Win32/Chepdu.AC

Aliases:	Trojan-Downloader.Win32.Banload.atdp (Kaspersky), Trojan:Win32/Chepdu.P (Microsoft), PWS-Banker!fss trojan (McAfee)
Type of infiltration:	Trojan
Size:	241664 B
Affected platforms:	Microsoft Windows
Signature database version:	4988 (20100331)

Short description

Win32/Chepdu.AC is a trojan which tries to promote certain web sites. Trojan is probably a part of other malware.

Installation

When executed, the trojan creates the following files:

%system%\ctfmon_wc.exe (11264 B, Win32/BHO.NOU)

The following Registry entries are set:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\ctfmon.exe]
"Debugger" = "%system%\ctfmon_wc.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Browser Helper Objects\{B7C72896-62EA-3CA3-826A-3BB47D98CC8F}]
"IExplore" = 1
[HKEY_CLASSES_ROOT\D.1]
"(Default)" = "D"

The %random% represents a random number.

Other information

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (2) URLs. The HTTP protocol is used.

It can execute the following operations:

download files from a remote computer and/or the Internet
run executable files
open a specific URL address

The trojan collects the following information:

a list of recently visited URLs

The trojan can send the information to a remote machine.

The trojan can redirect results of online search engines to web sites that contain adware.

The trojan opens the following URLs in Internet Explorer:

http://xmlwindataweb.net/

The trojan may create the following files:

%programfiles%\KB%random%.exe

A string with variable content is used instead of %random%.