TR/Dldr.Small.buv - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Dldr.Small.buv
Date discovered:	01/11/2005
Type:	Trojan
Subtype:	Downloader
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	5.637 Bytes
MD5 checksum:	374BFA78A2B1539025D7E713C1D9A59F
VDF version:	6.32.00.128 - Tue, 01 Nov 2005 14:32 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Symantec: W32.Magflag.B
   • Mcafee: Downloader-ACS
   • Kaspersky: Trojan-Downloader.Win32.Vidlo.t
   • TrendMicro: TROJ_DLOADER.AMC

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads files

Files It copies itself to the following location:
   • %SYSDIR%\winldr.exe

It tries to download some files:

– The locations are the following:
   • http://sillahill.addr.com/**********/flg.exe
   • http://drummania.pri.ee/**********/instruments/flg.exe
   • http://www.dwtsys.de/**********/flags/flg.exe
   • http://www.servicedwt.com/**********/backgroung/de/flg.exe
   • http://www.hwguide.net/**********/flg.exe
   • http://zofox.com/**********/flg.exe
   • http://www.eestiklan.com/**********/icons/flg.exe
   • http://idex.colocall.com/**********/flg.exe
   • http://umbura.com/**********/flg.exe
At the time of writing this file was not online for further investigation.

– The locations are the following:
   • http://sillahill.addr.com/**********/winldr.ini
   • http://drummania.pri.ee/**********/instruments/winldr.ini
   • http://www.dwtsys.de/**********/flags/winldr.ini
   • http://www.servicedwt.com/**********/backgroung/de/winldr.ini
   • http://www.hwguide.net/**********/winldr.ini
   • http://zofox.com/**********/winldr.ini
   • http://www.eestiklan.com/**********/icons/winldr.ini
   • http://idex.colocall.com/**********/winldr.ini
   • http://umbura.com/**********/winldr.ini
At the time of writing this file was not online for further investigation.

Registry The following registry key is changed:

– [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
   Old value:
   • "Shell"="Explorer.exe"
   New value:
   • "Shell"="Explorer.exe winldr.exe"

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• FSG

See a brief description here.

Description inserted by Andrei Gherman on Wed, 02 Nov 2005 08:40 (GMT+1)
Description updated by Andrei Gherman on Wed, 02 Nov 2005 08:41 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back