This Trojan downloads another program to the computer and launches it for execution without the user's knowledge. It is a Windows application (PE EXE file) and is 56 320 bytes in size. It is packed using an unknown packer and is written in C++.
After launching, the Trojan checks the name of its original file. If the name of the malware's executable file does not contain the string "sdcml.exe", it copies its executable file to the current user's temporary files directory under the name:
where rnd and rnd2 are random sequences of letters. It then launches a copy of its file for execution. In order to ensure that it is launched automatically each time the system is restarted, the Trojan adds a link to its executable file in the system registry autorun key:
where rnd3 is a random sequence of letters.
To ensure that its process is unique within the system, the Trojan creates a unique ID with the name:
To obtain additional parameters, the malware connects to the malicious user's server, sending an HTTP request of the following format in cycles of 30-second intervals:
GET /mod/ HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: ai***hk.com Connection: Keep-Alive
At the time of writing, this link was inactive.
After obtaining additional data from the server, the Trojan obtains access to the reading and writing of files located on the ftp server:
The malware also searches for the following strings:
index indix default main home login auth user check head headerA footer top start counters redirect go in out feedback feed contact support page news blog forum stat process upload payment test restore
in files with the extensions:
php htm html aspxand also in the files "htm.php" and "html.php".
If your computer does not have an antivirus, and is infected by this malicious program, follow the instructions below to delete it:
- Use Task Manager to terminate the process "iexplore.exe".
- Delete the original Trojan file (its location will depend on how the program originally penetrated the infected computer).
- Delete the following system registry key parameter:
- Delete the following file:
- Empty the Temporary Internet Files directory, which contains infected files (How to delete infected files from Temporary Internet Files folder?):
%Temporary Internet Files%
- Perform a full scan of the computer using Kaspersky Anti-Virus with up-to-date antivirus databases (download a trial version).