|Detected||Oct 31 2006 09:42 GMT|
|Released||Oct 31 2006 09:42 GMT|
|Published||Nov 10 2006 10:04 GMT|
This Trojan is designed to install other malicious programs. It is a Windows PE EXE file. The file is 19,456 bytes in size. It is packed using UPX. The unpacked file is approximately 40KB in size.
Once launched, the Trojan will:
The Trojan then checks the hard disk for the following file:
If this file is not found, the Trojan will:
The Trojan then drops a file autorun.inf to the root partitions. This file contains the following strings:
As a result, when the user opens infected partitions using Explorer, mshta.exe will be launched from the opened partition.
This type of behaviour covers malicious programs that delete, block, modify, or copy data, disrupt computer or network performance, but which cannot be classified under any of the behaviours identified above.
This classification also covers “multipurpose” Trojan programs, i.e. those that are capable of conducting several actions at once and which demonstrate several Trojan behaviours in a single program. This means they cannot be indisputably classified as having any single behaviour.