|Detected||Apr 15 2005 12:41 GMT|
|Released||Apr 15 2005 12:41 GMT|
|Published||Jun 06 2005 09:59 GMT|
This primitive Trojan is written in Visual C++. This is a Windows PE EXE file, packed using UPX. The packed file is approximately 76KB in size and the unpacked file is approximately 163KB in size.
When launched, the Trojan copies itself to the Windows system directory with a random name. For example:
and registers this file in the Windows system registry:
" = "%System%\jgsjyb.exe"
This ensures that the Trojan will be run each time Windows is rebooted.
Then it deletes the original file.
The Trojan harvests information about visited sites and can send it to the Trojan's author by HTTP.
It also downloads and installs an adware program, not-a-virus:AdWare.BetterInternet, to the victim machine.
This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.
This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.