| Malware name | Trojan.Magania.105988 | | Type | Trojan | | Affected platform | Win32 | | Media-Type | application/executable | | MD5 checksum | 9371047FFA1FD7A888C2BCF9F916F024 | | Static file | yes | | Filesize | 105,988 Bytes | Alias names
(also known as) | | Webwasher Proactive | Virus.Win32.FileInfector.gen | | Sophos | Mal/EncPk-IG | | McAfee | Generic PWS.ak |
| | Protection | | Webwasher Proactive | Database Version: 113 |
| | Side effects | - Downloads a malicious file
- Drops malicious files
- Lowers security settings
- Registry modification
|
|
Description:
Files
It copies itself to the following locations:
•
%drive%\3ds.cmd
• %SYSDIR%\rttrwq.exe
It deletes the initially executed copy of itself.
The following files are created:
–
%drive%\autorun.inf This is a non malicious text file with the following content:
•
%code that runs malware%– %SYSDIR%\mkfght0.dll Further investigation pointed out that this file is malware, too. Detected as: Trojan.Magania.129536
It tries to download a file:
– The location is the following:
• http://vfdsa.com/jj/**********
At the time of writing this file was not online for further investigation.
Registry
One of the following values is added in order to run the process after reboot:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
• "ertyuop"="%SYSDIR%\rttrwq.exe"
The following registry keys are changed:
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
Connections]
New value:
• "DefaultConnectionSettings"=hex:46,00,00,00,04,00,00,00,09,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,04,00,00,00,00,00,00,00,50,0F,2A,D2,DD,77,CA,01,00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,02,00,00,00,C0,A8,6B,64,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
– [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
New value:
• "Hidden"=dword:0x00000002
• "ShowSuperHidden"=dword:0x00000000
– [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL]
New value:
• "CheckedValue"=dword:0x00000000
File details
Runtime packer: In order to aggravate detection and reduce size of the file it is packed with a runtime packer.
