TROJ_DOFOIL.AU

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It executes then deletes itself afterward. It may be injected into processes running in memory.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\170316.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It executes then deletes itself afterward.

It may be injected into processes running in memory.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Policies\
Explorer\Run
Winternals = "%Application Data%\170316.exe"

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}36531.ru/xxx/index.php
• http://{BLOCKED}1.{BLOCKED}4.237.139

NOTES:
It attempts to access the said websites to download possibly malicious files. As a result, malicious routines of downloaded files may also be exhibited on the affected system.