1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Labs
  2. Threats
  3. Virus and threat descriptions
  4. Delf.AUY

Delf.AUY

Name : Delf.AUY
Size:22,498 Bytes
Category:Malware
Type:Trojan-Downloader
Platform:W32
Date of Discovery:August 08, 2006

Summary

Delf.AUY is a Borland Delphi complied malware that uses Internet Explorer to download and execute 5 other password stealing malware applications. Please see the details section for more information.

Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Additional Details

Once Delf.AUY is executed, it will install itself by creating a copy in the system directory as intenat.exe. It uses a temporary batch file dropped in the system directory with a filename of Deleteme.bat to delete the executed copy of itself.


Delf.AUY creates the following registry entry to enable its execution automatic upon boot up:

  •  [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
    @ = %sysdir%\intenat.exe


After the malware installs, it will then start executing its download routine. Delf.AUY searches for the installation path of Internet Explorer from the following registry entry and uses it to download some password stealing trojans:

  •  [HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE]


If it has no value it will set it to the following hardcoded path and filename:

  •  C:\Program Files\Internet Explorer\IEXPLORE.EXE


Below is a list of the URLs from where it will attempt to download other malware:

  •  http://www.ac66.cn/down/[BLOCKED]ezi.exe detected as Trojan-PSW.Win32.Delf.pw
  • http://www.ac66.cn/down/[BLOCKED]hxy.exe detected as Trojan-PSW.Win32.WOW.de
  • http://www.ac66.cn/down/[BLOCKED]ichong.exe detected as Trojan-PSW.Win32.Delf.px
  • http://www.ac66.cn/down/[BLOCKED]q.exe detected as Trojan-PSW.Win32.QQRob.hw
  • http://www.ac66.cn/down/[BLOCKED]x.exe detected as Trojan-PSW.Win32.Lmir.bac


Delf.AUY will save and execute the downloads to these hardcoded path and filenames:

  •  C:\program files\system.exe
  • C:\program files\system2.exe
  • C:\program files\system3.exe
  • C:\program files\system4.exe
  • C:\program files\system5.exe

    Detection


    F-Secure Anti-Virus detects this malware with the following updates:

    [FSAV_Database_Version]

    Version = 2006-08-24_01.