TROJ_KRYPTIK.DOI

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Dropping Routine

This Trojan drops the following files:

• %Application Data%\ipatwbkn.exe
• %System Root%\2806bb4aeb84d49be7015be0d05a0d2c3712.txt

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}.143.107:8090/{random path}
• http://{BLOCKED}.229.162:8080/{random path}
• http://{BLOCKED}115.220:8080/{random path}
• http://{BLOCKED}.14.197:8080/{random path}
• http://{BLOCKED}.205.55:8080/{random path}
• http://{BLOCKED}.32.99:8080/{random path}
• http://{BLOCKED}115.219:8080/{random path}
• http://{BLOCKED}.128.254:8090/{random path}

It deletes itself after execution.

This report is generated via an automated analysis system.