live casino online

This Trojan has received attention from independent media sources and/or other security firms. Specifically, it arrives via SQL injection in order to compromise sites from from various industries. It is found that a malicious server tries to inject sites with a .PHP script that is housed in a site called LizaMoon.

To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.

It may arrive when a user accesses a compromised website.

It reports system infection to certain websites, along with gathered information about the infected system.

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

It connects to certain websites to send and receive information. It deletes itself after execution.

Arrival Details

This Trojan may be unknowingly downloaded by a user while visiting malicious websites.

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Internet Settings\
Zones\{random character}
1806 = "0"

Other Details

This Trojan connects to the following website to send and receive information:

• http://{BLOCKED}ssmortgages.in/djcash.php
• http://{BLOCKED}um.in/djcash.php?

It deletes itself after execution.

NOTES:

It reports system infection to the above-mentioned sites by sending encrypted data using the following parameters:

• ini={encrypted data}
  
  This parameter includes the following information:
  • Installation date and time
  • System ID
  • Trojan ID
• data={encrypted data}
  
  This parameter includes the following information:
  • Debug information
  • Operating system
  • User privelege

As of this writing, however, there is no reply from the server.

It enumerates active windows on a system and looks for windows with the string sysinternals in it. If it finds one, it does not continue its malicious routine.