When first run Mitglieder.GB copies itself to %WINDIR%\system32\anti_troj.exe and drops the file ntimage.gif to the same directory. It opens Internet Explorer to view the gif picture. The picture looks like this:
It adds the value:
"anti_troj"="%WINDIR%\system32\anti_troj.exe"
to the keys:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
and the as value:
"FirstRRRun"=1
to the key:
[HKEY_CURRENT_USER\Software\FirstRRRun]
as an infection marker.
The trojan runs in an endless loop checking if the infected computer is connected to the internet and if so, tries to download a file named a.php from multiple URLs. It creates directory %WINDIR%\exefld and downloads the file there under a random name. If a file is downloaded then it's executed.
| 