TROJ_DLOADR.YZA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes then deletes itself afterward.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Temp%\{Malware File Name}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It executes then deletes itself afterward.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
PID = "%User Temp%\{Malware File Name}.exe"

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}ran.ru/forum/dl/ots.php?seller=3&hash={54DF9570-BEF0-473F-BD64-78E5AC580A09}
• http://{BLOCKED}ran.ru/forum/dl/getapp.php?seller=3&hash={54DF9570-BEF0-473F-BD64-78E5AC580A09}
• http://www.{BLOCKED}ne.cn/newweb/mokao/images/build.exe
• http://{BLOCKED}ran.ru/forum/dl/getruns.php?seller=3&hash={54DF9570-BEF0-473F-BD64-78E5AC580A09}&ahash=fbd4c632a0dc8fafc0f43fa7aee17e64

It saves the files it downloads using the following names:

• %User Temp%\{Random File Name}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.