arrow_back
search
close

TROJ_ZKRYPT.SMIH

October 16, 2013
 Analysis by: Sabrina Lei Sioting
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan modifies the affected system's HOSTS files. This prevents users from accessing certain websites.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

EXE

File Compression:

UPX

Memory Resident:

Yes

Initial Samples Received Date:

10 May 2011

Installation

This Trojan drops the following files:

  • %system%\b.dll - detected by Trend Micro as BKDR_SHIZ.CLY
  • %system%\dll
  • %WINDOWS%\Temp\explorer.dat
  • %WINDOWS%\Temp\winlogon.dat

Other System Modifications

This Trojan modifies the following file(s):

  • %System%\dllcache\explorer.exe - detected by Trend Micro as PTCH_BAMITAL.WQ
  • %System%\dllcache\winlogon.exe - detected by Trend Micro as PTCH_BAMITAL.WQ

(Note: %System% is the Windows system folder, which is usually C:\Windows\System32.)

HOSTS File Modification

This Trojan adds the following strings to the Windows HOSTS file:

  • 127.0.0.1 akamai.avg.com
  • 127.0.0.1 antivir.es
  • 127.0.0.1 anti-virus.by
  • 127.0.0.1 avast.com
  • 127.0.0.1 avg.com
  • 127.0.0.1 avp.com
  • 127.0.0.1 avp.ru
  • 127.0.0.1 avp.ru/download/
  • 127.0.0.1 avpg.crsi.symantec.com
  • 127.0.0.1 backup.avg.cz
  • 127.0.0.1 bancoguayaquil.com
  • 127.0.0.1 bcpzonasegura.viabcp.com
  • 127.0.0.1 bitdefender.com
  • 127.0.0.1 clamav.net
  • 127.0.0.1 comodo.com
  • 127.0.0.1 customer.symantec.com
  • 127.0.0.1 dispatch.mcafee.com
  • 127.0.0.1 download.mcafee.com
  • 127.0.0.1 download.microsoft.com
  • 127.0.0.1 downloads.microsoft.com
  • 127.0.0.1 downloads1.kaspersky-labs.com
  • 127.0.0.1 downloads1.kaspersky-labs.com/products/
  • 127.0.0.1 downloads1.kaspersky-labs.com/updates/
  • 127.0.0.1 downloads2.kaspersky-labs.com
  • 127.0.0.1 downloads2.kaspersky-labs.com/products/
  • 127.0.0.1 downloads2.kaspersky-labs.com/updates/
  • 127.0.0.1 downloads3.kaspersky-labs.com
  • 127.0.0.1 downloads3.kaspersky-labs.com/products/
  • 127.0.0.1 downloads3.kaspersky-labs.com/updates/
  • 127.0.0.1 downloads4.kaspersky-labs.com
  • 127.0.0.1 downloads4.kaspersky-labs.com/products/
  • 127.0.0.1 downloads4.kaspersky-labs.com/updates/
  • 127.0.0.1 downloads5.kaspersky-labs.com
  • 127.0.0.1 downloads5.kaspersky-labs.com/products/
  • 127.0.0.1 downloads5.kaspersky-labs.com/updates/
  • 127.0.0.1 drweb.com
  • 127.0.0.1 emsisoft.com
  • 127.0.0.1 eset.com
  • 127.0.0.1 eset.com/
  • 127.0.0.1 eset.com/download/index.php
  • 127.0.0.1 eset.com/joomla/
  • 127.0.0.1 eset.com/products/index.php
  • 127.0.0.1 eset.es
  • 127.0.0.1 fortinet.com
  • 127.0.0.1 f-prot.com
  • 127.0.0.1 f-secure.com
  • 127.0.0.1 gdata.es
  • 127.0.0.1 go.microsoft.com
  • 127.0.0.1 hacksoft.com.pe
  • 127.0.0.1 ikarus.at
  • 127.0.0.1 kaspersky.com
  • 127.0.0.1 kaspersky.ru
  • 127.0.0.1 kaspersky-labs.com
  • 127.0.0.1 liveupdate.symantec.com
  • 127.0.0.1 liveupdate.symantecliveupdate.com
  • 127.0.0.1 macafee.com
  • 127.0.0.1 mast.mcafee.com
  • 127.0.0.1 mcafee.com
  • 127.0.0.1 microsoft.com
  • 127.0.0.1 msdn.microsoft.com
  • 127.0.0.1 my-etrust.com
  • 127.0.0.1 networkassociates.com
  • 127.0.0.1 nod32.com
  • 127.0.0.1 norman.com
  • 127.0.0.1 norton.com
  • 127.0.0.1 nprotect.com
  • 127.0.0.1 pandasecurity.com
  • 127.0.0.1 pandasoftware.com
  • 127.0.0.1 pctools.com
  • 127.0.0.1 pif.symantec.com
  • 127.0.0.1 pifmain.symantec.com
  • 127.0.0.1 rads.mcafee.com
  • 127.0.0.1 rising-global.com
  • 127.0.0.1 scanner.novirusthanks.org
  • 127.0.0.1 secure.nai.com
  • 127.0.0.1 securityresponse.symantec.com
  • 127.0.0.1 service1.symantec.com
  • 127.0.0.1 sophos.com
  • 127.0.0.1 sunbeltsoftware.com
  • 127.0.0.1 support.microsoft.com
  • 127.0.0.1 symantec.com
  • 127.0.0.1 symantec.com/updates
  • 127.0.0.1 threatexpert.com
  • 127.0.0.1 trendmicro.com
  • 127.0.0.1 u2.eset.com
  • 127.0.0.1 u20.eset.com
  • 127.0.0.1 u3.eset.com
  • 127.0.0.1 u3.eset.com/
  • 127.0.0.1 u4.eset.com
  • 127.0.0.1 u4.eset.com/
  • 127.0.0.1 u7.eset.com
  • 127.0.0.1 update.avg.com
  • 127.0.0.1 update.microsoft.com
  • 127.0.0.1 update.symantec.com
  • 127.0.0.1 updates.symantec.com
  • 127.0.0.1 updates1.kaspersky-labs.com
  • 127.0.0.1 updates2.kaspersky-labs.com
  • 127.0.0.1 updates3.kaspersky-labs.com
  • 127.0.0.1 us.mcafee.com
  • 127.0.0.1 viabcp.com
  • 127.0.0.1 virscan.org
  • 127.0.0.1 virusbuster.hu
  • 127.0.0.1 viruslist.com
  • 127.0.0.1 viruslist.ru
  • 127.0.0.1 virusscan.jotti.org
  • 127.0.0.1 virustotal.com
  • 127.0.0.1 windowsupdate.microsoft.com
  • 127.0.0.1 www.ahnlab.com
  • 127.0.0.1 www.aladdin.com
  • 127.0.0.1 www.antivir.es
  • 127.0.0.1 www.antiy.net
  • 127.0.0.1 www.authentium.com
  • 127.0.0.1 www.avast.com
  • 127.0.0.1 www.avg.com
  • 127.0.0.1 www.avp.com
  • 127.0.0.1 www.avp.ru
  • 127.0.0.1 www.avp.ru/download/
  • 127.0.0.1 www.bitdefender.com
  • 127.0.0.1 www.clamav.net
  • 127.0.0.1 www.comodo.com
  • 127.0.0.1 www.download.mcafee.com
  • 127.0.0.1 www.drweb.com
  • 127.0.0.1 www.emsisoft.com
  • 127.0.0.1 www.eset.com
  • 127.0.0.1 www.eset.com/
  • 127.0.0.1 www.eset.com/download/index.php
  • 127.0.0.1 www.eset.com/joomla/
  • 127.0.0.1 www.eset.com/products/index.php
  • 127.0.0.1 www.fortinet.com
  • 127.0.0.1 www.f-prot.com
  • 127.0.0.1 www.f-secure.com
  • 127.0.0.1 www.gdata.es
  • 127.0.0.1 www.grisoft.com
  • 127.0.0.1 www.ikarus.at
  • 127.0.0.1 www.kaspersky.com
  • 127.0.0.1 www.kaspersky.ru
  • 127.0.0.1 www.kaspersky-labs.com
  • 127.0.0.1 www.macafee.com
  • 127.0.0.1 www.mcafee.com
  • 127.0.0.1 www.microsoft.com
  • 127.0.0.1 www.my-etrust.com
  • 127.0.0.1 www.networkassociates.com
  • 127.0.0.1 www.nod32.com
  • 127.0.0.1 www.norman.com
  • 127.0.0.1 www.norton.com
  • 127.0.0.1 www.nprotect.com
  • 127.0.0.1 www.pandasecurity.com
  • 127.0.0.1 www.pandasoftware.com
  • 127.0.0.1 www.pctools.com
  • 127.0.0.1 www.rising-global.com
  • 127.0.0.1 www.scanner.novirusthanks.org
  • 127.0.0.1 www.sophos.com
  • 127.0.0.1 www.sunbeltsoftware.com
  • 127.0.0.1 www.symantec.com
  • 127.0.0.1 www.symantec.com/updates
  • 127.0.0.1 www.trendmicro.com
  • 127.0.0.1 www.virscan.org
  • 127.0.0.1 www.viruslist.com
  • 127.0.0.1 www.viruslist.ru
  • 127.0.0.1 www.virusscan.jotti.org
  • 127.0.0.1 www.virustotal.com
  • 127.0.0.1 www.windowsupdate.microsoft.com