TROJ_SERVSTAR.DY

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Program Files%\7rar\{random numbers}.jpg
• %Program Files%\7rar\WinHodx32.exe

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It creates the following folders:

• %Program Files%\7rar

(Note: %Program Files% is the default Program Files folder, usually C:\Program Files.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• {abc-_-cba}

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\WinHtwg33
ImagePath = "%Program Files%\7rar\WinHodx32.exe"

Other Details

This Trojan deletes the initially executed copy of itself

NOTES:

It connects to the following site to report its installation:

• {BLOCKED}xiaozu.3322.org

It checks if the following process is running:

• ksafe.exe

If the said process is found, it removes the device associated with the following CLSID:

• {4d36e972-e325-11ce-bfc1-08002be10318}

The said CLSID is related to the network adapter device. Removing a device will delete the device's hardware and software registry keys and any hardware-profile-specific registry keys. This routine will prevent the user from accessing the internet.