TROJ_INJECT.JDT

This {malware/spyware type} has received attention from independent media sources and/or other security firms.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

This Trojan may be downloaded by other malware/grayware from remote sites. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan may be downloaded by the following malware/grayware from remote sites:

• JS_SHELLCOD.JDT

However, as of this writing, the said sites are inaccessible.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Temp%\mshmail.exe
• %User Temp%\svchost.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following files:

• %User Temp%\wshiph.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
mshmail = %User Temp%\mshmail.exe -installkys

Download Routine

This Trojan accesses the following websites to download files:

• https://www.{BLOCKED}kor.com/asp/kys_allow_get.asp?name=getkys.dat

Other Details

Based on analysis of the codes, it has the following capabilities:

• This file may be executed using the following switches:
  • removekys
  • installkys
• It copies the creation date and time of the legitimate svchost.exe and uses it to set the following file's creation time:
  • %User Temp%\svchost.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)