Win32/Gatsorm [Threat Name] go to Threat
Win32/Gatsorm.A [Threat Variant Name]
| Category | trojan |
| Size | 208896 B |
| Aliases | Trojan:Win32/Gatsorm.A (Microsoft) |
| W32/Stration.gen@MM.virus (McAfee) |
Short description
Win32/Gatsorm.A is a trojan which tries to download other malware from the Internet.
Installation
When executed, the trojan creates the following files:
- %windir%\wdmaud.drv (49152 B)
- %appdata%\tmp.dat (98304 B)
The trojan may create the following files:
- %appdata%\dmutils.nls
- %localappdata%\dmutils.nls
- %appdata%\dpnet.nls
- %localappdata%\dpnet.nls
- %appdata%\dsound.nls
- %localappdata\dsound.nls%
- %appdata%\audiosrv.nls
- %localappdata%\audiosrv.nls
- %appdata%\adsldp.nls
- %localappdata%\adsldp.nls
- %appdata%\eapolqec.nls
- %localappdata%\eapolqec.nls
- %homedrive%%homepath%\Local Settings\Temp\tag.tmp
Information stealing
The trojan collects the following information:
- computer IP address
- memory status
- CPU information
- operating system version
The trojan attempts to send gathered information to a remote machine.
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a list of (11) URLs. The HTTP protocol is used.
It can execute the following operations:
- download files from a remote computer and/or the Internet
- run executable files
- update itself to a newer version
- terminate running processes
- send gathered information