| Malware name | Trojan.PSW.Frethog.AJ.2 | | Type | Trojan | | Affected platform | Win32 | | Media-Type | application/executable | | MD5 checksum | 7E0F15F8840B937B91ADC75BF6C2E0D8 | | Static file | yes | | Filesize | 103,973 Bytes | Alias names
(also known as) | | Webwasher Proactive | Win32.Malware.gen!86 | | Sophos | Troj/PWS-AVL | | McAfee | PWS-Gamania.gen.c | | CA ETrust | Win32/Frethog.BZW |
| | Protection | | Webwasher Proactive | Database Version: 101 |
| | Side effects | - Downloads a malicious file
- Drops malicious files
- Lowers security settings
- Registry modification
|
|
Description:
Files
It copies itself to the following locations:
•
%drive%\2fiji.com
• %SYSDIR%\ckvo.exe
It deletes the initially executed copy of itself.
The following files are created:
–
%drive%\autorun.inf This is a non malicious text file with the following content:
•
%code that runs malware%– %SYSDIR%\ckvo0.dll
It tries to download a file:
– The location is the following:
• http://ghy67.com/xmfx/**********
At the time of writing this file was not online for further investigation.
Registry
One of the following values is added in order to run the process after reboot:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "kamsoft"="%SYSDIR%\ckvo.exe"
The following registry keys are changed:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
Connections]
New value:
• "DefaultConnectionSettings"=hex:46,00,00,00,04,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,80,2F,FD,CD,D2,77,CA,01,00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,C0,A8,6B,64,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
New value:
• "Hidden"=dword:0x00000002
• "ShowSuperHidden"=dword:0x00000000
– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL]
New value:
• "CheckedValue"=dword:0x00000000
File details
Runtime packer: In order to aggravate detection and reduce size of the file it is packed with a runtime packer.
