Modified by: Homer Pacag
ALIASES:

Backdoor.Spikeddos (Symantec); Trojan.Win32.Yoddos (Ikarus)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It performs denial of service (DoS) attacks on affected systems using specific flooding method(s).

It deletes itself after execution.

  TECHNICAL DETAILS

File Size: 29,184 bytes
File Type: EXE
Initial Samples Received Date: 23 Jul 2015

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

  • %Windows%\WinHelp32.exe

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKLM\SYSTEM\ControlSet001\
Services\WinHelp32
DisplayName = WinHelp32 Service

HKLM\SYSTEM\ControlSet001\
Services\WinHelp32
ImagePath = %Windows%\WinHelp32.exe

Denial of Service (DoS) Attack

This Trojan performs denial of service (DoS) attacks on affected systems using the following flooding method(s):

  • SYN Flood
  • GET Flood
  • ICMP Flood
  • UDP Flood
  • DNS Flood

Other Details

This Trojan performs DNS requests to the following sites:

  • www.{BLOCKED}x.com
  • www.{BLOCKED}i.com
  • dns.{BLOCKED}i.com

It deletes itself after execution.