W32/DelpDldr.C!tr

Analysis

W32/DelpDldr.C!tr is a generic detection for a trojan. Since this is a generic detection, malware that are detected as W32/DelpDldr.C!tr may have varying behaviour.
Below are some of its observed characteristics/behaviours:

• This malware may drop any of the following file(s):
  
  • %WINDIR%\system32\winicons.exe : This file is a copy of the original malware itself.
  • c:\good_dogs.scr : This file is a copy of the original malware itself.
  • d:\prikol.scr : This file is a copy of the original malware itself.
  • e:\sysconf.exe : This file is a copy of the original malware itself.


• This malware may apply any of the following registry modification(s):
  
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\Currentversion\Run
    
    • WinIcons = %WINDIR%\system32\winicons.exe
    This automatically executes the dropped file every time the infected user logs on.
    


• This malware also attempts to create a process with payload of outbound connection to:
• irc.tut.by
• irc.mgts.by


• This malware also sends out spam message to companies and organizations with pornography links.

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.