Author: Jed Valderama   
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVER ALL RISK RATING:
 DAMAGE POTENTIAL::
 DISTRIBUTION POTENTIAL::
 REPORTED INFECTION:
Low
Medium
High
Critical

  • Threat Type:
    Trojan

  • Destructiveness:
    No

  • Encrypted:
     

  • In the wild::
    Yes

  OVERVIEW


  TECHNICAL DETAILS

File size: 164,352 bytes
File type: EXE
INITIAL SAMPLES RECEIVED DATE: 25 de июня de 2012

Instalación

Crea las siguientes copias de sí mismo en el sistema afectado:

  • %System%\{random filename}.exe

(Nota: %System% es la carpeta del sistema de Windows, que en el caso de Windows 98 y ME suele estar en C:\Windows\System, en el caso de Windows NT y 2000 en C:\WINNT\System32 y en el caso de Windows XP y Server 2003 en C:\Windows\System32).

)

Técnica de inicio automático

Añade las siguientes entradas del registro de Image File Execution Options para ejecutarse a sí mismo cuando se ejecutan determinadas aplicaciones:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Image File Execution Options\
userinit.exe
Debugger = "{random filename}.exe"

Otras modificaciones del sistema

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\203E7401
B5C9 = "dword:00000000"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
5.0\203E7401
@ = "{hex values}"

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings
GlobalUserOffline = "dword:00000000"

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Internet Settings\Connections
DefaultConnectionSettings = "{hex values}"

Modifica las siguientes entradas de registro:

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
Cookies = "%System%\config\systemprofile\Cookies"

(Note: The default value data of the said registry entry is %System Root%\Documents and Settings\NetworkService\Cookies.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
Cache = "%System%\config\systemprofile\Local Settings\Temporary Internet Files"

(Note: The default value data of the said registry entry is %System Root%\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files.)

HKEY_USERS\.DEFAULT\Software\
Microsoft\Windows\CurrentVersion\
Explorer\Shell Folders
History = "%System%\config\systemprofile\Local Settings\History"

(Note: The default value data of the said registry entry is %System Root%\Documents and Settings\NetworkService\Local Settings\History.)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\3
1609 = "dword:00000000"

(Note: The default value data of the said registry entry is dword:00000001.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths
Directory = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path1
CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path2
CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache2.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path3
CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache3.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Internet Settings\
Cache\Paths\path4
CachePath = "%System%\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

(Note: The default value data of the said registry entry is %Temporary Internet Files%\Content.IE5\Cache4.)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Epoch
Epoch = "dword:00000091"

(Note: The default value data of the said registry entry is dword:0000008e.)