Analysis by: Christopher Daniel So
 PLATFORM:

Windows 2000, XP, Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan launches certain flood attacks against target sites. It does the said routine to prevent users from reaching these sites at a given time.

  TECHNICAL DETAILS

File Size: 221,184 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 14 Sep 2010

Installation

This Trojan drops the following copies of itself into the affected system:

  • %User Profile%\Application Data\srpp.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.)

It injects itself into the following processes running in the affected system's memory:

  • EXPLORER.EXE

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Winlogon
Taskman = "%User Profile%\Application Data\srpp.exe"

Denial of Service (DoS) Attack

This Trojan launches the following types of flood attack against target sites:

  • unknown.carohosting.net:1995

  SOLUTION

Minimum Scan Engine: 8.900
VSAPI OPR PATTERN File: 7.462.01
VSAPI OPR PATTERN Date: 14 Sep 2010

Step 1

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 2

DAMAGE CLEANUP TEMPLATE


Did this description help? Tell us how we did.