Full description

Virus:	TR/Drop.Muha.462027
Date discovered:	17/12/2008
Type:	Trojan
Subtype:	Dropper
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low to medium
Damage Potential:	Low
Static file:	Yes
File size:	462.050 Bytes
MD5 checksum:	4f30003916cc70fca3ce6ec3f0ff1429
IVDF version:	7.01.00.249 - Wednesday, December 17, 2008

General Method of propagation:
   • Autorun feature

Aliases:
   • Mcafee: W32/Autorun.worm.h
   • Sophos: W32/AHKHeap-A
   • Panda: W32/AHKHeap.A.worm
   • Eset: Win32/AHKHeap.A
   • Bitdefender: Win32.Worm.Ahkheap.C

Platforms / OS:
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Drops malicious files
   • Registry modification

Files It copies itself to the following location:
   • %drive%\MicrosoftPowerPoint.exe

The following files are created:

– C:\heap41a\offspring\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %drive%\autorun.inf This is a non malicious text file with the following content:
   • %code that runs malware%

– %TEMPDIR%\MicrosoftPowerPoint\svchost.exe
– C:\heap41a\Icon.ico
– C:\heap41a\script1.txt Further investigation pointed out that this file is malware, too. Detected as: TR/AutoHK.A

– C:\heap41a\drivelist.txt
– %TEMPDIR%\MicrosoftPowerPoint\Install.txt Further investigation pointed out that this file is malware, too. Detected as: TR/Agent.aoe.1

– C:\heap41a\2.mp3
– %TEMPDIR%\MicrosoftPowerPoint\drivelist.txt
– C:\heap41a\std.txt Further investigation pointed out that this file is malware, too. Detected as: Worm/AHKHeap.B

– C:\heap41a\svchost.exe
– C:\heap41a\reproduce.txt Further investigation pointed out that this file is malware, too. Detected as: Worm/AHKHeap.C

– %TEMPDIR%\MicrosoftPowerPoint\Icon.ico
– %TEMPDIR%\MicrosoftPowerPoint\2.mp3
– %TEMPDIR%\MicrosoftPowerPoint\pathlist.txt Further investigation pointed out that this file is malware, too. Detected as: Worm/AHKHeap.A

Registry The following registry key is added:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\
   Run]
   • "status"="present"
   • "winlogon"="C:\heap41a\svchost.exe C:\heap41a\std.txt"

The following registry key is changed:

– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
   Folder\Hidden\SHOWALL]
   New value:
   • "checkedvalue"=dword:0x00000000

File details Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with a runtime packer.

说明添加者： Petre Galan 打开 2010年3月11日星期四
说明更新者： Petre Galan 打开 2010年3月11日星期四

反馈 . . . .

我的帐户