TROJ_CHEPVIL

This description is based on a compiled analysis of several variants of TROJ_CHEPVIL. Note that specific data such as file names and registry values may vary for each variant.

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. However, as of this writing, the said sites are inaccessible.

It bears the file icons of certain applications to avoid easy detection and consequent removal. It executes then deletes itself afterward.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

However, as of this writing, the said sites are inaccessible.

Installation

This Trojan bears the file icons of the following applications:

• PDF Document

It executes then deletes itself afterward.

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}llis.com/blood.exe
• http://{BLOCKED}llis.com/ftp/g.php
• http://{BLOCKED}dfjnf.ru/blood.exe
• http://{BLOCKED}dfjnf.ru

NOTES:

This description is based on a compiled analysis of several variants of TROJ_CHEPVIL. Note that specific data such as file names and registry values may vary for each variant.