Virus:TR/Hosts.BD
Date discovered:23/08/2010
Type:Trojan
Subtype:Hosts
In the wild:Yes
Reported Infections:Medium
Distribution Potential:Low to medium
Damage Potential:Medium
Static file:Yes
File size:126.976 Bytes
MD5 checksum:efaa4cad70db7d08aa32ba670260a0d5
IVDF version:7.10.11.01 - Monday, August 23, 2010

 General Method of propagation:
   • No own spreading routine


Aliases:
   •  Symantec: W32.Pilleuz
   •  Mcafee: Artemis!EFAA4CAD70DB
   •  Kaspersky: Email-Worm.Win32.Joleee.fee
   •  PCTools: Malware.Pilleuz
   •  Eset: Win32/VB.PFT
   •  AhnLab: Win-Trojan/Seint.126976.E
   •  Authentium: W32/Trojan2.NDBD
   •  DrWeb: Trojan.MulDrop1.42701
   •  Fortinet: W32/Agent.E880!tr
   •  Ikarus: Trojan.SuspectCRC


Platforms / OS:
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003
   • Windows Vista
   • Windows Server 2008
   • Windows 7


Side effects:
   • Drops a file
   • Infects files
   • Lowers security settings
   • Registry modification

 Files It copies itself to the following locations:
   • %SYSDIR%\syscache.exe
   • %system drive%\%current directory%\%executed file%



It modifies the following file:
   • %SYSDIR%\drivers\etc\hosts



It deletes the initially executed copy of itself.



The following file is created:

– %WINDIR%\%executed file name%.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.

 Registry One of the following values is added in order to run the process after reboot:

–  [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   • "%executed file name%"="%SYSDIR%\syscache.exe"

 Hosts The host file is modified as explained:

– In this case already existing entries remain unmodified.

– Access to the following domains are redirected to other destinations:
   • 127.0.0.1 download82.avast.com; 127.0.0.1 mcafeefans.com;
      127.0.0.1 www.trapware.com; 127.0.0.1
      http://downloads1.kaspersky-labs.com; 127.0.0.1 u40.eset.com;
      127.0.0.1 sunbelt-software.com; 127.0.0.1 www.kztechs.com;
      127.0.0.1 forum.jiangmin.com; 127.0.0.1
      dnl-kr15.kaspersky-labs.com; 127.0.0.1 u51.eset.com; 127.0.0.1
      download83.avast.com; 127.0.0.1 media.fastclick.net; 127.0.0.1
      www.trendmicro.com; 127.0.0.1 http://downloads2.kaspersky-labs.com;
      127.0.0.1 u41.eset.com; 127.0.0.1 sygate.com; 127.0.0.1
      www.lavasoft.nu; 127.0.0.1 f-prot.com; 127.0.0.1
      dnl-kr2.kaspersky-labs.com; 127.0.0.1 u52.eset.com; 127.0.0.1
      download84.avast.com; 127.0.0.1 microsoft.com; 127.0.0.1
      www.trendmicro.com.cn; 127.0.0.1
      http://downloads3.kaspersky-labs.com; 127.0.0.1 u42.eset.com;
      127.0.0.1 symantec.com; 127.0.0.1 www.lavasoftusa.com; 127.0.0.1
       fr.bitdefender.com; 127.0.0.1 dnl-kr3.kaspersky-labs.com;
      127.0.0.1 u53.eset.com; 127.0.0.1 download85.avast.com;
      127.0.0.1 microsoft.fr; 127.0.0.1 www.trendmicro.fr; 127.0.0.1
       http://downloads4.kaspersky-labs.com; 127.0.0.1 u43.eset.com;
      127.0.0.1 symantec-ese.baynote.net; 127.0.0.1
      www.liutilities.com; 127.0.0.1 fr.drweb.com; 127.0.0.1
      dnl-kr4.kaspersky-labs.com; 127.0.0.1 u54.eset.com; 127.0.0.1
      download9.quickheal.com; 127.0.0.1 mirror02.gdata.de; 127.0.0.1
      www.uk.trendmicro-europe.com; 127.0.0.1 http://nod32.com; 127.0.0.1
       u44.eset.com; 127.0.0.1 tds.diamondcs.com.au; 127.0.0.1
      www.liveupdate.symantec.com; 127.0.0.1 fr.mcafee.com; 127.0.0.1
      dnl-kr5.kaspersky-labs.com; 127.0.0.1 u55.eset.com; 127.0.0.1
      download900.avast.com; 127.0.0.1 mmsk.cn; 127.0.0.1
      www.update.symantec.com; 127.0.0.1 bitdefender.secyber.net;
      127.0.0.1 u45.eset.com; 127.0.0.1 threatexpert.com


 File details Programming language:
 The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

Description inserted by Carlos Valero Llabata on Tuesday, August 24, 2010
Description updated by Carlos Valero Llabata on Tuesday, August 24, 2010

Back . . . .