Threat behavior
Win32/Huhk.7469 is a cavity virus that infects host files without increasing the size of the infected file. It does this by placing parts of itself in blocks of zeros found within the host.
Installation
When executed, the virus decrypts and reconstructs itself in the affected computer's memory. The virus then attempts to infect "Explorer.exe".
It does this by initially disabling System Restore and copying <system folder>\dllcache\Explorer.exe to the %Temp% directory, for example C:\Users\<user name>\AppData\Local\Temp.
It then infects "Explorer.exe" and copies it back to the Windows directory and <system folder>\dllcache.
When the infected Explorer.exe is executed and the virus gains control, the virus hooks the CreateProcessW API to redirect to its own code. The virus also checks the process name and infects the associated file, if appropriate.
Spreads via…
File infection
The virus searches through any available removable drives and connected network resources for suitable files to infect.
The virus avoids infecting files with the following filenames or associated process names:
readbook.exe
qq.exe
icesword.exe
aspack.exe
iris.exe
iexplore.exe
navapw32.exe
navapsvc.exe
nmain.exe
navw32.exe
kvfw.exe
kavsvcui.exe
kavpfw.exe
kav32.exe
kvxp.kvxp.kxp
kvsrvxp.exe
kvmonxp.kxp
kvwsc.exe
kavsvc.exe
kwatchui.exe
ravmond.exe
ravmon.exe
ravtimer.exe
rising.exe
rav.exe
ravmon.exe
ravtimer.exe
iparmor.exe
trojanhunter.exe
thguard.exe
pfw.exe
eghost.exe
mailmon.exe
firefox.exe
The virus also avoids infecting files that contain the following strings in their paths:
windows
winnt
system32
system
dllcache
Payload
Downloads and executes arbitrary files
The virus hooks the "connect" API to redirect to its own code, and attempts to contact the domain 'vampire009tw.xxxy.info' to download and execute a file.
Additional information
The virus may also contact the domain 'c34.statcounter.com', presumably to track its infection rate.
Analysis by Ray Roberts
Prevention
