TROJ_KRYPTK.YRV
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
111,464 bytes
EXE
28 Feb 2014
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Other System Modifications
This Trojan adds the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\{random}
HKEY_CURRENT_USER\SOFTWARE\{random}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\1_RASAPI32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\1_RASMANCS
It adds the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\{random}
License = "951"
HKEY_CURRENT_USER\SOFTWARE\{random}
License = "951"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\1_RASAPI32
EnableFileTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\1_RASAPI32
EnableConsoleTracing = "0"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\1_RASAPI32
FileTracingMask = "4294901760"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\1_RASAPI32
ConsoleTracingMask = "4294901760"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\1_RASAPI32
MaxFileSize = "1048576"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Tracing\1_RASAPI32
FileDirectory = "%Windows%\Tracing"
Other Details
This Trojan connects to the following possibly malicious URL:
- {BLOCKED}t-18.com/b/shoe/951
- {BLOCKED}a-coil.com/lib89.47/jquery/