Need help? Ask the community or hire an expert.
Go to Avira Answers
Nume:TR/Cossta.lzr
Descoperit pe data de:16/02/2011
Tip:Troian
ITW:Da
Numar infectii raportate:Scazut spre mediu
Potential de raspandire:Scazut spre mediu
Potential de distrugere:Scazut spre mediu
Fisier static:Da
Marime:26.624 Bytes
MD5:2089b0f682a8fcd79665a9644150998b
Versiune VDF:7.10.08.215
Versiune IVDF:7.11.03.121 - miercuri, 16 februarie 2011

 General Metoda de raspandire:
   • Functia autorun


Alias:
   •  Mcafee: Artemis!2089B0F682A8
   •  Kaspersky: Trojan.Win32.Cossta.lzr
   •  Bitdefender: Trojan.Generic.5229936
   •  Panda: Bck/Hupigon.LLS
   •  GData: Trojan.Generic.5229936


Sistem de operare:
   • Windows 2000
   • Windows XP
   • Windows 2003


Efecte secundare:
   • Creeaza fisiere malware
   • Modificari in registri
   • Profita de vulnerabilitatile softului
      •  CVE-2007-1204
      •  MS07-019

 Fisiere Se copiaza in urmatoarele locatii:
   • %HOME%\Application Data\engel\updates.exe
   • %unitate disc%\mousedriver.exe



Este creat fisierul:

%unitate disc%\autorun.inf Acesta este un fisier text care nu prezinta pericol si are urmatorul continut:
   • %cod care ruleaza fisierul malitios%




Incearca se execute urmatorul fisier:

– Numele fisierului:
   • %SYSDIR%\netsh.exe" advfirewall firewall add rule name="%fisier executat%" dir=in action=allow program="%directorul de activare malware%\%fisier executat%"

 Registrii sistemului Urmatoarea cheie este adaugata in registri pentru a rula procesul la repornirea sistemului:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "engel"="%HOME%\Application Data\updates\updates.exe"



Creeaza urmatoarea valoare, pentru a trece de Windows XP firewall:

– [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\
   FirewallPolicy\StandardProfile]
   • "EnableFirewall"=dword:0x00000000



Se adauga in registrii sistemului:

– [HKCU\Software\Microsoft\Internet Explorer\Main]
   • "DHCP"="1973614"
   • "DNS"=""

 Injectarea codului malware in alte procese – Injecteaza o rutina backdoor intr-un proces.

    Numele procesului:
   • netsh.exe


 Alte informatii Acceseaza resurse de pe internet:
   • http://88.183.145.188/**********;
      http://85.65.176.74/**********;
      http://189.192.200.139/**********;
      http://82.131.26.101/**********;
      http://186.210.129.86/**********;
      http://81.57.215.203/**********;
      http://116.73.120.158/**********;
      http://85.204.169.5/**********;
      http://81.39.177.208/**********;
      http://75.133.44.131/**********;
      http://24.7.229.177/**********;
      http://123.237.42.130/**********;
      http://95.172.110.199/**********;
      http://109.248.37.211/**********;
      http://70.71.190.92/**********;
      http://203.184.2.124/**********;
      http://63.248.102.39/**********;
      http://210.207.211.28/**********;
      http://195.3.229.6/**********;
      http://118.168.198.216/**********;
      http://58.9.40.76/**********;
      http://84.95.100.151/**********;
      http://201.250.143.227/**********;
      http://77.231.34.6/**********;
      http://61.90.124.143/**********;
      http://119.152.52.106/**********;
      http://173.59.254.75/**********;
      http://201.253.112.237/**********;
      http://118.165.7.206/**********;
      http://217.132.110.8/**********;
      http://186.122.241.86/**********;
      http://84.23.135.227/**********;
      http://109.182.62.94/**********;
      http://208.81.160.62/**********;
      http://111.248.202.188/**********;
      http://58.9.49.223/**********;
      http://187.106.13.158/**********;
      http://117.205.35.133/**********;
      http://119.152.99.28/**********;
      http://117.102.33.21/**********;
      http://93.80.23.24/**********;
      http://187.89.41.174/**********;
      http://190.220.60.143/**********;
      http://201.29.8.233/**********;
      http://190.48.147.167/**********;
      http://187.3.112.114/**********;
      http://118.34.56.143/**********;
      http://113.193.184.102/**********;
      http://201.83.236.154/**********;
      http://116.71.185.112/**********;
      http://84.252.53.238/**********;
      http://88.171.207.2/**********;
      http://213.209.162.104/**********;
      http://213.186.183.4/**********;
      http://87.254.142.57/**********;
      http://85.204.47.87/**********;
      http://62.103.174.192/**********


Mutex:
Creeaza urmatorul mutex:
   • Ms32Dll

 Detaliile fisierului Limbaj de programare:
Limbaj de programare folosit: C (compilat cu Microsoft Visual C++).


Compresia fisierului:
Pentru a ingreuna detectia si a reduce marimea fisierului, este folosit un program de compresie runtime.

Description inserted by Petre Galan on Tuesday, April 19, 2011
Description updated by Petre Galan on Tuesday, April 19, 2011

Back . . . .