|
|
|  |
|
|
|
|
F-Secure Malware Information Pages: Small.QP
|
|
|
| Radar |
 |
|
|
|
Summary
|
| Small.QP copies itself to the Windows folder and attempts to download and install other malware to the system. |
|
|
|
Detailed Description
|
Upon execution, this malware creates the mutex _Win_Loader_ to ensure that only one instance of itself is running in memory.
Additionally, it drops the following files in the affected system:
- %windir%\winlogon32.exe - A copy of itself (Detected as Trojan-Dropper.Win32.Small.qp)
- %windir%\winlogon32.dll - Another malware file (Detected as Trojan-Downloader.Win32.Small.anj)
- %windir%\prefoct.dat - An empty file
As a stealth mechanism, it loads the dropped DLL, winlogon32.dll, under the legitimate process: lsass.exe.
Trojan-Downloader.Win32.Small.anj, on the other hand, creates the mutex _Win_Loader__Win_Loader_. This malware attempts to connect to the following web sites to possibly download other malicious components:
- http://www.max-stats.com/l/[REMOVED].php?i=21
Data downloaded is saved in the file, %windir%\prefoct.dat - http://www.teen4-sex.com/[REMOVED].dat
Data downloaded is saved in the file, %wndir%\_tmp0232.exe
Small.QP then executes the downloaded file, _tmp0232.exe.
Note: Both download sites are unavailable at the time of writing.
There are additional details on Small.QP on F-Secure's Weblog. |
|
|
|
F-Secure Corporation |
|
|
|
|
|
Last Modified: January 31, 2007
|
|
|
|
|
