Category: Malware
Type: Backdoor
Affected Operating Systems: Windows
Summary
A remote administration utility which bypasses normal security mechanisms to secretly control a program, computer or network.
Installation
This malware installs a rootkit onto the system. In addition to hiding its presence on the system, the rootkit is able to inject a dropped file into a process, which is then able to function as a backdoor program.
During installation, this malware creates a copy of the file %System%\ADVAPI32.DLL as:
%Temp%\TDSS%randchar2%.tmp.
It then modifies this file with 21 bytes at the entry point, in order to load the file %Temp%\TDSS%randchar1%.tmp. A number of additional changes must take place for this to occur.
First, the malware deletes the "\KnownDlls\advapi32.dll" section object of the Windows Operating System, in order to remove the legitimate advapi32.dll. The section object is then recreated and linked to the %Temp%\TDSS%randchar2%.tmp file. It then stops and restarts the "MSISERVER" Windows service, which subsequently loads the %Temp%\TDSS%randchar2% file.
The cumulative effect of these changes causes %Temp%\TDSS%randchar1%.tmp to be loaded as a Windows service, which then creates a file, %systemdir%\drivers\TDSServ.sys. This sys file is the actual rootkit driver file. The rootkit hides all its files, as well as registry components beginning with the string 'TDSS'.
The loaded rootkit driver then drops a dll file in the %systemdir% as "TDSSl.dll". It injects the dropped file into SVCHOST.EXE and tries to connects to a number of websites, which are still live at time of writing.
The injected dll can also function as a backdoor, which may be commanded to perform any of the following routines:
Download and execute programs
Display pop-up advertisements
NOTE:
TDSS%randchar1%.tmp is the first temporary file created with random characters added as part of the filename
TDSS%randchar2%.tmp is the second temporary file created with different random characters added as part of the filename
File System Changes
Creates these files:
%Temp%\TDSS%randchar1%.tmp
%Temp%\TDSS%randchar2%.tmp
Process Changes
Creates these mutexes:
\TdlStartMutex
Network Connections
Attempts to connect with HTTP to:
hxxp://findxproportal1.com/tdss2/[...]/main
hxxp://stableclickz1.com/tdss2/[...]/main
hxxp://updatemics1.com/tdss2/[...]/main
hxxp://findsproportal1.com/tdss2/[...]/main
hxxp://findzproportal1.com/tdss2/[...]/main
hxxp://91.203.92.121/tdss2/[...]/main
hxxp://youblognews.net/tdss/[...]/main
Registry Modifications
The rootkit driver is registered with the key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys
It may also create the following registry subkeys:
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\versions
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\injector
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS\connections
The malware creates the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, build = "standart"
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, type = "clicker"
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, affid = "5"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata, affid = "5"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata, subid = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, subid = "1"
HKEY_LOCAL_MACHINE\SOFTWARE\TDSS, serversdown = [dword value]
A mutex is then created so that only one copy of the malware will reside in memory at any given session.
Removal
If you are using Sophos please follow the below link for removal instructions.
http://www.sophos.com/en-us/support/knowledgebase/17026.aspx
If the Sophos scan does not work please try using the following guide (please note this is not written by Wavenet Education or LGfL so it is used at your own risk).
