Malware Information

Malware name Trojan.Zapchast.AI Type Trojan Affected platform Win32 Media-Type application/executable MD5 checksum C0F6543EA0C3B43F4CA0FF4A47225BB8 Static file yes Filesize 45,056 Bytes Alias names (also known as) McAfee BackDoor-CVM Side effects Drops files Drops malicious files Propagation No own spreading routine

Description:

It creates the following directories:
• C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\
• C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\download



The following files are created:

– Non malicious files:
• C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\aliases.ini;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\control.ini;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\Desktop.ini;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\fullname.txt;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\identd.txt;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\instsrv.exe;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\mirc.ico;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\mirc.ini;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\popups.txt;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\remote.ini;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\servers.ini;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\svchost.exe;
C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\users.ini

– C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\a.reg Further investigation pointed out that this file is malware, too. Detected as: IRC/Cloner.BI

– C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\csrss.exe Detected as: Trojan.mIRC-593262.A

– C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\script.ini Detected as: IRC/Zapchast.AI

– C:\RECYCLER\S-1-5-21-606747145-1085031214-725345543-500\sup.exe Furthermore it gets executed after it was fully created. Detected as: Trojan.Runner.B


Programming language:
The malware program was written in MS Visual C++.


Runtime packer:
In order to aggravate detection and reduce size of the file it is packed with the following runtime packer:
• UPX