This Trojan has received attention from independent media sources and/or other security firms. In particular, it takes advantage of the Epsilon data-breach incident that was reported in the media.
To get a one-glance comprehensive view of the behavior of this Trojan, refer to the Threat Diagram shown below.
It drops specific files on the infected systems, which are detected as BKDR_MSPOSER.KAX. As a result, routines of the dropped backdoor are exhibited on the system.
It also displays an image, to avoid being immediately noticed by user.
This Trojan may be unknowingly downloaded by a user while visiting malicious websites.
It executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.
File size: 229,376 bytes
File type: EXE
Memory resident: Yes
Initial samples received date: 24 Feb 2011
Payload: Drops files
Arrival Details
This Trojan may be unknowingly downloaded by a user while visiting malicious websites.
Installation
This Trojan drops the following files:
- %Application Data%\IExplore.exe - detected as BKDR_MSPOSER.KAX
- %User Profile%\My Documents\SearchIndex\searchindex.exe - detected as BKDR_MSPOSER.KAX
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.. %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)
It drops the following copies of itself into the affected system:
- %Application Data%\pl.exe
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
It creates the following folders:
- %User Profile%\My Documents\SearchIndex
(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)
Dropping Routine
This Trojan executes the dropped file(s). As a result, malicious routines of the dropped files are exhibited on the affected system.
Other Details
This Trojan displays the following images:
Connect with us on
| | | |