Analysis by: Sabrina Lei Sioting
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted:

  • In the wild: Yes

  OVERVIEW

This Trojan drops files when executed.

It connects to website(s) to download and execute a malicious file.

  TECHNICAL DETAILS

File Size: 25,600 bytes
File Type: EXE
Memory Resident: No
Initial Samples Received Date: 16 May 2011

Installation

This Trojan drops the following files:

  • %User Temp%\kr_done1

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

Download Routine

This Trojan connects to the following website(s) to download and execute a malicious file:

  • http://{BLOCKED}rldmap.com/{BLOCKED}see/out/12.exe

Other Details

This Trojan connects to the following URL(s) to check for an Internet connection:

  • http://google.com/

  SOLUTION

Minimum Scan Engine: 8.900
FIRST VSAPI PATTERN FILE: 8.160.06
FIRST VSAPI PATTERN DATE: 16 May 2011

NOTES:


Did this description help? Tell us how we did.