Trojan:Win32/Elvdeng.C

Trojan:Win32/Elvdeng.C is a component of Trojan:Win32/Elvdeng - a multiple component family that uses several different methods to attempt to change the start page for a number of different popular Internet browsers. It may also open other browser windows.

Installation

Win32/Elvdeng’s installer writes the following files to the %ProgramFiles%\lvegned folder:

• sstatic.exe – may be detected as Trojan:Win32/Elvdeng.B
• scvhost.exe – may be detected as Trojan:Win32/Elvdeng.C
• sysinit.exe – may be detected as Trojan:Win32/Elvdeng.A or Trojan:Win32/Elvdeng.D
• hook.dll – may be detected as Trojan:Win32/Elvdeng.E
• config.ini
• uninstall.exe
• uninstall.dat
• taobao.ico

The installer ensures that when a file with a .ghi extension is launched, sysinit.exe will be run instead by creating the following registry entry:

In subkey: HKLM\SOFTWARE\Classes\.ghi\shell\open\command
Sets value: (default)
With data: "%program_files%\lvegned\sysinit.exe"

It then launches sstatic.exe and scvhost.exe.

Payload

Modifies browser settings

Scvhost.exe checks the config.ini file for a list of commonly used Internet browsers. It then monitors running processes to determine whenever a new process is launched for one of these browsers. When this occurs, it will terminate this new browser process and launch another browser process, displaying a page specified by config.ini. One config.ini file observed at the time of publication displayed a page from ucgm8.info, and used the following list of browsers:

• iexplore
• 360se
• Firefox
• SogouExplorer
• Opera
• TTraveler
• Maxthon
• TheWorld
• Chrome

Opens browser windows

During installation, the malware may open an Internet Explorer window to a site such as xiazai189.com.

Other components of Win32/Elvdeng may open additional browser windows. See the Trojan:Win32/Elvdeng family description for more details.

Analysis by David Wood