Analysis by: Al Victor de Leon
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

  TECHNICAL DETAILS

File Size: 7,926,507 bytes
File Type: EXE
Initial Samples Received Date: 18 Jun 2014

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Trojan connects to the following possibly malicious URL:

  • ns.{BLOCKED}omain.com

NOTES:

It enumerates the entries in the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It then overwrites the files referenced in these registries with copies of itself.

It also overwrites the all running process, except system files, with the copy of itself. The legitimate files are saved as {filename}, the extension is deleted with the hidden attribute.