Weekly Report on Viruses and Intruders – Nugache.A Worm, Hiviti.A and Banker.CTD Trojans

A worm, Nugache.A, the backdoor Trojan Hiviti.A and the Banker.CTD Trojan are the focus of this week’s PandaLabs report.

Nugache.A can spread in three different ways: exploiting the LSSAS and RPC DCOM known software vulnerabilities, through the popular MSN Messenger application, or via email.

When installed on a computer, Nugache.A creates a copy of itself in the Windows system directory, in a file with the name MSTC.EXE. In addition, it generates several Windows registry entries. Having done this, it opens several communication ports to connect to a series of IP addresses from which it receives remote instructions across P2P networks, allowing an attacker to take malicious action on the affected system.

Hiviti.A is a backdoor Trojan that cannot spread on its own, but requires the intervention a malicious user. When it is installed on a computer, it creates a copy of itself under the name LOADCNTR.EXE, it makes new entries in the Windows registry, and injects itself in the explorer.exe process so that it is not noticed by users. In this way, the Trojan waits to log keystrokes made by the user, thereby accessing all types of confidential information, such as user names, passwords, etc.. The data collected is then sent to certain predetermined email addresses.

We finish this week’s report with Banker.CTD, a new banker Trojan, i.e. designed to steal confidential data related to online banking services.

Banker.CTD waits for the user to access web pages belonging to certain banks, including Banking, Bradesco, NetBanking, Santander and Sudameris, in order to log the data entered by the user. It then sends the data to a certain email address.

Banker.CTD requires the intervention of an attacker in order to reach computers. The means of distribution used vary and include floppy disks, CD-ROMs, email messages with attachments, Internet download, files transferred via FTP, IRC channels, P2P file sharing networks, etc.