Win32:Karagany-MX

Win32:Karagany-MX is a dangerous Trojan infection that has recently been distributed using a fake email message from Vodafone. One of the reason why the email message containing Win32:Karagany-MX has managed to bypass many spam filters is because this email message contains links to legitimate websites associated with Vodafone apart from the malicious email attachment containing the Win32:Karagany-MX Trojan. If you have been exposed to the malicious email message containing Win32:Karagany-MX, ESG security researchers strongly advise computer users to use an anti-malware application of their choice to scan their computer for possible Trojan infections such as Win32:Karagany-MX.

There are several variants of the malicious email message that contains the Win32:Karagany-MX Trojan but, essentially, they are all the same. The malicious email will often be asked to open a file attachment that it claims is a picture in JPG format. In fact, this file is actually a compressed archive that contains a file named Vodafone_MMS.jpg.exe. As you can see, criminals use an old trick, adding a fake file extension to the file (in this case '.jpg') to mask the fact that this malicious file is actually an executable file with the EXE extension. While more advanced versions of this scam will change the file's icon so that Win32:Karagany-MX will appear to be a JPG file, the criminals behind this scam have not bothered to do so, and this malicious file will appear with an executable application icon.

Win32:Karagany-MX is a Trojan dropper that ensures that Win32:Karagany-MX runs automatically as soon as the infected computer starts up. Win32:Karagany-MX is typically associated with a variant of the Citadel Trojan, a known backdoor Trojan that opens an unauthorized port in the infected computer's security so it can be given further guidance from the criminals responsible for the Win32:Karagany-MX infection. Unlike more advanced versions of these kinds of malware infections, the Win32:Karagany-MX Trojan does not connect to a remote server or send out information about the infected computer, it only 'listens' on this open port for instructions. While this version of the Win32:Karagany-MX Trojan appears to remain dormant (it has not been activated yet to carry out attacks), ESG security researchers have observed that Win32:Karagany-MX still does not initiate an attack. However, as long as the Win32:Karagany-MX Trojan remains on your computer, the potential for criminals to connect to your computer using this open port remains.