SHA1:
- eb7c08ef01c4eba0a1cb2edb06dde6b7f5e9383d (rar)
- f4cf382939aaf7f76a5cbf81c525dab2a26a4d5e (Чит wallhackwh для CS GO {steam no steam}.exe)
- 785e2807132889d886d2794eb576c5ff2571e852 (new-node.bin)
- f4a0d14e862c6d7de28096a2662ae08fcb89679d (work.js)
Description
A module of the MonsterInstall trojan. An enhanced version of Trojan.MonsterInstall.7.
Operating routine
The new version supports string encryption. Decryption algorithm:
def decrypt(d):
s = ''
for i in range(len(d)/4):
s += chr((int(d[i*4:(i+1)*4], 10)+20) & 0xff)
return s
The trojan creates the "Global\cortel-install" mutex to prevent identical components from operating simultaneously.
It then unpacks the contents of data\new-node.bin in %WINDIR%\NodeService\0\ using a 7z executable file:
data/7za.exe x data/new-node.bin -o"%WINDIR%\NodeService\0\" –yFor new-node.bin, password protection has been added.
new-node.bin launches:
%WINDIR%/NodeService/0/node.exe %WINDIR%/NodeService/0/install.js
%WINDIR%/NodeService/0/node.exe data/work.js
The work.js file reads data.json and opens the link specified in the “link” field.
install.js writes the component versions in the registry:
[HKLM\\SOFTWARE\\Microsoft\\MoonTitle\\starter] 'version' = [0,0,0,2] [HKLM\\SOFTWARE\\Microsoft\\MoonTitle\\worker] 'version' = [0,0,0,2] Then the trojan uses the Windows Scheduler to add itself to the autorun list under the name MoonTitle.
