TROJ_UFRAIE.AB
October 09, 2012
PLATFORM:
Windows 2000, Windows XP, Windows Server 2003
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan drops files when executed.
It connects to website(s) to download and execute a malicious file.
TECHNICAL DETAILS
File Size: 25,600 bytes
File Type: EXE
Memory Resident: No
Initial Samples Received Date: 16 May 2011
Installation
This Trojan drops the following files:
- %User Temp%\kr_done1
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)
Download Routine
This Trojan connects to the following website(s) to download and execute a malicious file:
- http://{BLOCKED}rldmap.com/{BLOCKED}see/out/12.exe
Other Details
This Trojan connects to the following URL(s) to check for an Internet connection:
- http://google.com/
SOLUTION
Minimum Scan Engine: 8.900
FIRST VSAPI PATTERN FILE: 8.160.06
FIRST VSAPI PATTERN DATE: 16 May 2011
NOTES:
Did this description help? Tell us how we did.