This thread contains posts moved from thread TrojanDownloader:Win32/Harnig.S and its payload
This trojan downloader along with TDL3 was previously part of malware bundle distributed by keygen.name malware distribution site
/* original message below */
Jaxryley wrote:Dropped by a ltpro32.exeltpro32.exe multiple downloader.
http://www.virustotal.com/file-scan/rep ... 1288860456
Cryptor + UPX 2.90
Open > nul /c del COMSPEC ver62 %sjaqlgavztf.php?adv=adv447&code1=%s&code2=%s&id=%d&p=%s %u %sjesggmkk.exe %stkbvqkfdls.php?adv=adv447 %swrbq.exe %sgtovqub.php?adv=adv447 %shslyg.exe %sgtbwqys.php?adv=adv447 %samrvomw.exe %simdysnucxe.php?adv=adv447 %sdjlyquj.exe %scfjeyt.php?adv=adv447 %sfgyxjx.exe %sxbsnusnvp.php?adv=adv447 %sxitb.exe %saaick.php?adv=adv447 %sbwffwif.exe %serztbwqyg.php?adv=adv447 %skdyejm.exe %srhlgoidbwq.php?adv=adv447 %snhijh.exe %sermtbvqls.php?adv=adv447 %staerwln.exe %soovqlsahc.php?adv=adv447 %s%d %sivcxfzu.php?adv=adv447 http://dapaper.com/ibemh/ http://cacrazy.com/ibemh/ C:\ psapi.dll ddraw.dll urlmon.dll shell32.dll kernel32.dll user32.dll wininet.dll SeDebugPrivilege ntdll.dll NtMapViewOfSection \svchost.exe explorer.exedichmnv.sys
Rootkit driver. Looks like old good Rustock alike clon.
Performs DKOH based modification for CmpRegistryType object Parse procedure. Uses CmRegistry callback to filter registry requests (rootkit driver registry entries hiding/protection from deletion).
Intercepts IRP_MJ_CREATE, IRP_MJ_INTERNAL_DEVICE_CONTROL handlers for NTFS.sys
NTFS hooks used to deny read/write access to rootkit driver.
Ring0 - the source of inspiration
