TROJ_LUKICSEL.AH
Trojan:Win32/Lukicsel.E (Microsoft), Win32/Lukicsel.W trojan (NOD32), W32/Pakes.QKK!tr (Fortinet), Trojan.Win32.Pakes (Ikarus), Trojan.Win32.Pakes (Sunbelt)
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
TECHNICAL DETAILS
370,176 bytes
EXE
03 Aug 2012
Arrival Details
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Installation
This Trojan drops the following files:
- %System%\crt.dat
- %System%\dll.dll
- %System%\mdhcp32.dll
- %System%\shimg.dll
- %Current%\xn1m2
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
Autostart Technique
This Trojan adds the following registry entries to enable its automatic execution at every system startup:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon\
Notify\mdhcp32