A worm installs and runs eMule

Relatively atypical, the worm Changeup this feature to install and run on the Windows computer from his victim eMule P2P client.

Polymorphic worm, W32.Changeup appeared for the first time there is almost a year. Once it infects a computer, it aims to repatriate various threats such as Trojan horses to harmful actions. To ensure its dissemination, Changeup just adopted a singular behavior uncovered by Symantec.

Several threats are used to analyze the contents of a target computer to identify P2P applications and submit a copy of their code in shared folders. Changeup there is more frankly and claims the right to directly install and run a P2P client well-known eMule.

In file sharing, eMule, Changeup create various copies of itself that can be released, if at no protective measures are no obstacles to sharing. To disguise its actions from other users, share files take the form of ZIP archives that use different names from more than 45,000. These files borrow the names of legitimate software, cracks and more generally of all those who are likely to generate an exchange.

For each ZIP archive, Changeup adds some random bits so that the files have a different hash. Otherwise, all ZIP files (which contain an infected executable) would be returned to the same research by inspecting the different versions of a file available, which obviously would arouse suspicion. According to Symantec, it also allows the threat to pass through some antivirus detection statistics (based on file hash).