Win32/Chroject

Installation

The trojan copies itself as either:

• %LOCALAPPDATA% \<random name>\<random letters>.exe
• %LOCALAPPDATA% \<random name>\<random letters>.dll

For example, we have seen Chroject copy itself to:

• %LOCALAPPDATA%\Adobe\sihziheazvl.exe
• %LOCALAPPDATA%\Google\Xgyzbukxvjut.exe

It installs a local copy of Google Chrome into the %LOCALAPPDATA% older with a random file name.

It then drops a Chrome extension that is used in conjunction with the click fraud into the same folder.

Depending on the Chroject variant, it sets itself to run automatically each time you start your PC by setting one of the following registry key patterns:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value “<random letters>”
With data: “%LOCALAPPDATA%\<random name>\<random letters>.exe”

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Sets value “<random letters>”
With data: “regsvr32.exe /s%LOCALAPPDATA%\<random name>\<random letters>.dll”

Payload

Contacts remote hosts 

The malware can contact the following remote hosts as part of its click fraud payload: 

• hxxp://216.172.63.18/board/PggJa2QPaUhWBwYKEgwGChIPEg==
• hxxp://198.37.112.235/io/3+noioXuiKm35ufr8+3n6/Pv8w== 
• hxxp://199.182.165.2/news/v4mI6uWO6MnXhoeLk42Hi5OOkw==

Uses your PC to perform click fraud

This threat can use your PC for click fraud.

It runs multiple hidden Chrome instances in the background, navigating the web performing clickfraud. This will significantly reduce the performance of your PC, and will use a large amount of bandwidth.

Analysis by Geoff McDonald