|Detected||Feb 21 2006 05:03 GMT|
|Released||Feb 21 2006 05:03 GMT|
|Published||Aug 11 2006 12:16 GMT|
This Trojan is designed to download other files via the Internet without the knowledge or consent of the user.
The Trojan itself is a Windows PE EXE file, 3072 bytes in size, packed using FSG. The unpacked file is approximately 28KB in size.
Once launched, the Trojan checks to see if %System%\qvxgamet1.exe is present. If not, the Trojan will then delete a file called %Temp%\qvxt1.game (if there is such a file on the victim machine and downloads data from http://**ko.biz/dl.php in its place.
The Trojan then deletes the following files (if they are present on the victim machine):
%Temp%\qvxt2.game %Temp%\qvxt3.game %Temp%\qvxt4.game
It then downloads data from the following URLs in place of these files:
http://**ko.biz/soft/1.exe/ http://**ko.biz/soft/2.exe/ http://**ko.biz/soft/3.exe/
If the download is successful, the Trojan copies the downloaded files to the Windows system directory under the following names:
%System%\qvxgamet2.exe %System%\qvxgamet3.exe %System%\qvxgamet4.exe
If these files already exist, the data in them will be overwritten.
If for some reason the download is not successful, a repeat attempt to download will be made after 5 minutes.
Once the files have been downloaded, they will be launched for execution. The execution of the Trojan program will be terminated.
At the time of writing, the links contained in this description were not functioning.
%System%\qvxgamet2.exe %System%\qvxgamet3.exe %System%\qvxgamet4.exe %Temp%\qvxt1.game %Temp%\qvxt2.game %Temp%\qvxt3.game %Temp%\qvxt4.game
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.