TROJ_KRYPTIK.BMP

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information. However, as of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Temp%\label.exe
• %User Temp%\ethnet.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
IEHelpService = "%User Temp%\label.exe"

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
MsUpdate = %User Temp%\ethnet.exe

Download Routine

This Trojan accesses the following websites to download files:

• http://www.{BLOCKED}mb.com.tw/image.bmp

It saves the files it downloads using the following names:

• %User Temp%\{Random Characters}.bmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Trend Micro detects the dowloaded file as:

• TROJ_KRYPTIK.BMP

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}.{BLOCKED}.207.84/ms.htm?id={Random}
• http://{BLOCKED}.{BLOCKED}.207.84:53/ms.htm?id={Random}
• http://{BLOCKED}.{BLOCKED}.157.251/ms.htm?id={Random}

However, as of this writing, the said sites are inaccessible.

NOTES:

It decrypts the downloaded file and the encrypted file is saved as %User Temp%\{Random Characters}.tmp.