Trojan.DownLoader22.20848

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\YahooUSService] 'ImagePath' = '"%CommonProgramFiles%\Yahoo!\YahooAUService.exe" -silentupdate'
[<HKLM>\SYSTEM\ControlSet001\Services\YahooUSService] 'Start' = '00000002'

Malicious functions:

Executes the following:

'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
'%TEMP%\pft6~tmp\Disk1\Setup.exe'
'<SYSTEM32>\sethc.exe'
'%CommonProgramFiles%\Yahoo!\YahooAUService.exe' -silentupdate
'%TEMP%\z2.tmp' <Full path to virus>

Injects code into

the following system processes:

<SYSTEM32>\sethc.exe

Terminates or attempts to terminate

the following system processes:

<SYSTEM32>\sethc.exe

Modifies file system:

Creates the following files:

%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core543b.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor54a9.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje567e.rra
%TEMP%\4f59.rra
%TEMP%\pft6~tmp\Disk1\layout.bin
%TEMP%\IEC7.tmp
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse56db.rra
%TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\isrt6543.rra
%TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\defa65c0.rra
%TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\_IsR664c.rra
%TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\valu64c6.rra
%CommonProgramFiles%\InstallShield\IScript\iscr5ac3.rra
%TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\setu639d.rra
%TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\lice6439.rra
%TEMP%\t3.tmp.new
%TEMP%\ext5.tmp
%TEMP%\plf4.tmp
%TEMP%\z2.tmp
%TEMP%\KB834789.tmp
%CommonProgramFiles%\Yahoo!\YahooAUService.exe
%TEMP%\c1.tmp.new
%TEMP%\pft6~tmp\pftw1.pkg
%TEMP%\pft6~tmp\Disk1\Setup.exe
%TEMP%\pft6~tmp\Disk1\Setup.ini
%TEMP%\pft6~tmp\Disk1\Setup.inx
%TEMP%\pft6~tmp\Disk1\data2.cab
%TEMP%\pft6~tmp\Disk1\ikernel.ex_
%TEMP%\pft6~tmp\Disk1\data1.hdr
%TEMP%\pft6~tmp\Disk1\data1.cab

Deletes the following files:

%TEMP%\pft6~tmp\pftw1.pkg
%TEMP%\IEC7.tmp
%TEMP%\ext5.tmp
%TEMP%\KB834789.tmp
%TEMP%\t3.tmp

Moves the following files:

from %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\lice6439.rra to %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\license.txt
from %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\setu639d.rra to %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\setup.inx
from %CommonProgramFiles%\InstallShield\IScript\iscr5ac3.rra to %CommonProgramFiles%\InstallShield\IScript\iscript.dll
from %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\valu64c6.rra to %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\value.shl
from %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\_IsR664c.rra to %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\_IsRes.dll
from %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\defa65c0.rra to %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\default.pal
from %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\isrt6543.rra to %TEMP%\{B3C53492-53A3-4EA8-A3A2-B30DBBE14B96}\isrt.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
from %TEMP%\t3.tmp.new to %TEMP%\t3.tmp
from %TEMP%\c1.tmp.new to %TEMP%\c1.tmp
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core543b.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse56db.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje567e.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor54a9.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll