TROJ_KRAP.QALP

It connects to a URL to download its configuration file.

It hooks certain APIs to perform its information stealing routine.

This Trojan may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It runs certain commands that it receives remotely from a malicious user. Doing this puts the affected computer and information found on the computer at greater risk.

It also has rootkit capabilities, which enables it to hide its processes and files from the user.

It lowers the security setting of Internet Explorer.

As of this writing, the said sites are inaccessible.

Arrival Details

This Trojan may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %System Root%\mute.exe\mute.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It creates the following folders:

• %System Root%\mute.exe

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.)

It injects threads into the following normal process(es):

• SMSS.EXE
• CSRSS.EXE
• SERVICES.EXE
• SYSTEM

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
mute.exe = %System Root%\mute.exe\mute.exe

Backdoor Routine

This Trojan executes the following command(s) from a remote malicious user:

• Steal information from Internet Explorer and Mozilla Firefox
• Download and execute other files
• Log keystrokes

Rootkit Capabilities

This Trojan also has rootkit capabilities, which enables it to hide its processes and files from the user.

Web Browser Home Page and Search Page Modification

This Trojan lowers the security setting of Internet Explorer.

Download Routine

This Trojan connects to the following URL(s) to download its configuration file:

• http://{BLOCKED}rvicenail.com/8956mainadmin/rxtdcfyvgubhinj.php?{system information}

As of this writing, the said sites are inaccessible.

Other Details

This Trojan does the following:

• It hooks certain APIs to perform its information stealing routine.