KATUSHA

KATUSHA Trojans typically arrive via spammed email messages or as files downloaded unknowingly by users when visiting malicious sites. It is used to download and execute other malicious files.

In 2010, a spam run that poses as an IT notification contained a KATUSHA variant as an attachment. Cybercriminals also used this malware to launch attacks on the users of the social networking site/blogging platform Multiply.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
{malware name} = "{malware path}\{malware name}.exe"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\RunServices
{malware name} = "{malware path}\{malware name}.exe"

Other System Modifications

This Trojan adds the following registry keys as part of its installation routine:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
MediaPlayer\Setup\Files

Other Details

This Trojan connects to the following possibly malicious URL:

• http://http-{BLOCKED}ting.us/httpss/v={random numbers}&step={random numbers}&hostid={random numbers}
• http://domain-{BLOCKED}u.com/httpss/v={random numbers}&step={random numbers}&hostid={random numbers}
• http://website-{BLOCKED}b.us/httpss/v={random numbers}&step={random numbers}&hostid={random numbers}
• http://http{BLOCKED}ck.us/httpss/v={random numbers}&step={random numbers}&hostid={random numbers}
• http://http-{BLOCKED}p.co.cc/httpss/v={random numbers}&step={random numbers}&hostid={random numbers}