Viral label:
Viral name: Trojan-Downloader.Win32.Small.xwr
Viral type: Wooden horse
Document MD5: FEFEC24CF9C0E4D1E26498A09D7ED159
Public scope: Completely public
Harm rank: 3
Document length: Adds the shell latter 9,728 bytes to peel off the shell the latter 41,984 bytes
Infection system: Windows98 above edition
Development kit: Borland Delphi 6.0 - 7.0
Adds the shell type: UPX 0.89.6 - 1.02/1.05 - 1.24
Viral description:
This virus for downloading class wooden horse, after viral movement, derivation virus document DesktopWin.dll to %Windir%
Under \ AppPatch; The additional registry item, founds the CLSID value, the increase start item, in
Under the ShellServiceObjectDelayLoad key increases the DesktopWin key value, when system initiation uses
The Explorer.exe advancement autoloading virus module, and searches under this whether to have the JavaView key value, if exists,
Then deletion; Transfers rundll32.exe by the command line way, founds %Windir% by rundll32.exe
\ AppPatch \ AclLayer.dll document; After this virus carries out own code, will finish own advancement, in
%System32% grows unxxx.bat, the goal is to delete this viral document and oneself; The linked network, downloads in a big way
Measures the viral document and moves in this aircraft.
Behavioral analysis:
Local behavior:
1st, after document movement, will release the following document:
%Windir% \ AppPatch \ AclLayer.dll 9,728 bytes
%Windir% \ AppPatch \ DesktopWin.dll 14,336 bytes
2nd, additional registry:
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID
\ {DA191DE0-AA86-4ED0-4B87-292A3D48BE99}
\ InProcServer32]
Registration tabular value: “@”
Type: REG_SZ
String of character: “C:\WINDOWS\AppPatch\DesktopWin.dll”
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID
\ {DA191DE0-AA86-4ED0-4B87-292A3D48BE99}
\ InProcServer32]
Registration tabular value: “ThreadingModel”
Type: REG_SZ
String of character: “Apartment”
Description: Registers the CLSID value
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft
\ Windows \ CurrentVersion
\ ShellServiceObjectDelayLoad]
Registration tabular value: “DesktopWin”
Type: REG_SZ
String of character: “{DA191DE0-AA86-4ED0-4B87-292A3D48BE99}”
Description: When system initiation uses the Explorer.exe advancement autoloading virus module
3rd, in [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion
\ ShellServiceObjectDelayLoad] under the key searches whether to have JavaView, if has this item,
Then deletion.
4th, transfers rundll32.exe by the command line way, founds by rundll32.exe
%Windir% \ AppPatch \ AclLayer.dll document.
5th, when after this virus carries out own code, will finish own advancement, in %System32% grew unxxx.bat,
Other pages: : 1 * 2 * 3 * 4 * Next>>
|
You are here: hacking technology
> the virus to be related
> Content
Category: Home
> the virus to be related