://www<removed>babaw.com/soso.asp?q={searchTerms}&ie=utf-8"

The trojan modifies the search page in Internet Explorer to open at the following:

• baidu.com/s?tn=ax5008_dg&wd={searchTerms}&ie=utf-8
• babaw.com/soso.asp?q={searchTerms}&ie=utf-8

Analysis by Xinrui Qin