Analysis by: Lord Alfred Remorin
 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:

  • Threat Type: Trojan

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

This Trojan may be dropped by other malware.

  TECHNICAL DETAILS

File Size: 75,704 bytes
File Type: EXE
Memory Resident: Yes
Initial Samples Received Date: 16 Aug 2012

Arrival Details

This Trojan may be dropped by the following malware:

  • TROJ_ARTIEF.LOG

Installation

This Trojan drops the following component file(s):

  • %User Startup%\SystemDebugger.lnk

(Note: %User Startup% is the current user's Startup folder, which is usually C:\Windows\Profiles\{user name}\Start Menu\Programs\Startup on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Start Menu\Programs\Startup on Windows NT, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup.)

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKCU\Software\Microsoft\
Windows\CurrentVersion\Run
SystemDebugger = "{malware path}"

Download Routine

This Trojan downloads an updated copy of itself from the following website(s):

  • http://{BLOCKED}unty.net
  • http://{BLOCKED}stingtalk.com

It connects to the following website(s) to download and execute a malicious file:

  • http://{BLOCKED}unty.net/first-time/msreg.exe - detected as TSPY_KEYLOG.ZGD

It saves the files it downloads using the following names:

  • %User Profile%\programs\msreg.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

  SOLUTION

Minimum Scan Engine: 9.200
FIRST VSAPI PATTERN FILE: 9.328.06
FIRST VSAPI PATTERN DATE: 16 Aug 2012

Step 1

For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.

Step 2

Remove the malware/grayware file that dropped/downloaded TROJ_DLOADR.ZGD

    ?
    • TROJ_ARTIEF.LOG

Step 3

Remove malware/grayware files dropped/downloaded by TROJ_DLOADR.ZGD