 |
|
 |
|
DizzyX
Administrator
Data inscrierii: 16/Iul/2008
Mesaje: 48
|
|
 |
|
 |
|
 Trimis: 16/07/2008 02:26 Titlul subiectului: Trojan.Loader.N |
 |
|
Trojan.Loader.N
( Trojan.Kobcka, Trojan-Downloader.Win32.Mutant, TrojanDownloader:Win32/Cutwail, Trojan.Pandex, Win32/Wigon )
Raspandire : mediu
Dauna : mediu
Size: ~ 12 kB
Descoperit : 2008 May 05
SYMPTOMS:
Increased network activity.
Presence of the specified files and registry keys.
TECHNICAL DESCRIPTION:
The virus acts like a loader for an encrypted PE file contained in the virus body. After the payload has been decrypted, the control of the program is passed to the contained executable.
After executed, the virus adds the registry value in order to run at every system start-up:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run = "advap32"
This contained malware file is detected as Trojan.Kobcka.DO and acts like a downloader. The malware tries several urls:
75.126.22.226 (citycentre2.dk)
75.125.207.50 (server.microlite18.com)
75.125.207.82 (server.host53.com)
208.66.195.71
208.66.194.236
using the HTTP 80 port, and downloads several other malware files known as:
Trojan.Kobcka.DT
Trojan.Downloader.Agent.ZJA.
These are stored as: "%Temp%\BN[random_digit].tmp", are executed and download other malware, as well.
The downloaded files are components of a SPAM bot trojan designed to launch massive SPAM attacks from the compromised system |
|
FAQ 
Mesaje private 
