TR/Dldr.PurityScan.FK - Trojan

See also

Summary

Full description

Statistics

Virus:	TR/Dldr.PurityScan.FK
Date discovered:	25/01/2008
Type:	Trojan
Subtype:	Downloader
In the wild:	Yes
Reported Infections:	Low
Distribution Potential:	Low
Damage Potential:	Low
Static file:	Yes
File size:	70.656 Bytes
MD5 checksum:	c400b89a9a425fc78041ef9876d40C1b
IVDF version:	6.23.00.00

General Method of propagation:
   • No own spreading routine

Aliases:
   • Mcafee: Downloader.gen.a
   • Kaspersky: Trojan-Downloader.Win32.PurityScan.fk
   • F-Secure: Trojan-Downloader.Win32.PurityScan.fk
   • Sophos: ClickSpring
   • Panda: Adware/PurityScan
   • Grisoft: Downloader.Generic6.AEPH
   • VirusBuster: Trojan.DL.CLSpring.Gen
   • Bitdefender: Trojan.Downloader.JJRL

Platforms / OS:
   • Windows 95
   • Windows 98
   • Windows 98 SE
   • Windows NT
   • Windows ME
   • Windows 2000
   • Windows XP
   • Windows 2003

Side effects:
   • Downloads a malicious file
   • Registry modification

Files It drops a copy of itself using a filename from a list:
– To: %randomly chosen directory% Using one of the following names:
   • regsvr32.exe
   • regedit.exe
   • tracert.exe
   • nslookup.exe
   • arpa.exe
   • ping.exe
   • mshta.exe
   • nopdb.exe
   • winword.exe
   • ati2evxx.exe
   • spool32.exe
   • msconfig.exe
   • userinit.exe
   • netdde.exe
   • mmc.exe
   • scanregw.exe
   • wucrtupd.exe
   • wuauboot.exe
   • wuauclt.exe
   • wuaclt.exe
   • rundll.exe
   • fast.exe
   • alg.exe
   • cmd.exe
   • dexplore.exe
   • iexplore.exe
   • notepad.exe
   • msdtc.exe
   • javaw.exe
   • ntvdm.exe
   • wowexec.exe
   • winspool.exe
   • taskmgr.exe
   • rundll32.exe
   • msiexec.exe
   • logonui.exe
   • dvdplay.exe
   • dllhost.exe
   • chkdsk.exe
   • chkntfs.exe
   • attrib.exe
   • winlogon.exe
   • spoolsv.exe
   • smss.exe
   • services.exe
   • lsass.exe
   • csrss.exe
   • svchost.exe
   • explorer.exe

It tries to download a file:

– The location is the following:
   • http://63.251.135.17/**********
It is saved on the local hard drive under: %TEMPDIR%\ctxad.exe Furthermore this file gets executed after it was fully downloaded. Further investigation pointed out that this file is malware, too. Detected as: DR/ZenoSearch.AD.1

Registry One of the following values is added in order to run the process after reboot:

– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   • "Wsea"=""%WINDIR%\CROSOF~1.NET\nslookup.exe" -vt ndrv"

The following registry keys are added:

– [HKCU\Software\Scst]
   • "Ratc"=hex:24,13,51,50,d7,a4,b5,d1,2a,c6,29,80
   • "Roeo"=hex:3a,2b,e9,16,da,7e,ed,d9
   • "Patr"=hex:45,7d,34,27,3e,91,89,b0,e1,eb,02,4d,b0,b6,e4,c6,1c,58,25,8d,3f,89,7b,09,81,dd,fb,83,29,bf,c5,dc,5c,fd,1d,99,49,d9,10,2a,46,99,c3,82,af

– [HKLM\SYSTEM\ControlSet001\Services\PerfOS\Performance]
   • "Error Count"=-

– [HKLM\SYSTEM\ControlSet001\Services\PerfDisk\Performance]
   • "Error Count"=-

– [HKCU\Software\Rcud]
   • "toec"=hex:2c,03,51,50,d8,e4,b4,d1,d0,a9,5b,13,e6,ed,a6,81,06,0a,7b,8b,4b,f1,1a,6d,e2,b6,ce,b4,1d,82,f4,ee,6c,cc,2f,ac,7f,e9,27,13,46,9e,31,1d,f1,5b,6e,b1,f0,8e,1a,50,f3,b1,9e,ca,ea,14,68,dd,05,88,3a,4c,b4,5a,a7,3f,a7,5e,64,c5,ce,de,12,75,59,ba,86,40,b8,13,1d,37,9b,43,34,4f,f2,ff,4f,bf,ed,e6,08,02,fc,dd,29,0c,cf,f4,93,94,56,bc,de,6d,c1,41,93,15,80,1d,27,a2,43,46,07,d6,fa,97,83,3f,d5,3e,e8,fd,44,76,9d,73,f7,4b,84,db,de,56,ac,75,29,92,ce,6a,48,cc,08,55,eb,59,27,bc,02,fd,53,4d,bd,2f,65,5e,8c,43,dc,54,1f,04,27,4e,66,ce,26,7f,91,4b,b7,3c,10,40,c6,dc,93,1e,08,d3,0a,4f,e6,0a,a5,59,90,f9,d4,65,34,78,47,bd,11,b4,ee,42,0d,d2,f9,0d,90,d8,d8,98,17,e4,3b,34,01,63,12,ae,b3,c5,8d,5c,7e,73,1c,fd,e7,4b,6f,17,fe,b2,76,d4,b2,ab,61,79,df,fa,a0,f6,e8,d7,e3,3a,ce,3d,1a,3a,09,bf,75,d8,c7,e4,64,29,ad,f0,97,b2,49,a9,fe,a2,7e,af,c9,2d,f0,7d,68,79,da,db,8b,d2,0e,e1,22,13,88,c4,5d,6d,09,11,ac,0a,2e,96,bf,2e,76,98,86,ce,6b,27,31,cb,50,98,30,41,c0,0e,33,9b,c6,a8,2a,59,a5,98,45,bb,63,2d,f4,c0,88,27,e7,2b,a9,1f,0e,77,89,14,99,f1,53,ab,f8,6d,22,1f,db,34,dd,11,32,2c,2a,2b,2d,62,fb,36,3c,6c,cf,47,0f,4a,2c,86,96,bc,7a,0f,01,41,90,a1,c0,1f,bd,2f,83,3f,9e,0c,3a,ac,b3,a1,15,02,79,d9,84,2c,88,9e,37,29,ed,d5,1e,bf,f6,f8,69,59,60,dd,88,76,00,0c,2b,5b,39,5f,42,f9,32,30,fd,3a,89,e5,cc,21,2d,74,5f,69,fd,05,a6,9e,48,7a,d1,da,62,b7,50,92,90,ac,d3,27,42,18,4a,33,6d,c1,e5,ac,5c,57,14,6c,ac,9e,87,aa,12,35,2e,7b,cf,55,39,65,fa,8c,18,93,c5,0b,7b,45,30,11,52,7a,7b,6f,cd,f7,27,ed,5c,2b,e8,bd,af,8c,06,f4,b6,74,7e,87,a1,98,cd,5e,e0,98,2b,4a,23,54,df,80,5a,ee,4a,cc,b5,bb,a3,4d,a4,7f,36,c8,d7,af,56,a0,7d,91,00,62,40,5b,03,b0,ff,90,5e,60,99,bc,5d,d1,24,d1,2d,d4,d3,dd,d8,be,ec,88,e1,e6,ff,b3,a4,ce,c6,3e,05,70,71,7a,15,d1,70,33,bf,b0,73,c4,e2,51,6a,dd,05,94,85,2e,23,6b,34,67,a7,a2,27,39,36,c5,4e,4f,27,c3,d9,68,ab,15,38,08,89,81,1b,66,62,fa,72,98,6f,66,6d,1d,ac,3a,7c,3a,3a,60,4f,df,74,06,d6,fc,05,96,41,80,bf,cb,00,62,bc,fb,c3,78,f9,3c,7a,00,97,f7,55,05,f0,36,c4,22,c0,2c,77,46,6e,eb,5e,67,f8,5b,a9,60,cc,1d,c8,60,69,12,6b,9c,f7,e8,82,35,0d,e0,3d,86,bb,82,0c,40,53,da,9f,0e,54,4e,e6,ae,e9,94,11,aa,90,60,90,24,d4,49,13,71,10,ea,8a,57,37,f3,25,40,5f,e0,54,b2,81,6c,c7,d7,fb,44,6e,f3,d8,9d,79,fc,8e,a1,58,cd,f4,0b,bb,96,db,4a,92,86,ce,37,0d,d3,2f,c8,9c,99,cd,d4,ef,41,5f,eb,f6,54,59,51,e1,f7,8d,c5,20,7b,f7,4c,63,ad,54,47,9a,e2,5f,b0,f5,de,05,0f,e4,15,2d,ff,17,ed,1b,3e,7e,f3,11,78,49,3c,18,37,e8,4d,bc,7f,0b,55,5b,6f,a2,8b,cc,f3,dd,03,be,1c,2c,47,8a,2e,3f,79,f3,04,06,ef,3d,09,b1,69,fc,24,b0,65,57,da,b3,2d,33,d9,aa,a1,c9,95,c5,e1,b8,b2,74,4d,43,a9,67,86,4b,cd,8e,67,2c,3b,19,20,cd,50,78,e2,90,ea,5b,d7,03,64,b2,44,60,5f,ad,18,5b,42,bc,48,aa,b5,8f,b4,ad,f4,16,7d,c0,63,81,ff,60,6d,40,e4,64,7a,03,f2,58,0a,ba,94,6d,57,95,48,8d,d3,04,59,85,e6,b7,a3,47,c3,9e,4f,f1,a8,e9,a7,52,0d,08,8b,83,c4,ab,1d,a2,44,c2,b1,22,9b,7d,11,3c,7b,4c,9e,8e,b7,df,f3,6a,96,26,ff,49,81,51,b9,80,21,d0,f6,d0,f8,53,fa,b2,7b,ca,bb,84,06,65,13,d8,61,94,38,f4,79,07,45,0d,1b,ae,ab,69,04,b9,d3,8d,07,98,47,e5,10,fb,27,43,8b,d2,d2,ec,ac,4d,ee,d5,59,dc,47,d8,90,2f,37,48,98,36,75,83,0b,21,97,60,28,60,9d,8c,f4,a3,46,6e,54,da,16,88,21,35,42,2e,06,24,ec,d0,fd,57,6a,d9,49,e9,08,bb,40,89,a3,a3,26,28,18,47,ee,4b,f6,33,60,e2,a7,d7,8f,1d,af,dd,90,6c,45,68,3d,7f,7e,a2,ca,46,df,55,45,f1,98,45,9d,f0,d7,c8,6f,f3,d6,f7,91,ea,a5,30,a4,05,d5,64,f1,b4,73,9c,73,a7,13,29,8f,ce,bf,d8,76,59,17,f9,6d,b8,fc,79,26,9b,88,01,ea,f2,30,3c,44,ed,53,48,c3,fc,96,5f,e8,cf,c9,16,70,56,3d,ea,1a,c1,be,b4,9f,80,a6,f6,5f,43,ab,fc,57,fa,68,77,17,d5,cb,90,ac,44,cf,17,d4,f7,40,b9,44,de,77,21,2a,29,2f,33,cd,48,f5,8e,be,eb,de,78,9d,02,6e,b3,df,bd,dc,4a,54,8c,3c,1f,7c,1f,19,82,8d,66,8f,a9,31,91,08,73,23,10,09,c7,3d,93,c3,69,40,0a,60,95,a1,a5,26,07,e9,d4,fe,43,9f,47,f2,86,2e,ee,a3,c1,23,f9,ea,36,f0,d8,01,d7,86,3b,f9,a6,8d,12,5f,16,9d,8d,49,5a,37,1c,36,48,32,6f,6c,01,3a,76,d5,3c,f8,61,76,85,c0,a0,ff,2a,95,e3,1f,6c,ab,1a,8b,03,16,75,e5,5c,50,64,02,62,6c,97,27,cf,ca,fe,43,02,1d,c9,4a,29,0f,68,22,e3,aa,8b,d7,d8,bb,22,04,7e,ec,5d,9a,2b,c0,ac,83,bb,23,bf,c3,f1,ee,86,0f,8d,b6,31,08,31,83,30,8a,53,95,33,c0,70,0f,2a,ea,7a,05,45,08,67,54,f4,d9,f2,79,e7,e0,0e,a2,0e,(...)
   •

See a brief description here.

Description inserted by Lutz Koch on Wed, 30 Apr 2008 12:49 (GMT+1)
Description updated by Lutz Koch on Wed, 30 Apr 2008 13:46 (GMT+1)

» About Malware
» About Phishing
» Viruses In the Wild

« back