Analysis by: Roland Marco Dela Paz
ALIASES:

Kaspersky : Trojan.Win32.Swisyn.afrk; Sophos : Mal/VB-S

 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

However, as of this writing, the said sites are inaccessible.

  TECHNICAL DETAILS

File Size: 10/12/2009 bytes
File Type: PE
Memory Resident: Yes
Initial Samples Received Date: 12 Oct 2009

Arrival Details

However, as of this writing, the said sites are inaccessible.

Installation

This Trojan drops the following copies of itself into the affected system:

  • %WINDOWS%\winlogon.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Winlogon = %WINDOWS%\winlogon.exe

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Winlogon = %WINDOWS%\winlogon.exe

Other Details

This Trojan connects to the following possibly malicious URL:

  • http://{BLOCKED}ru.net/DATA
  • http://{BLOCKED}ru.net/DOZ
  • http://{BLOCKED}ru.net/SYN