arrow_back
search
close

PTCH_KATUSHA.W

October 14, 2013
 Analysis by: kathleenno
 Modified by: Christopher Daniel So
 ALIASES:

Virus:Win32/Patchload.O (Microsoft), W32/Katusha (McAfee)

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW


These are legitimate executable files whose code has been altered by another malware to serve as an autostart mechanism for the other malware.

It checks whether the main malware is already running by attempting to open a device object named ACPI#PNP0303#2&da1a3ff&0. Getting the error STATUS_VALIDATE_CONTINUE (0xC0000271) indicates that the main malware is already running.

If the malware is not yet running, it then decrypts the encrypted main malware file %System%\c_{random 5 digit number}.nls and writes the decrypted file to %System%\c_{random 5 digit number}.nl_. The decrypted file is then executed. As a result, the malicious routines of the main malware are exhibited in the affected system.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

04 Jun 2011

NOTES:

These are legitimate executable files whose code has been altered by another malware to serve as an autostart mechanism for the other malware.

It checks whether the main malware is already running by attempting to open a device object named ACPI#PNP0303#2&da1a3ff&0. Getting the error STATUS_VALIDATE_CONTINUE (0xC0000271) indicates that the main malware is already running.

If the malware is not yet running, it then decrypts the encrypted main malware file %System%\c_{random 5 digit number}.nls and writes the decrypted file to %System%\c_{random 5 digit number}.nl_. The decrypted file is then executed. As a result, the malicious routines of the main malware are exhibited in the affected system.

  SOLUTION

Minimum Scan Engine:

8.900

FIRST VSAPI PATTERN FILE:

8.202.04

FIRST VSAPI PATTERN DATE:

04 Jun 2011

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

Scan your computer with your Trend Micro product to clean files detected as PTCH_KATUSHA.W. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.


Did this description help? Tell us how we did.