Threat Encyclopedia

This malware is injected into certain processes in order to download and execute malware. The malicious routines of the downloaded malware may be exhibited on the affected system.

This Trojan may arrive bundled with malware packages as a malware component. It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

It exports functions used by other malware. It requires its main component to successfully perform its intended routine.

Arrival Details

This Trojan may arrive bundled with malware packages as a malware component.

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Download Routine

This Trojan accesses the following websites to download files:

• http://www.{BLOCKED}wer.com/srilk/TomAndJerry.jpg

It saves the files it downloads using the following names:

• %User Temp%\{random file name}.tmp

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.

Other Details

This Trojan exports functions used by other malware.

It requires its main component to successfully perform its intended routine.

NOTES:

TROJ64_INSTOL.USR passes the encrypted URL to this DLL component.

This DLL component has only one export function named ExportFunc which is repeatedly executed.