4/29: Lineag-DL Trojan Copies Itself, Creates Files

Troj/Lineag-DL is a Trojan for the Windows platform.

When first run Troj/Lineag-DL copies itself to System\kxvo.exe and creates the following files:

Temp\ty4s.dll
Temp\w32l.sys
System\fool0.dll
System\ieso0.dll

The file ieso0.dll is detected as Mal/Behav-204.

The following registry entry is created to run kxvo.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run kxva
System\kxvo.exe

The file ieso0.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE7C3CF0-4B15-11D1-ABED-709549C10000}
HKCR\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}

Technical details can be found at this Sophos page.