TROJ_DLOADR.AKT

This Trojan copies the file time of EXPLORER.EXE and uses the the file time of %Windows%\Downloaded Program Files\ZipExt16.dll to avoid detection.

If a process named AVP.EXE exists, it will drop a system driver component as %User Temp%\atapi.sys. The said system file is used by the malware to avoid detection and will enable it to load into memory. The malware will delete this file after being used. This file is detected by Trend Micro as TROJ_AGENT.AGIO.

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats. As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• WORM_DROPPER.AKO

Installation

This Trojan drops the following component file(s):

• %Windows%\Downloaded Program Files\ZipExt16.dll - also detected as TROJ_DLOADR.AKT
• %System Root%\rising.hiv - used to create its auto-start registry entry. This will be deleted by the malware after execution.
• %User Temp%\rssb.bat - batch file used to delete the initiailly executed copy of the malware. This will also be deleted after execution.

(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.. %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %System%\atmd.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Its DLL component is injected to the following process(es):

• svchost.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
Explorer\Run
sysres = "atmd.exe"

Download Routine

This Trojan connects to the following malicious URLs:

• http://{BLOCKED}.197.148/ks2/log.asp?isnew={value}&LocalInfo={OS Version}&szHostName={computer name}&tmp3=tmp3

It connects to the following URL(s) to download its configuration file:

• http://{BLOCKED}.197.148/ks2/ks2.txt

It saves the files it downloads using the following names:

• %User Temp%\m.ini - this configuration file should contain the version of the malware and another URL where it will connect to download another possibly malicious file.

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

As of this writing, the said sites are inaccessible.

NOTES:

The file time of EXPLORER.EXE is copied by this malware and uses the the file time of %Windows%\Downloaded Program Files\ZipExt16.dll to avoid detection.

If a process named AVP.EXE exists, it will drop a system driver component as %User Temp%\atapi.sys. The said system file is used by the malware to avoid detection and will enable it to load into memory. The malware will delete this file after being used. This file is detected by Trend Micro as TROJ_AGENT.AGIO.