TR/Proxy.Ranky.EI.1 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Proxy.Ranky.EI.1
Date discovered:	21/02/2006
Type:	Trojan
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	61.440 Bytes
MD5 checksum:	64abbfc626189f3101aabe09ddcfcb95
VDF version:	6.33.01.05 - Sat, 18 Feb 2006 14:34 (GMT+1)

General Method of propagation:
   • No own spreading routine

Alias:
   • Kaspersky: Trojan-Proxy.Win32.Ranky.ei

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Registry modification
   • Third party control

Registry The following registry key is added in order to run the process after reboot:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
• SmartTesting = %malware execution directory%\%executed file%

Backdoor The following port is opened:

– explorer.exe on a random TCP port in order to provide a proxy server.

Contact server:
One of the following:
   • http://rogerr.homeunix.net/**********
   • http://vcdf.hopto.org/**********
   • http://omygodd.net/**********
   • http://roger.bounceme.net/**********
   • http://dnsme.mine.nu/**********
   • http://dnsmze.mine.nu/**********

As a result it may send some information. This is done via the HTTP GET request on a PHP script.
The servers answer is written to the file: C:\photos.jpg

Sends information about:
    • Opened port

Miscellaneous Mutex:
It creates the following Mutex:
• AllAlone

Trusted file pretending:
Its process pretends to be the following trusted process: %WINDIR%\explorer.exe
Please note that the malware even fakes the icon. As a result it appears to be the above mentioned process.

File details Programming language:
The malware program was written in MS Visual C++.

Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• NTPacker

See a brief description here.

Description inserted by Andrei Gherman on Tue, 21 Feb 2006 16:30 (GMT+1)
Description updated by Andrei Gherman on Wed, 22 Feb 2006 08:53 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back