At start-up, the Trojan requests and loads a DLL from the author's command-and-control server.Link (via Deep Links)
This then downloads a pirated copy of Kaspersky AntiVirus for WinGate into a concealed directory on the infected system.
It patches the license signature check in-memory in the Kaspersky DLL to avoid having Kaspersky refuse to run due to an invalid or expired license, Stewart said.
Ten minutes after the download of the DLL, it begins to scan the system for malware, skipping files which it detects are part of its own installation.
"Any other malware found on the system is then set up to be deleted by Windows at the next reboot," he added.
I write books. My latest is a YA science fiction novel called Homeland (it's the sequel to Little Brother). More books: Rapture of the Nerds (a novel, with Charlie Stross); With a Little Help (short stories); and The Great Big Beautiful Tomorrow (novella and nonfic). I speak all over the place and I tweet and tumble, too.