When we unrar this trojan, the icon of the exe is not of the original. Plus the file size is the same size of a recent trojan posted here a few days ago.. in fact, [Only registered and activated users can see links. ] it is exactly the same as the mentioned trojan, just renamed to pretend to be a cheat.
[Only registered and activated users can see links. ][Only registered and activated users can see links. ]
Code:
Performs File Modification and Destruction: The executable modifies and destructs files which are not temporary.
Performs Registry Activities: The executable reads and modifies register values. It also creates and monitors register keys.
Quote:
[ General information ]
* Applications uses MSVBVM60.DLL (Visual Basic 6).
* File length: 1364038 bytes.
* MD5 hash: 8b9fea63a1d4805a5edfd9d4732b865c.
[ Process/window information ]
* Creates a COM object with CLSID {FCFB3D23-A0FA-1068-A738-08002B3371B5} :
VBRuntime.
* Creates a COM object with CLSID {E93AD7C1-C347-11D1-A3E2-00A0C90AEA82} :
VBRuntime6.
The original file was created using C++, not VB6. Also, as the process info shows, its creating a COM object. COM has been replaced at least to some extent by the Microsoft .NET framework, and support for Web Services through the Windows Communication Foundation (WCF). Usually COM objects are/were used to access the internet. Googling the CLSID's shows they're used in existing trojans on the net.
This trojan creates these files on the host computer: Number of new processes: 10
Quote:
Unlock TF2 Achievements.exe (1180)
svchost.exe (1912)
svchost.exe (1184)
svchost.exe (1496)
svchost.exe (1232)
svchost.exe (1236)
dwwin.exe (1888)
svchost.exe (1628)
svchost.exe (2032)
cmd.exe (1568)
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\test. htm
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\test. htm
c:\docume~1\admini~1\locals~1\temp\svcho st.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\melt. bat
It also opens these files on the host computer:
Code:
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat
C:\Documents and Settings\Administrator\Cookies\index.dat
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\rasphone.pbk
c:\autoexec.bat
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1081A79.dmp
C:\WINDOWS\AppPatch\systest.sdb open
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\test.htm open
C:\WINDOWS\system32\shell32.dll.124.Config open
C:\WINDOWS\WindowsShell.Config open
C:\WINDOWS\system32\comctl32.dll.124.Config open
c:\docume~1\admini~1\locals~1\temp\svchost.exe open
C:\WINDOWS\system32\urlmon.dll.123.Config open
c:\docume~1\admini~1\locals~1\temp\svchost.exe.Manifest open
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\melt.bat open
C:\WINDOWS\system32\cmd.exe.Manifest open
C:\WINDOWS\WINHELP.INI
It accesses or creates these keys in the host computers registry:
Hybrid Mode
