Trojan:Win32/Helpud.BA

Trojan:Win32/Helpud is a family of Trojans that steals passwords for online games, which it sends to remote sites.

 

Win32/Helpud.AA is known to arrive on a user's machine by means of exploits, for example if a user visits or is redirected to a compromised site. Trojan:SWF/Redirector.I is known to redirect to sites that install Trojan:Win32/Helpud.AA.

Upon execution, Trojan:Win32/Helpud.AA may search for the mutex dd75d055b3. If it locates the mutex, it terminates itself.

 

It tries to drop a DLL file with the Hidden and System attributes into the Windows system folder as the file <malware file>ym.dll. If this file already exists and cannot be deleted, it attempts to drop the DLL file in the same location as the file <malware file><two random letters>ym.dll. If this last attempt fails, it then tries to drop the DLL file in the Windows Temp folder as <malware file>ym.dll.

 

The dropped DLL file is detected as Trojan:Win32/Helpud.AA!dll.

 

Win32/Helpud.AA then loads the DLL file and injects it into all running processes.

 

Note that <malware file> is the file name of the malware process detected as Trojan:Win32/Helpud.AA.

 

It also drops and executes the batch file $ckvjkk4kg.bat, which deletes its currently-running process.

Disables Security Processes

Trojan:Win32/Helpud.AA attempts to disable various antivirus programs to avoid detection.

 

If Kaspersky Antivirus is running in the system, this trojan attempts to set the system year to 2004 to invalidate the user subscription.

 

It attempts to disable Jiangmin Antivirus Software and 360Safe Antivirus Software if these are running in the system.

 

It attempts to close windows with AVP.TrafficMonConnectionTerm as the window class name.

 

It deletes the Windows file %system32%\VerClsid.exe if it exists in the system.

 

Analysis by Marian Radu