TROJ_EMBEDDED.KD

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %Windows%\missAU.exe
• {malware location}\1

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

It adds the following possibly malicious files or file components:

• %Windows%\schost.exe

(Note: %Windows% is the Windows folder, which is usually C:\Windows.)

Autostart Technique

This Trojan modifies the following registry entry(ies) to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Userinit = "%Windows%\missAU.exe"

(Note: The default value data of the said registry entry is "%System%\userinit.exe,".)

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings
GlobalUserOffline = "0"

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}pro.clanteam.com/store/schost