Threat behavior
Trojan:Win32/Riberow.A is a trojan that gathers information about the infected system, which it sends back to a remote attacker.
Installation
Trojan:Win32/Riberow.A arrives in the system as two files: an EXE and a DLL component. The EXE file is presented as a fake Microsoft security update with varying file names. It has the following version information:
CompanyName = ""
ProductName = "Microsoft Security Patch"
OriginalFilename = "wins"
In the wild, this trojan may be present as 'wins.exe', 'rtskin.exe' or 'winver32.exe'. Win32/Riberow.A also drops the following files:
- <system folder>\iconpop.dll - DLL component
- <system folder>\prof.dat - file to which the trojan writes its gathered information
- <system folder>\list.txt
- <system folder>\ffffz<random characters>.tmp
Note - <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP and Vista is C:\Windows\System32.
It injects itself into the Windows Explorer (explorer.exe) and Internet Explorer (iexplore.exe) processes. It then restarts IE.
Payload
Steals System Information
Trojan:Win32/Riberow.A gathers the computer name and IP address, and writes it into its dropped file prof.dat.
It may then attempt to connect to the following websites to send the gathered information:
- www.microsoft-xpupdate.com (fake Microsoft website)
- www.neosilba.com
It may also send the gathered information via email to curl_by_daniel@haxx.se.
Modifies Internet Settings
Trojan:Win32/Riberow.A locks the IE toolbar and deletes the user's Favorites by modifying the following registry entries:
Adds value: "Locked"
With data: "1"
To subkey: HKCU\Software\Microsoft\Internet Explorer\Toolbar
Adds value: "Order"
With data: "."
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\Links
Analysis by Jaime Wong
Prevention