Troj/Delf-KQ is a Trojan for the Windows platform.
Troj/Delf-KQ includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Delf-KQ copies itself to the Windows folder as XPsys.exe.
Troj/Delf-KQ will attempt to download the file 24997.exe to the Windows folder
and run it.
The following registry entry is created to run XPsys.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
XPsys
<Windows folder>\XPsys.exe
The following registry entries are set, affecting internet security:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1200
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1201
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1400
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1406
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
1C00
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
1200
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
1406
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
1C00
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1200
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1201
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1406
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
1C00
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
1200
3
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
1C00