TROJ_ZKRYPT.SMIH
PLATFORM:
Windows 2000, Windows XP, Windows Server 2003
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan modifies the affected system's HOSTS files. This prevents users from accessing certain websites.
TECHNICAL DETAILS
File Size:
Varies
File Type:
EXE
File Compression:
UPX
Memory Resident:
Yes
Initial Samples Received Date:
10 May 2011
Installation
This Trojan drops the following files:
- %system%\b.dll - detected by Trend Micro as BKDR_SHIZ.CLY
- %system%\dll
- %WINDOWS%\Temp\explorer.dat
- %WINDOWS%\Temp\winlogon.dat
Other System Modifications
This Trojan modifies the following file(s):
- %System%\dllcache\explorer.exe - detected by Trend Micro as PTCH_BAMITAL.WQ
- %System%\dllcache\winlogon.exe - detected by Trend Micro as PTCH_BAMITAL.WQ
(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)
HOSTS File Modification
This Trojan adds the following strings to the Windows HOSTS file:
- 127.0.0.1 akamai.avg.com
- 127.0.0.1 antivir.es
- 127.0.0.1 anti-virus.by
- 127.0.0.1 avast.com
- 127.0.0.1 avg.com
- 127.0.0.1 avp.com
- 127.0.0.1 avp.ru
- 127.0.0.1 avp.ru/download/
- 127.0.0.1 avpg.crsi.symantec.com
- 127.0.0.1 backup.avg.cz
- 127.0.0.1 bancoguayaquil.com
- 127.0.0.1 bcpzonasegura.viabcp.com
- 127.0.0.1 bitdefender.com
- 127.0.0.1 clamav.net
- 127.0.0.1 comodo.com
- 127.0.0.1 customer.symantec.com
- 127.0.0.1 dispatch.mcafee.com
- 127.0.0.1 download.mcafee.com
- 127.0.0.1 download.microsoft.com
- 127.0.0.1 downloads.microsoft.com
- 127.0.0.1 downloads1.kaspersky-labs.com
- 127.0.0.1 downloads1.kaspersky-labs.com/products/
- 127.0.0.1 downloads1.kaspersky-labs.com/updates/
- 127.0.0.1 downloads2.kaspersky-labs.com
- 127.0.0.1 downloads2.kaspersky-labs.com/products/
- 127.0.0.1 downloads2.kaspersky-labs.com/updates/
- 127.0.0.1 downloads3.kaspersky-labs.com
- 127.0.0.1 downloads3.kaspersky-labs.com/products/
- 127.0.0.1 downloads3.kaspersky-labs.com/updates/
- 127.0.0.1 downloads4.kaspersky-labs.com
- 127.0.0.1 downloads4.kaspersky-labs.com/products/
- 127.0.0.1 downloads4.kaspersky-labs.com/updates/
- 127.0.0.1 downloads5.kaspersky-labs.com
- 127.0.0.1 downloads5.kaspersky-labs.com/products/
- 127.0.0.1 downloads5.kaspersky-labs.com/updates/
- 127.0.0.1 drweb.com
- 127.0.0.1 emsisoft.com
- 127.0.0.1 eset.com
- 127.0.0.1 eset.com/
- 127.0.0.1 eset.com/download/index.php
- 127.0.0.1 eset.com/joomla/
- 127.0.0.1 eset.com/products/index.php
- 127.0.0.1 eset.es
- 127.0.0.1 fortinet.com
- 127.0.0.1 f-prot.com
- 127.0.0.1 f-secure.com
- 127.0.0.1 gdata.es
- 127.0.0.1 go.microsoft.com
- 127.0.0.1 hacksoft.com.pe
- 127.0.0.1 ikarus.at
- 127.0.0.1 kaspersky.com
- 127.0.0.1 kaspersky.ru
- 127.0.0.1 kaspersky-labs.com
- 127.0.0.1 liveupdate.symantec.com
- 127.0.0.1 liveupdate.symantecliveupdate.com
- 127.0.0.1 macafee.com
- 127.0.0.1 mast.mcafee.com
- 127.0.0.1 mcafee.com
- 127.0.0.1 microsoft.com
- 127.0.0.1 msdn.microsoft.com
- 127.0.0.1 my-etrust.com
- 127.0.0.1 networkassociates.com
- 127.0.0.1 nod32.com
- 127.0.0.1 norman.com
- 127.0.0.1 norton.com
- 127.0.0.1 nprotect.com
- 127.0.0.1 pandasecurity.com
- 127.0.0.1 pandasoftware.com
- 127.0.0.1 pctools.com
- 127.0.0.1 pif.symantec.com
- 127.0.0.1 pifmain.symantec.com
- 127.0.0.1 rads.mcafee.com
- 127.0.0.1 rising-global.com
- 127.0.0.1 scanner.novirusthanks.org
- 127.0.0.1 secure.nai.com
- 127.0.0.1 securityresponse.symantec.com
- 127.0.0.1 service1.symantec.com
- 127.0.0.1 sophos.com
- 127.0.0.1 sunbeltsoftware.com
- 127.0.0.1 support.microsoft.com
- 127.0.0.1 symantec.com
- 127.0.0.1 symantec.com/updates
- 127.0.0.1 threatexpert.com
- 127.0.0.1 trendmicro.com
- 127.0.0.1 u2.eset.com
- 127.0.0.1 u20.eset.com
- 127.0.0.1 u3.eset.com
- 127.0.0.1 u3.eset.com/
- 127.0.0.1 u4.eset.com
- 127.0.0.1 u4.eset.com/
- 127.0.0.1 u7.eset.com
- 127.0.0.1 update.avg.com
- 127.0.0.1 update.microsoft.com
- 127.0.0.1 update.symantec.com
- 127.0.0.1 updates.symantec.com
- 127.0.0.1 updates1.kaspersky-labs.com
- 127.0.0.1 updates2.kaspersky-labs.com
- 127.0.0.1 updates3.kaspersky-labs.com
- 127.0.0.1 us.mcafee.com
- 127.0.0.1 viabcp.com
- 127.0.0.1 virscan.org
- 127.0.0.1 virusbuster.hu
- 127.0.0.1 viruslist.com
- 127.0.0.1 viruslist.ru
- 127.0.0.1 virusscan.jotti.org
- 127.0.0.1 virustotal.com
- 127.0.0.1 windowsupdate.microsoft.com
- 127.0.0.1 www.ahnlab.com
- 127.0.0.1 www.aladdin.com
- 127.0.0.1 www.antivir.es
- 127.0.0.1 www.antiy.net
- 127.0.0.1 www.authentium.com
- 127.0.0.1 www.avast.com
- 127.0.0.1 www.avg.com
- 127.0.0.1 www.avp.com
- 127.0.0.1 www.avp.ru
- 127.0.0.1 www.avp.ru/download/
- 127.0.0.1 www.bitdefender.com
- 127.0.0.1 www.clamav.net
- 127.0.0.1 www.comodo.com
- 127.0.0.1 www.download.mcafee.com
- 127.0.0.1 www.drweb.com
- 127.0.0.1 www.emsisoft.com
- 127.0.0.1 www.eset.com
- 127.0.0.1 www.eset.com/
- 127.0.0.1 www.eset.com/download/index.php
- 127.0.0.1 www.eset.com/joomla/
- 127.0.0.1 www.eset.com/products/index.php
- 127.0.0.1 www.fortinet.com
- 127.0.0.1 www.f-prot.com
- 127.0.0.1 www.f-secure.com
- 127.0.0.1 www.gdata.es
- 127.0.0.1 www.grisoft.com
- 127.0.0.1 www.ikarus.at
- 127.0.0.1 www.kaspersky.com
- 127.0.0.1 www.kaspersky.ru
- 127.0.0.1 www.kaspersky-labs.com
- 127.0.0.1 www.macafee.com
- 127.0.0.1 www.mcafee.com
- 127.0.0.1 www.microsoft.com
- 127.0.0.1 www.my-etrust.com
- 127.0.0.1 www.networkassociates.com
- 127.0.0.1 www.nod32.com
- 127.0.0.1 www.norman.com
- 127.0.0.1 www.norton.com
- 127.0.0.1 www.nprotect.com
- 127.0.0.1 www.pandasecurity.com
- 127.0.0.1 www.pandasoftware.com
- 127.0.0.1 www.pctools.com
- 127.0.0.1 www.rising-global.com
- 127.0.0.1 www.scanner.novirusthanks.org
- 127.0.0.1 www.sophos.com
- 127.0.0.1 www.sunbeltsoftware.com
- 127.0.0.1 www.symantec.com
- 127.0.0.1 www.symantec.com/updates
- 127.0.0.1 www.trendmicro.com
- 127.0.0.1 www.virscan.org
- 127.0.0.1 www.viruslist.com
- 127.0.0.1 www.viruslist.ru
- 127.0.0.1 www.virusscan.jotti.org
- 127.0.0.1 www.virustotal.com
- 127.0.0.1 www.windowsupdate.microsoft.com