 |
|
 |
|
DizzyX
Administrator
Data inscrierii: 16/Iul/2008
Mesaje: 48
|
|
 |
|
 |
|
 Trimis: 16/07/2008 01:59 Titlul subiectului: Trojan.Boaxxe.D |
 |
|
Trojan.Boaxxe.D
( TrojanDropper:Win32/Boaxxe.D Win32.Podnuha.dl )
Raspandire : mediu
Dauna : tare scazut
Size: ~135KB
Descoperit : 2008 Jun 18
[[URL=http://imageshack.us] [/URL]
[URL=http://imageshack.us] [/URL]
[URL=http://imageshack.us] [/URL]
[URL=http://g.imageshack.us/g.php?h=244&i=pic3xx7.png] [/URL]
Regardless of the user's option, Internet Explorer then opens the download site for the afore mentioned software.
TECHNICAL DESCRIPTION:
At execution he will drop a dll file in %WINDIR%\system32\ with a name like other dll in that directory with the difference that this name hasn't the last letter of the original dll name.
For example: if he choose "advpack.dll" from %WINDIR%\system32\ then he will drop a dll with name "advpac.dll"
Then malware register itself as a BHO (Browser Helper Object) by creating the following registry key with a random CLSID:
HKCR\CLSID\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\InprocServer32
(Default)="path to the dll file"
It also creates the following registry keys to mark the presence of specific versions of this malware:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu
These keys contain the encrypted version, CLSID and install path of the malware. If an older version is detected, it is replaced by the new one.
On Internet Explorer execution the dll file is loaded and the following links are accessed:
http:///ppc/config.phpchk
http:///ppc/config.php?v=18&u=2868&acln=en-us&s=about:blank&sch=n
All the traffic is encrypted and server sends in header of all replies:
"Content-Type: image/gif"
maybe to fool firewalls and other intrusion detection systems that server sends just a picture. |
|
FAQ 
Mesaje private 
