Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Trojan-Downloader:W32/Kazy-17907


Aliases:


Trojan-Downloader:W32/Kazy-17907
Gen:variant.kazy.17907

Malware
Trojan-Downloader
W32

Summary

This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

This trojan-downloader appears to be related to a distribution of spam e-mails currently under way as of 5 April 2011, as hundreds of samples were submitted to our analysis systems in the last 24 hrs.

The spammed e-mail uses a social engineering attack to lure the recipient into clicking on an attached executable file. This attachment is actually the trojan-downloader, disguised as a legitimate document. The attachment uses a PDF file icon and the filename 'dhl.exe' to further disguise itself.

On clicking the file, the trojan-downloader is executed and creates a dummy svchost.exe process. It then injects a thread that downloads and executes a file from:

  • h t t p : / / puskovayaustanovka.ru/pusk[...].exe

At the time of writing, the domain is blocked by the Browsing Protection feature of our product.







Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.

Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free