TROJ_TRACUR.B

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %Application Data%\76487-699-1423605-23312517C.manifest
• %Application Data%\76487-699-1423605-23312517O.manifest
• %Application Data%\76487-699-1423605-23312517P.manifest
• %Application Data%\76487-699-1423605-23312517S.manifest
• %System%\{random}32.dll

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System% is the Windows system folder, which is usually C:\Windows\System32.)

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify
{random} =

It adds the following registry entries as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\{random}
Startup = "EventStartup"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\{random}
DllName = "%System%\{random}32.dll"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer
{random} = "{Hex Values}"

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}ggym.com/conn
• {BLOCKED}.{BLOCKED}.93.190/conn
• {BLOCKED}ime.com/conn