|Detected||Apr 04 2006 02:24 GMT|
|Released||Apr 04 2006 02:24 GMT|
|Published||Jun 01 2006 14:18 GMT|
This malicious program downloads other programs from the Internet without the user's knowledge or consent and launches them on the victim machine.
The Trojan itself is a Windows PE EXE file 7026 bytes in size, packed using UPX.
Once launched, the Trojan creates a unique identified, "gagagaradio", to flag its presence in the system.
If the Trojan finds such an identifier already on the victim machine, it will terminate itself. If no such identifier is found, the Trojan will download a file via the Internet from the following:
This file will be saved to the Windows system directory as svcp.csv:
This is a text file which contains encrypted links to subsequent files which will be downloaded by the Trojan. The file also contains some other information.
The Trojan downloads files from the links which it gets and saves them to the Windows system directory (%System%), adding an .exe extension. Once this is done, the Trojan launches the downloaded files for execution.
Additionally, the Trojan saves its information to the following file:
The Trojan also checks for a connection to IP address 22.214.171.124, and then attempts to connect via TCP/IP port 25.
Programs classified as Trojan-Downloader download and install new versions of malicious programs, including Trojans and AdWare, on victim computers. Once downloaded from the Internet, the programs are launched or included on a list of programs which will run automatically when the operating system boots up.
Information about the names and locations of the programs which are downloaded are in the Trojan code, or are downloaded by the Trojan from an Internet resource (usually a web page).
This type of malicious program is frequently used in the initial infection of visitors to websites which contain exploits.