TROJ_UFRAIE.AB
PLATFORM:
Windows 2000, Windows XP, Windows Server 2003
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan drops files when executed.
It connects to website(s) to download and execute a malicious file.
TECHNICAL DETAILS
File Size:
25,600 bytes
File Type:
EXE
Memory Resident:
No
Initial Samples Received Date:
16 May 2011
Installation
This Trojan drops the following files:
- %User Temp%\kr_done1
(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)
Download Routine
This Trojan connects to the following website(s) to download and execute a malicious file:
- http://{BLOCKED}rldmap.com/{BLOCKED}see/out/12.exe
Other Details
This Trojan connects to the following URL(s) to check for an Internet connection:
- http://google.com/
SOLUTION
Minimum Scan Engine:
8.900
FIRST VSAPI PATTERN FILE:
8.160.06
FIRST VSAPI PATTERN DATE:
16 May 2011
NOTES:
Did this description help? Tell us how we did.