Trojan:Win32/Alureon.EP

Trojan:Win32/Alureon.EP is component of Win32/Alureon - a family of data-stealing trojans. Trojan:Win32/Alureon.EP is the detection for a component that drops and loads a driver component.

Installation

Trojan:Win32/Alureon.EP drops the following file, which is also detected as Trojan:Win32/Alureon.EP:

• %SystemRoot%\system32\spool\prtprocs\w32x86\.tmp

It may create the following registry entries as part of its installation process:

In subkey: HKLM\SYSTEM\ControlSet001\Control\Print\Providers\<random 3-digit number>
Sets value: "Name"
With data: "<system folder>\spool\prtprocs\w32x86\<random 3-digit number>.tmp"

In subkey: HKLM\SYSTEM\ControlSet001\Services\<random 5-digit number>
Sets value: "Imagepath"
With data: "<system folder>\drivers\<random 5-digit number>.tmp"

It deletes its originally running copy when the computer restarts.

Payload

Installs other malware
Trojan:Win32/Alureon.EP calls the "AddPrintProvidor function to load its dropped file into the "spoolsv.exe" process. In the "spoolsv.exe" process, Trojan:Win32/Alureon.EP drops a device driver under the "%SystemRoot%\system32\drivers", for example:

• %SystemRoot%\system32\drivers\790f.sys - may be detected as Trojan:WinNT/Alureon.S

Trojan:Win32/Alureon.EP then loads the driver immediately.

Analysis by Tim Liu