A forum for reverse engineering, OS internals and malware analysis 

TrojanDownloader:Win32/Chepvil

Forum for analysis and discussion about malware.

Re: Malware/Not classified

 #6071  by EP_X0FF
 Thu Apr 28, 2011 6:16 pm
Triple Helix wrote:New Infected Attachment email going around! VirusTotal reports 21/42 http://www.virustotal.com/file-scan/rep ... 1304009540 please move to the proper thread if necessary!

TH

This is trojan downloader Chepvil.
kkojjors.net zolotiyeyayca.ru nahuysplyaga.ru variantov.com pusk.exe Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.0; .NET CLR 1.0.2914) http://%s/f/g.php data= /f/s.php POST Content-Type: application/x-www-form-urlencoded TEMP
As payload it downloads and installs XP Total Security FakeAV. After removal registry repair is required, because FakeAV extends Exefile HKCR entry.
Posts moved.
Attachments
payload, pass: malware
(276.66 KiB) Downloaded 51 times
 Return to “Malware”