TROJ_MULJER.A

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives as an attachment to email messages spammed by other malware/grayware or malicious users.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Application Data%\ejmmcqrz\ryvqpam.exe - (hidden)
• %Application Data%\ejmmcqrz\npkoehlv.exe - (hidden)

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

It creates the following folders:

• %Application Data%\ejmmcqrz

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Grouping Error Helper Play Topology = "%Application Data%\ejmmcqrz\ryvqpam.exe"

Dropping Routine

This Trojan drops the following files:

• %Application Data%\ejmmcqrz\ryvqpam.wtkb0

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming on Windows Vista and 7.)

NOTES:

This Trojan's process uses the watchdog technique, making it persistent.

It combines two words from its list where it queries for a mailing address. Below is the format:

• {word1}{word2}.net/forum/search.php?email=aj.abdelkhalek.r96x@statefarm.com&method=post

Wherein {word1} and {word2} could be any of the following:

• above
• action
• advance
• afraid
• against
• airplane
• almost
• alone
• already
• although
• always
• amount
• anger
• angry
• animal
• another
• answer
• appear
• apple
• around
• arrive
• article
• attempt
• banker
• basket
• battle
• beauty
• became
• because
• become
• before
• begin
• behind
• being
• believe
• belong
• beside
• better
• between
• beyond
• bicycle
• board
• borrow
• bottle
• bottom
• branch
• bread
• bridge
• bright
• bring
• broad
• broken
• brought
• brown
• building
• built
• business
• butter
• captain
• carry
• catch
• caught
• century
• chair
• chance
• character
• charge
• chief
• childhood
• children
• choose
• cigarette
• circle
• class
• clean
• clear
• close
• clothes
• college
• company
• complete
• condition
• consider
• contain
• continue
• control
• corner
• country
• course
• cover
• crowd
• daughter
• decide
• degree
• delight
• demand
• desire
• destroy
• device
• difference
• different
• difficult
• dinner
• direct
• discover
• distance
• distant
• divide
• doctor
• dollar
• double
• doubt
• dress
• dried
• during
• early
• eearly
• effort
• either
• electric
• electricity
• english
• enough
• enter
• escape
• evening
• every
• except
• expect
• experience
• explain
• family
• famous
• fancy
• father
• fellow
• fence
• fifteen
• fight
• figure
• finger
• finish
• flier
• flower
• follow
• foreign
• forest
• forever
• forget
• fortieth
• forward
• found
• fresh
• friend
• further
• future
• garden
• gather
• general
• gentle
• gentleman
• glass
• glossary
• goodbye
• govern
• guard
• happen
• health
• heard
• heart
• heaven
• heavy
• history
• honor
• however
• hunger
• husband
• include
• increase
• indeed
• industry
• inside
• instead
• journey
• kitchen
• known
• labor
• ladder
• language
• large
• laugh
• laughter
• leader
• leave
• length
• letter
• likely
• listen
• little
• machine
• manner
• market
• master
• material
• matter
• mayor
• measure
• meeting
• member
• method
• middle
• might
• million
• minute
• mister
• modern
• morning
• mother
• mountain
• movement
• nation
• nature
• nearly
• necessary
• needle
• neighbor
• neither
• niece
• night
• north
• nothing
• notice
• number
• object
• oclock
• office
• often
• opinion
• order
• orderly
• outside
• paint
• partial
• party
• people
• perfect
• perhaps
• period
• person
• picture
• pleasant
• please
• pleasure
• position
• possible
• power
• prepare
• present
• president
• pretty
• probable
• probably
• problem
• produce
• promise
• proud
• public
• quarter
• question
• quiet
• rather
• ready
• realize
• reason
• receive
• record
• remember
• report
• require
• result
• return
• ridden
• right
• river
• round
• safety
• school
• season
• separate
• service
• settle
• severa
• several
• shake
• share
• shore
• short
• should
• shoulder
• shout
• silver
• simple
• single
• sister
• smell
• smoke
• soldier
• space
• speak
• special
• spent
• spread
• spring
• square
• station
• still
• store
• storm
• straight
• strange
• stranger
• stream
• street
• strength
• strike
• strong
• student
• subject
• succeed
• success
• sudden
• suffer
• summer
• supply
• suppose
• surprise
• sweet
• system
• therefore
• thick
• think
• third
• those
• though
• thought
• through
• thrown
• together
• toward
• trade
• train
• training
• travel
• trouble
• trust
• twelve
• twenty
• understand
• understood
• until
• valley
• value
• various
• wagon
• water
• weather
• welcome
• wheat
• whether
• while
• white
• whose
• window
• winter
• within
• without
• woman
• women
• wonder
• worth
• would
• write
• written
• yellow

It displays the following fake error message: