This malware may arrive as an attachment to a Microsoft Word RTF file.

Upon Execution, this malware displays the following fake error message:



It then drops the following files on Windows System folder:

• %systemdir%GenuineLicence.exe - Trojan-Spy.Win32.KeyLogger.rk
• %systemdir%kbd.dll - Trojan-Spy.Win32.KeyLogger.rk
• %systemdir% est.dll - Trojan-Spy.Win32.KeyLogger.rl

Note: %systemdir% by default is C:Windowssystem32

It also creates the following registry key as part of its auto-start mechanism:

• HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
• service = "C:WINDOWSsystem32GenuineLicence.exe"

Initially, it will try to contact this url to set the infected machine's status

• hxxp://208.101.11.38/~mbs1/mail/cgi-bin/scripts/.old/trProj/setStatus.php

Then this malware sends the user's keystrokes including its ip address to this url:

• hxxp://208.101.11.38/~mbs1/mail/cgi-bin/scripts/.old/trProj/saveKeLog.php

Last update 31 October 2007

 

TOP