TROJ_KRAP.SMZQ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
kr_done1 = 4eea355c

Dropping Routine

This Trojan drops the following files:

• %User Temp%\qas1.tmp
• %System%\kr_done1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}e.com/
• http://kdzjzcmmyl.{BLOCKED}1.in/{random path}

It deletes the initially executed copy of itself

This report is generated via an automated analysis system.