TrojanDropper:Win32/Kheagol.C

TrojanDropper:Win32/Kheagol.C is a detection for the trojan dropper component of the Win32/Kheagol malware family. It installs a password-stealing banking trojan (detected as PWS:Win32/Kheagol.F) and modifies system DLLs to allow automatic execution of the trojan when Internet Explorer or Mozilla Firefox is run.

Payload

Drops other malware
TrojanDropper:Win32/Kheagol.C drops a randomly-named file with the following name format:

• t5<1 to 2 random letters>.dll (such as t5y.dll, t5g.dll, t5cs.dll, and so on)

Modifies system files
TrojanDropper:Win32/Kheagol.C modifies a copy of the following system files:

• <system folder>\imm32.dll
• <system folder>\version.dll

Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

These files are often loaded by various programs, including Internet Explorer and Mozilla Firefox. TrojanDropper:Win32/Kheagol.C modifies the files by adding a function that references the dropped DLL. As a result, when either of these browsers are run and the DLL files are loaded, then the dropped trojan is loaded as well.

Analysis by Rodel Finones