Threat behavior
Trojan:Win32/Matcash.gen!F is a generic detection for a group of trojans that install additional malware and spyware onto the affected system. It also connects to a remote site and downloads and executes arbitrary files, observed to be additional members of the Matcash family.
Installation
When executed, Matcash drops the following files onto the affected machine:
- %Program Files%\InetGet2\Installeur.exe - detected as Trojan:Win32/Matcash.KV
- %Program Files%\InetGet2\Installeur.exe.lzma - compressed Installeur.exe file
It then executes Installer.exe, which in turn drops the following files:
- %Program Files%\<name>\<name>.exe --> detected as Spyware:Win32/Maxifiles
- %Program Files%\<name>\<name>.exe.lzma --> compressed <name>.exe file
- %Program Files%\<name>\uninstall.exe --> uninstaller file
- %Program Files%\<name>\uninstall.exe.lzma --> compressed uninstall.exe
where <name> may be either of the following strings:
JavaCore
NoDNS
It also creates the following registry entries to ensure that one of these files is executed at each Windows start:
Adds value: "<name>"
With data: "%Program Files%\<name>\<name>.exe"
To subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
where <name> may be either of the following strings:
JavaCore
NoDNS
It also adds the following registry entries:
HKEY_CLASSES_ROOT\CLSID\{FCCEB19B-0624-1033-0222-0622060001}
HKEY_CLASSES_ROOT\CLSID\{F4507CDA-0AF2-1033-0920-0520050001}
HKEY_CURRENT_USER\Software\Classes\CLSID\{FCCEB19B-0624-1033-0222-0622060001}
HKEY_CURRENT_USER\Software\Classes\CLSID\{F4507CDA-0AF2-1033-0920-0520050001}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BO1jiZmwnF2zhi\JavaCore
UninstallString = "%Program Files%\\JavaCore\\UnInstall.exe"
KEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\NoDNS
UninstallString = "%Program Files%\\nodns\\uninstall.exe"
Payload
Downloads and Executes Arbitrary Files
Matcash.gen!F connects to the following location in order to download other members of the Matcash family:
h t t p://<REMOVED>.mcboo.c o m/ack.p h p?<REMOVED>
The downloaded file is saved to the following location: C:\Temp
Analysis by Elda Dimakiling
Prevention