Fakerean_7 Malicious Fake Antivirus software

The SonicWALL UTM research team has seen an increase in Fake AV Malware. Such Malware attempts to scare users into buying Fake Antivirus software that performs fake scans and returns bogus results. Fakerean_7 (Trojan) is yet another piece of Malware that performs such malicious activity.

The Trojan performs the following DNS queries:

• {random 9-14 char domain}.com [we observed over 100 of these requests]
• microsoft.com

The Trojan uses a typical Windows installer icon and claims to have originated from Valve Corporation:

Upon infection the Trojan removes itself from the location it is run from. It then shows a fake virus scan informing the user that the system is infected with Malware:

Clicking the “register” button leads to the following page:

The Trojan will periodically show variations of the following pop-ups:

The Trojan creates the following files on the filesystem:

• C:Documents and SettingsAll UsersApplication Datac5t4g1kso4fl53 [Detected as GAV: Fakerean_7 (Trojan)]
• C:Documents and Settings{USER}Local SettingsApplication Datac5t4g1kso4fl53 [Detected as GAV: Fakerean_7 (Trojan)]
• C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe [Detected as GAV: Fakerean_7 (Trojan)]
• C:Documents and Settings{USER}Local SettingsTempc5t4g1kso4fl53 [Detected as GAV: Fakerean_7 (Trojan)]
• C:Documents and Settings{USER}Templatesc5t4g1kso4fl53 [Detected as GAV: Fakerean_7 (Trojan)]

The Trojan creates the following keys in the Windows registry:

Registry Spawning keys:

• HKEY_CLASSES_ROOT.exeDefaultIcon @ “%1”
• HKEY_CLASSES_ROOT.exeshellopencommand @ “”C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe” -a “%1″ %*”
• HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand @ “”C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe” -a “%1″ %*”
• HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand @ “”C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe” -a “%1″ %*”
• HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand IsolatedCommand “”%1″ %*”
• HKEY_CURRENT_USERSoftwareClassesexefileshellrunascommand @ “”%1″ %*”
• HKEY_CURRENT_USERSoftwareClassesexefileshellrunascommand IsolatedCommand “”%1″ %*”
• HKEY_USERSS-1-5-21-1993962763-1202660629-1957994488-1003_Classesexefileshellopencommand @ “”C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe” -a “%1″ %*”

Disabling firewall:

• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile EnableFirewall dword:00000000
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile DoNotAllowExceptions dword:00000000
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile DisableNotifications dword:00000001

The Trojan deletes the following keys from the Windows registry:

To disable Windows Automatic Updates:

• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WUAUSERV000 ClassGUID “{8ECC055D-047F-11D1-A537-0000F8753ED1}”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WUAUSERV000 DeviceDesc “Automatic Updates”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WUAUSERV000Control ActiveService “wuauserv”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswuauserv ImagePath hex “%systemroot%system32svchost.exe -k netsvcs”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswuauserv DisplayName “Automatic Updates”

SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

• GAV: Fakerean_7 (Trojan)

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.