SHA1 1572f907a18e341de253240f7a4f5bd242f8f1f1
The Trojan is distributed by means of Trojan.LoadMoney.336. It uses the following libraries:
- OpenSSL (1.0.1j),
- std,
- jsoncpp.
The main purpose of this Trojan is to install different extensions for Chrome.
Once launched, the malicious program checks command-line parameters. If the Trojan does not receive the command line, it reads parameters from the myfile%:args and %myfile%.args files. If the command line is received, the Trojan saves it to the mentioned files.
The malicious program can receive the following command-line parameter:
- source—URL of the Chrome extension (the Trojan downloads it to the %TEMP%\ folder and then saves it with a random %rnd%.crx name).
Once the command line is parsed, Trojan.LoadMoney.915 registers itself under a random name in the HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce registry branch and deletes %myfile%:Zone.Identifier. Next time the Trojan is launched, it reads all the necessary parameters from the file.
