TROJ_DLOADER.JP

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• %User Profile%\æô¶¯\{malware file name}

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %System%\CPAPP
• %User Temp%\7ZipSfx.000
• %User Profile%\Tencent\QQDownload
• %User Profile%\QQDownload\1100463875
• %User Profile%\1100463875\Setting
• %User Profile%\Application Data\Tencent
• %User Profile%\Tencent\DeskUpdate

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other System Modifications

This Trojan deletes the following files:

• %User Profile%\Download\version
• %User Temp%\3329884665.idx
• %User Profile%\Download\version.tdl
• %User Temp%\e71ab0ac913b3c417d63f88ffe82255b.tpt
• %User Temp%\1140033060.idx

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It adds the following registry keys:

HKEY_CLASSES_ROOT\metnsd\clsid

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
metnsd\clsid
SequenceID = "{random values}"

Dropping Routine

This Trojan drops the following files:

• %System%\CPAPP\StepData.dat
• %System%\cpapp\{malware file name}
• %System%\CPAPP\cpappinstall.dat
• %System%\CPAPP\QQPCDownload_60885.exe
• %System%\CPAPP\caiyun_setup_3.85_rm0801.exe
• %User Temp%\7ZipSfx.000\QQPCDownload.exe
• %User Temp%\7ZipSfx.000\qqdownload.dll
• %Desktop%\Global.db

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.. %Desktop% is the current user's desktop, which is usually C:\Windows\Profiles\{user name}\Desktop on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Desktop on Windows NT, and C:\Documents and Settings\{User Name}\Desktop on Windows 2000, XP, and Server 2003.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://tv.{BLOCKED}an.com:999/cpaall3.xml
• http://dl_dir2.{BLOCKED}{BLOCKED}.com/{random path}
• http://downcdn.{BLOCKED}n.com/setup/silent/{BLOCKED}n_setup_3.85_rm0801.exe

This report is generated via an automated analysis system.