1 min read

[Malware Review] Pandora's removable device

Loredana BOTEZATU

March 31, 2010

Promo Protect all your devices, without slowing them down.
Free 30-day trial
[Malware Review] Pandora's removable device

Moreover, the Trojan will be difficult to spot as it disables the “Show hidden files” option in Windows Explorer.

It creates two copies of itself with two different file extensions: an “.exe” one and a “.scr” one, while keeping a previously generated name. Plus it makes copies of itself under random names in the “%Documents and settings%” folder. In order to execute itself repeatedly, Chinky generates a registry key in HKCUSoftwareMicrosoft WindowsCurrentVersion Run%RandomName% with the value %Documents and settings% %UserName% %RandomName%.exe.

Just as most other recent malware, Trojan.VB.Chinky.U also has a worm component which allows it to spread using flash drives and other media, such as USB external hard disks and even mapped drives across the network.

The “autorun.inf” component assures the automatic execution of the “.exe” file and it also changes the icon of the infected removable drive into a Windows standard folder icon. Six more shortcut files pointing to the “.scr” file are created and displayed on the removable drive with different names and icons: New Folder, Passwords, Documents, Music, Documents, and Pictures.

This is not the end of it. The downloader component of Trojan.VB.Chinky.U would subsequently drop and install other e-threats on the infected system, such as backdoors, password stealers, Rogue AV and other offers that are too hot to handle.

tags


Author


Loredana BOTEZATU

A blend of product manager and journalist with a pinch of e-threat analysis, Loredana writes mostly about malware and spam. She believes that most errors happen between the keyboard and the chair.

View all posts

You might also like

Bookmarks


loader