TROJ_RANSOM.ESQ

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes the initially executed copy of itself. It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %User Temp%\{random}.pre - delete afterwards

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following files:

• %User Temp%\{random folder}\{random}.exe

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %User Temp%\{random folder}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It injects codes into the following process(es):

• svchost.exe
• explorer.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "%User Temp%\{random folder}\{random}.exe"

Information Theft

This Trojan gathers the following data:

• OS Version
• Location
• Malware ID

Other Details

This Trojan deletes the initially executed copy of itself

It deletes itself after execution.

NOTES:

This malware sends the gathered information in the following format:

• http://{Domain Name}/inbox.php?ltype=ld&ccr=1&id={malware ID}&stat=0&ver={OS Version}&loc={Location}&os={OS Version}

The {Domain Name} can be any of the following:

• http://{BLOCKED}czxrz.com
• http://{BLOCKED}vwieg.com
• http://{BLOCKED}webspace-apo.com
• http://{BLOCKED}onlines.com
• http://{BLOCKED}-online.com
• http://{BLOCKED}ysolderxx.com
• http://{BLOCKED}irect-proxy.com
• http://{BLOCKED}k-gt.com