TROJ_HILOTI.JZ

This Trojan may be downloaded by other malware/grayware/spyware from remote sites. It may be unknowingly downloaded by a user while visiting malicious websites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Trojan may be downloaded by other malware/grayware/spyware from remote sites.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Windows%\{random}.dll

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• 8f347b5f
• dd250d3b
• {random}

It injects itself into the following processes as part of its memory residency routine:

• explorer.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "rundll32.exe {malware path and filename},Startup"

Other System Modifications

This Trojan adds the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\{random}

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Information Theft

This Trojan does not have any information-stealing capability.

NOTES:

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Other Details

Upon execution, it creates a DLL-converted copy of itself in %Windows% directory using a random file name. It then sets the file time of the DLL similar to that of user32.dll.

It executes the malware copy using the following command:

• rundll32 {DLL copy},Startup

It accesses the following URL to download an updated copy of itself or another malware:

• {date-time}.{BLOCKED}zy.net/get2.php

The downloaded file is saved as %Windows%\{random}. When executed, the routines of the downloaded file are also exhibited on the system.

Currently, the said URL is inaccessible.

This Trojan does not exploit any vulnerability.