#Awesome screenshot trojan driver#

Let us look at the IDA-View (First Tab by default) in Graph View AND also open the EXE in Olly 2.01. That itself, is an initial sign that this does not look like a very large executable. YouвЂ™ll see that there are not too many custom functions (just above 20) starting with sub_ as per IDA. So I opened it in IDA and took a quick look at the Functions. Lets now look at this file more closely and understand it more clearly. The file ~acrd~tmp.exe was written by the dropper to C:Documents and SettingsarvindLocal SettingsTemp~acrd~tmp~.exe as mentioned in the previous article. If you have trouble understanding anything, it is best that you look at my previous article and then come here. And yesвЂ¦I will go a little faster this time :). This time we will study the little EXE that the dropper put into a Temp folder, and look at how the 2 Skype executables landed up on disk, as well as a little bit of Process Injection that the malware has done. These 2 files are called SkypeLauncher.exe and SkypePMLauncher.exe. In addition it also drops 2 files that seem to be related to Skype in some way.

#Awesome screenshot trojan driver#

Okay.enough of the suspense.what is this new piece to the puzzle? The dropper, as mentioned previously drops a Temp EXE file, a DLL and a driver to the disk. I reset my VM to a clean snapshot and ran the trojan againвЂ¦but had to do a little patching to ensure that those paths got visited.

For some reason that bit had not got triggered at all. I was looking through the dropper again and found, in the disassembly particular path that looked interesting. ThereвЂ™s a slight change to those plans though. In my next article what IвЂ™d been planning to do was to reverse the DLL and then the driver. In the last article, I discussed in quite some detail how exactly the dropper for Bundestrojaner worked.