TROJ_SHIZ.SMP1

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Windows%\apppatch\uukrggu.dat

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Autostart Technique

This Trojan modifies the following registry entries to ensure it automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
userinit = "%System%\userinit.exe,%Windows%\apppatch\uukrggu.dat,"

(Note: The default value data of the said registry entry is %Windows%\system32\userinit.exe,.)

Other System Modifications

This Trojan deletes the following files:

• %User Temp%\1.tmp
• %Windows%\SoftwareDistribution\DataStore\Logs\edbtmp.log

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
f0bdff95 = "%Windows%\apppatch\uukrggu.dat"

It deletes the following registry keys:

6“–_CHAR(0x13)__CHAR(0x04)_“#_CHAR(0x12)_¡_CHAR(0x17)_¥†6 ¡‚

Dropping Routine

This Trojan drops the following files:

• %Windows%\apppatch\uukrggu.dat
• lyvyxor.com
• gatyfus.com
• lyxylux.com
• gaqydeb.com
• galykes.com
• pupybul.com
• gahyhob.com
• gatyvyz.com
• gacyryw.com
• gaqycos.com
• vofygum.com
• gadyfuh.com
• vonyzuf.com
• lykyjad.com
• ganypih.com
• qekyqop.com

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}s.com/login.php
• http://{BLOCKED}r.com/login.php
• http://{BLOCKED}m.com/login.php
• http://{BLOCKED}v.com/login.php
• http://{BLOCKED}l.com/login.php
• http://{BLOCKED}h.com/login.php
• http://{BLOCKED}d.com/login.php
• http://{BLOCKED}t.com/login.php
• http://{BLOCKED}q.com/login.php
• http://{BLOCKED}z.com/login.php
• http://{BLOCKED}j.com/login.php
• http://{BLOCKED}f.com/login.php
• http://{BLOCKED}p.com/login.php
• http://{BLOCKED}b.com/login.php
• http://{BLOCKED}x.com/login.php
• http://{BLOCKED}k.com/login.php
• http://{BLOCKED}g.com/login.php
• http://{BLOCKED}w.com/login.php
• http://{BLOCKED}n.com/login.php
• http://{BLOCKED}c.com/login.php

This report is generated via an automated analysis system.