On execution this trojan will download a second trojan file from:
http://202.190[REMOVED]/gaga/2malware.html
It is saved as C:\malware.html and then later renamed and executed as C:\malware2.exe. The second trojan is also detected as Trojan-Downloader:W32/MyDrill.A.
It will then create a copy of itself in the Window's System directory, usually C:\Windows\System32.
It will then Show the following Message Box:
It then creates an autostart registry entry for the downloaded Trojan in:
It also monitors the following active analyst tools and applications and shows a message box as an alert:
Command Prompt
Ethereal / WireShark
Olly Debug
Process Explorer
Registry Editor
RegShot
Windows Task Manager
WordPad
ZoneAlarm
Example:
It then exits whenever one of the said tools are detected as running.
With an additional anti-debugging check compared to the first trojan, the downloaded file when executed then downloads a third trojan from:
http://202.190[REMOVED]/gaga/3-malware.html
The download is saved as C:\malware.html and then later renamed and executed as C:\malware3.exe.
The third trojan is also detected as Trojan-Downloader:W32/MyDrill.A.
It then copies itself to the Window's System directory as malware3.exe showing the same message box for notification. An autostart entry in the registry is then created for itself as:
