Description
This is a trojan detection. Unlike viruses, trojans do not self-replicate. They are spread manually, often under the premise that they are beneficial or wanted. The most common installation methods involve system or security exploitation, and unsuspecting users manually executing unknown programs. Distribution channels include email, malicious or hacked web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.
Indication of Infection
- unexpected outgoing HTTP traffic to the domain indicated above
- existence of the files and Registry keys detailed in this description
- multiple unexpected instances of IEXPLORE.EXE running in the background (no visible window)
Methods of Infection
The trojan installs itself in the Windows system folder as PRNTA.EXE and PRNTC.EXE, for example:
- C:\WINNT\SYSTEM32\PRNTA.EXE
- C:\WINNT\SYSTEM32\PRNTC.EXE
A copy is also dropped in the Windows startup folder as PRNTB.EXE, for example:
- C:\DOCUMENTS AND SETTINGS\USER2\START
MENU\PROGRAMS\STARTUP\PRNTB.EXE
A keylogging DLL is installed in %WinDir% as PRNTSVR.DLL:
The following Registry key is added to hook system startup:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
Run "load32" = C:\WINNT\SYSTEM32\PRNTA.EXE
The following key is changed:
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon "Shell"
from:
to:
- Explorer.exe C:\WINNT\SYSTEM32\PRNTC.EXE
The following Registry key is also added:
Clipboard contents and logged keystrokes are written to the following files respectively:
- %WinDir%\prntk.log
- %WinDir%\prntc.log
The HTML form that is dropped to facilitate sending stolen data to the hacker via HTTP, is written to:
- %WinDir%\TEMP\feff35a0.htm
A raw MIME message containing stolen data is written to:
- %WinDir%\TEMP\fa4537ef.tmp
Aliases
Srv.SSA-KeyLogger