TROJ_INJECTOR.SS
October 09, 2012
PLATFORM:
Windows 2000, Windows XP, Windows Server 2003
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
TECHNICAL DETAILS
File Size: 17,925 bytes
File Type: EXE
Memory Resident: No
Initial Samples Received Date: 08 Jun 2011
Installation
This Trojan drops the following copies of itself into the affected system:
- %User Profile%\Local Settings\VSS.exe
(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)
Autostart Technique
This Trojan adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
VSS = %User Profile%\Local Settings\VSS.exe
Other Details
This Trojan connects to the following possibly malicious URL:
- http://{BLOCKED}.{BLOCKED}.58.243/akbht.php?id=000636111D307928DD
- http://{BLOCKED}.{BLOCKED}.58.243/akbht.php?id=023160111D307928DD
- http://{BLOCKED}.{BLOCKED}.58.243/kysba.php?id=013106111D307928DD
- http://{BLOCKED}.{BLOCKED}.58.243/kysba.php?id=023287111D307928DD