VirTool:WinNT/Bohu.A

VirTool:WinNT/Bohu.A is a kernel-mode malicious rootkit driver registered by TrojanDropper:Win32/Bohu.B. It is used to monitor registry keys pertaining to the malware and to prevent security processes from executing.

Installation

VirTool:WinNT/Bohu.A is installed as a service by TrojanDropper:Win32/Bohu.B as the following file:

• <system folder>\studomn\TimerWorks.sys

Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

It is registered as a service with the creation of the following entry:

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\TimerWorks
Sets value: "ImagePath"
With data: "<system folder>\studomn\TimerWorks.sys

Payload

Checks for the presence of another malware
When executed, VirTool:WinNT/Bohu.A checks if the system references objects with the following strings:

• Registry\Machine\Software\Bieke
• \Device\TimerWorks
• \DosDevices\TimerWorks

These strings are associated with the installation routine of TrojanDropper:Win32/Bohu.B.

Terminates processes
VirTool:WinNT/Bohu.A calls certain kernel APIs to terminate security-related processes and unload modules such as the following:

• Kingsoft AntiVirus
• 360 Safe

Analysis by Marianne Mallen