A two-component Trojan consisting of a downloader written in Delphi and a dynamic-link library with the payload. The Trojan verifies that the process name contains "vcnost.e". If the process is not launched from "vcnhost.e", the malware kills all processes containing svcnost in their names.
The Trojan replicates itself to %APPDATA%\x%RND31%\svcnost.exe, where %RND31% indicates a string containing 31 random characters. Then it registers the path to svcnost.exe in the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Init branch. After that, the malware renames %APPDATA%\x%RND31% into %APPDATA%\x%RND31%2.
The Trojan launches its copy. If it is run with administrator privileges, the Trojan modifies the system registry to bypass protection of Windows Firewall and rewrites the hosts file to block access to websites of anti-virus software developers. Moreover, the downloader loads the library with the payload into the RAM granting it control.
The Trojan reads a value from the HKCU\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\SavedLegacySettingsML branch and, if an error occurs, adds 9 random digits to the value as the bot's identifier.
The library responsible for interaction with SSL is saved to %APPDATA%\desktop.ini.
The ZLIB library is saved to %APPDATA%\ntuser.dat.
The Trojan contains a code to retrieve account details for MS Outlook, The Bat!, and Windows autofill service.
Trojan.Spambot.11349 sends repetitive requests to random IP addresses chosen based on a special algorithm from the list of resources stored in the Trojan's body. After that, the Trojan establishes a connection to one of three command and control servers whose addresses are encrypted and stored in the library. Then the malicious program awaits the reply containing a configuration file.
By sending email messages containing random characters from the infected computer, the Trojan checks whether it is possible to send out spam. If the check is successful, the malicious program receives from a remote server necessary data to conduct spam mailings.
