TROJ_GORIADU.DRP

This Trojan drops files detected by Trend Micro as:

• TROJ_GORIADU.SMX
• TROJ_GORIADU.SMW
• TROJ_GORIADU.SMC
• TROJ_GORIADU.SMY
• TROJ_GORIADU.SMM

It creates folders. It creates registry key.

This Trojan may be dropped by other malware.

Arrival Details

This Trojan may be dropped by the following malware:

• TROJ_GORIADU.SMX

Installation

This Trojan drops the following files:

• %Program Files%\baidu\newnetgar.dll - detected as TROJ_GORIADU.SMW
• %Program Files%\baidu\spass.dll - detected as TROJ_GORIADU.SMC
• %Program Files%\baidu\passthru.dll - detected as TROJ_GORIADU.SMY
• %Program Files%\baidu\netsf.inf - NDIS miniport driver configuration file
• %Program Files%\baidu\netsf_m.inf - NDIS miniport driver configuration file
• %Program Files%\baidu\sumpod-nos.sys - detected as TROJ_GORIADU.SMM
• %Program Files%\baidu\sumpod.sys - detected as TROJ_GORIADU.SMM
• %Program Files%\baidu\SysDat.bin - TROJ_GORIADU.SMC configuration file
• %Program Files%\baidu\msfsg.exe - detected as TROJ_GORIADU.SMX
• %Program Files%\baidu\dsetup.exe - detected as TROJ_GORIADU.SMX

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It creates the following folders:

• %Program Files%\baidu

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

Other Details

This Trojan does the following:

• It executes the file dsetup.exe, which installs the dropped components to the %System% directory.
• The file dsetup.exe copies the configuration file of TROJ_GORIADU.SMM to the %Windows%\inf folder. It then copies the file sumpod.sys, which is detected as TROJ_GORIADU.SMM in the %System%\drivers directory. It registers sumpod.sys as a system service by creating the following registry key:
  

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Passthru

• It then copies and executes the following files to the %System% folder:
  
  • passthru.dll to passthru.dll
  • newnetgar.dll to idecomp.dll
• It creates a folder named %System%\hardpol. It then creates and executes a copy of spass.dll and saves it as hardpol.dll. The new file, hardpol.dll, is also detected as TROJ_GORIADU.SMM.
• It also creates the folder MyIEData in the created folder. It then copies the configuration file of TROJ_GORIADU.SMM into MyIEData.
• TROJ_GORIADU.DRP deletes the initially dropped files in the %Program Files% directory after executing dsetup.exe.

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %Program Files% is the default Program Files folder, usually C:\Program Files.)