TROJ_CRYPTRED.AA

This Trojan executes the dropped malware detected as TROJ_SRIAL.A.

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It bears the file icons of certain applications to avoid easy detection and consequent removal.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following files:

• %System Root%\Documents and Settings\wrcs.doc - non-malicious file
• %User Temp%\~1tmp.bat - non-malicious file
• %User Temp%\~1tmp.exe - detected as TROJ_SRIAL.A

(Note: %System Root% is the root folder, which is usually C:\. It is also where the operating system is located.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It bears the file icons of the following applications:

• Microsoft Word Document

Dropping Routine

This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

NOTES:

It executes the dropped batch file component, %User Temp%\~1tmp.bat. This batch file then executes the following commands:

• Delete the main malware
• Open the non-malicious .DOC file, WRCS.DOC, in order to hide its malicious routines from the user
• Execute the dropped malware detected as TROJ_SRIAL.A

The batch file also tries to delete itself after executing all the commands above.