TROJ_MSPOSER.ASM

This Trojan has received attention from independent media sources and/or other security firms. In particular, it takes advantage of the Epsilon data-breach incident that was reported in the media.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

It drops specific files on the infected systems, which are detected as BKDR_MSPOSER.KAX. As a result, routines of the dropped backdoor are exhibited on the system.

It also displays an image, to avoid being immediately noticed by user.

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This Trojan drops the following files:

• %Application Data%\IExplore.exe - detected as BKDR_MSPOSER.KAX
• %User Profile%\My Documents\SearchIndex\searchindex.exe - detected as BKDR_MSPOSER.KAX

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

It drops the following copies of itself into the affected system:

• %Application Data%\pl.exe

(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)

It creates the following folders:

• %User Profile%\My Documents\SearchIndex

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Dropping Routine

This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.

Other Details

This Trojan displays the following images: