Virus: TR/Drop.Agent.uws Date discovered: 26/02/2009 Type: Trojan Subtype: Dropper In the wild: Yes Reported Infections: Low to medium Distribution Potential: Low to medium Damage Potential: Low to medium Static file: Yes File size: 104.459 Bytes MD5 checksum: c86abd1d526e6eb03f27a7cc4b397d4e IVDF version: 7.01.02.84 - Thursday, February 26, 2009
General Method of propagation: • Autorun feature Aliases: • Mcafee: Generic PWS.ak trojan • Sophos: Troj/PWS-AYM • Panda: W32/Lineage.KOS • Eset: Win32/PSW.OnLineGames.NMY • Bitdefender: Trojan.PWS.OnLineGames.KCNF Platforms / OS: • Windows 2000 • Windows XP • Windows 2003 Side effects: • Downloads malicious files • Drops malicious files • Lowers security settings • Registry modification Files It copies itself to the following location: • %drive% \tvlx2fg.exe The following files are created: – %drive% \autorun.inf This is a non malicious text file with the following content: • %code that runs malware% – %SYSDIR% \optyhww0.dll Further investigation pointed out that this file is malware, too. Detected as: TR/PSW.OnLineGa.wnx – %SYSDIR% \urretnd.exe Further investigation pointed out that this file is malware, too. Detected as: TR/Drop.Agent.ahdz – %TEMPDIR% \ker1.tmp Further investigation pointed out that this file is malware, too. Detected as: TR/Drop.OnLi.123904 – %drive% \d1vmq.exe Further investigation pointed out that this file is malware, too. Detected as: TR/Drop.Agent.ahdz – %SYSDIR% \optyhww1.dll Further investigation pointed out that this file is malware, too. Detected as: TR/Crypt.XPACK.Gen It tries to download some files: – The location is the following: • http://vfgtyp.com/fm4/********** Further investigation pointed out that this file is malware, too. – The location is the following: • http://vbfdt.com/fm4/********** Further investigation pointed out that this file is malware, too. Registry One of the following values is added in order to run the process after reboot: – [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] • "cbvcs"="%SYSDIR% \urretnd.exe" The following registry key is added: – [HKLM\SOFTWARE\Classes\CLSID\MADOWN] • "urlinfo"="afvbgy.m" The following registry keys are changed: – [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ Connections] New value: • "DefaultConnectionSettings"=hex:46,00,00,00,05,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,70,89,60,1E,B4,66,CA,01,00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,C0,A8,6B,64,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00 – [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] New value: • "Hidden"=dword:0x00000002 • "ShowSuperHidden"=dword:0x00000000 – [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ Folder\Hidden\SHOWALL] New value: • "CheckedValue"=dword:0x00000000 File details Runtime packer: In order to aggravate detection and reduce size of the file it is packed with a runtime packer.
Description inserted by Petre Galan on Monday, November 16, 2009 Description updated by Andrei Ivanes on Monday, November 23, 2009
Back
.
.
.
.