TROJ_INJECT.CPX

This Trojan may be dropped by other malware.

Arrival Details

This Trojan may be dropped by the following malware:

• TROJ_PIDIEF.KGM

Installation

This Trojan creates the following folders:

• {Malware Path}\{random}
• %User Temp%\Low

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• JKDFHIUEJDH
• HDIWJDGHWJK

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

• http://{BLOCKED}loner.es/index.php

It saves the files it downloads using the following names:

• %User Temp%\Low\cr{random}.tmp - renamed to {Malware Path}\lbarhelp32.dll
• %User Temp%\Low\ia{random}.tmp - renamed to {Malware Path}\lbarext32.dll

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

NOTES:

This Trojan checks if the file is injected to the following applications:

• chrome.exe
• facebookmessenger.exe
• firefox.exe
• icq.exe
• iexplore.exe
• jucheck.exe
• jusched.exe
• miranda32.exe
• msmsgs.exe
• msnmsgr.exe
• opera.exe
• outlook.exe
• pidgin.exe
• skype.exe
• thunderbird.exe
• winmail.exe
• yahoomessenger.exe
• yahoom~1.exe