TR/Popwin.A.1 - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Popwin.A.1
Date discovered:	10/10/2006
Type:	Trojan
In the wild:	No
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low to medium
Static file:	Yes
File size:	14.827 Bytes
MD5 checksum:	0E2a899b15af30b35fbae47c750C0Dc1
VDF version:	6.36.00.69 - Fri, 29 Sep 2006 16:07 (GMT+1)
IVDF version:	6.36.00.83 - Mon, 09 Oct 2006 08:37 (GMT+1)

General Method of propagation:
   • No own spreading routine

Aliases:
   • Kaspersky: Trojan.Win32.Agent.zg
   • Sophos: Troj/PopWin-A
   • Bitdefender: Generic.Malware.Sdldspg.3725E1C5

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a file
   • Drops files
   • Drops a malicious file
   • Registry modification

Files It copies itself to the following locations:
   • %SYSDIR%\PopWin.exe
   • %SYSDIR%\PopTWin.exe

It deletes the initially executed copy of itself.

The following files are created:

– %SYSDIR%\PopWin.dll Furthermore it gets executed after it was fully created. Further investigation pointed out that this file is malware, too. Detected as: TR/Popwin.A

– %SYSDIR%\delme.bat Furthermore it gets executed after it was fully created. This batch file is used to delete a file.

It tries to download a file:

– The location is the following:
   • http://www.win.xmpd.net/popwin/**********
It is saved on the local hard drive under: %SYSDIR%\update.web This file may contain further download locations and might serve as source for new threats.

Registry The following registry keys are added in order to load the service after reboot:

– [HKLM\SYSTEM\CurrentControlSet\Services\PopWinIe]
   • "Type"=dword:00000010
   • "Start"=dword:00000002
   • "ErrorControl"=dword:00000001
   • "ImagePath"="%SYSDIR%\PopWin.exe -service"
   • "DisplayName"="PopWinIe"
   • "ObjectName"="LocalSystem"
   • "Description"="%random character string%"

– [HKLM\SYSTEM\CurrentControlSet\Services\PopWinIe\Security]
   • "Security"=%hex values%

– [HKLM\SYSTEM\CurrentControlSet\Services\PopWinIe\Enum]
   • "0"="Root\\LEGACY_POPWINIE\\0000"
   • "Count"=dword:00000001
   • "NextInstance"=dword:00000001

Process termination The active processes memory is searched for the following strings. If successful the processes become terminated.:
   • qqkav; agentsvr; frogagent; kvxp; kvsrvxp; kregex; kvcenter; kvmon;
      uihost; KVSrvXP_1; KVSrvXP; KvXP; KVMonXP; vsmon; vptray; rtvscan;
      Navap; Norton; Symantec; webscanx; vsstat; vshwin32; alogserv;
      avsynmgr; avconsol; Iparmor; KWatch; KPfwSvc; KMailMon; KavPFW;
      KAVStart; KAVSvc; KULANSyn; KPopMon; KWatchUI; KAVPlus; rfwsrv;
      RAVMON; rfwmain; RAVTIMER; RAV.exe; RavStub; Ravmond; CCENTER;
      RsCCenter

Injection – It injects the following file into a process: %SYSDIR%\PopWin.dll

    All of the following processes:
   • winlogon.exe
   • explorer.exe

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

See a brief description here.

Description inserted by Monica Ghitun on Tue, 10 Oct 2006 09:09 (GMT+1)
Description updated by Andrei Ivanes on Fri, 27 Oct 2006 09:45 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back