Comment
Author: Admin | 2025-04-28
This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.Arrival DetailsThis Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.InstallationThis Trojan adds the following processes: "%User Temp%\is-N2V5T.tmp\6cf8a9f031b45f70be3e66e7acc7449cda15fa34.tmp" /SL5="$B01A0,18080539,54272,%User Temp%\6cf8a9f031b45f70be3e66e7acc7449cda15fa34.exe""%User Temp%\is-3J8P4.tmp\InstallCheck.exe" /verysilent /v=1.2.3 /lc=en"%System%\regsvr32.exe" /s "%System%\MSVBVM60.DLL""%System%\regsvr32.exe" /s "%System%\MSCOMCT2.OCX""%System%\regsvr32.exe" /s "%System%\MSCOMCTL.OCX""%System%\regsvr32.exe" /s "%System%\MSMAPI32.OCX""%Program Files%\PDFCreator\PDFCreator.exe" /RegServer"%Windows%\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "%Program Files%\PDFCreator\PlugIns\pdfforge\pdfforge.dll" /codebase"%User Temp%\is-3J8P4.tmp\pdfforgeToolbar-stub-1.exe" /S /V"/qn CHANNEL_ID=827316 D_WSD=1" /UM"http://download.{BLOCKED}serbar.com/vkits/dlv1/827316/pdfforgeToolbar.msi"http://www.{BLOCKED}ge.org/pdfcreator/welcome "%User Temp%\is-KBOE1.tmp\InstallCheck.tmp" /SL5="$16014A,54272,54272,%User Temp%\is-3J8P4.tmp\InstallCheck.exe" /verysilent /v=1.2.3 /lc=en%System%\spoolsv.exe%System%\svchost.exe -k WerSvcGroup"%Program Files%\Internet Explorer\iexplore.exe" SCODEF:2524 CREDAT:79873It creates the following folders: %User Temp%\is-3J8P4.tmp\_isetup%Program Files%\PDFCreator\Scripts\RunProgramBeforeSaving%Program Files%\PDFCreator\Scripts%Program Files%\PDFCreator\COM\VB6%Program Files%\PDFCreator\languages%All Users Profile%\Microsoft\Windows\Start Menu\Programs\PDFCreator\Licenses%Application Data%\pdfforge\Images2PDF%Program Files%\PDFCreator\GS9.04\gs9.04%Program Files%\PDFCreator\COM\Dot Net%User Temp%\PDFCreator%Program Files%\PDFCreator\Scripts\RunProgramAfterSaving%User Temp%\is-JHQ5S.tmp\_isetup%Program Files%\PDFCreator\COM\Ruby%Program Files%\PDFCreator\PlugIns\pdfforge%Program Files%\PDFCreator\COM%Program Files%\PDFCreator\GS9.04\gs9.04\Bin%Program Files%\PDFCreator\COM\Perl%Program Files%\PDFCreator\COM\Windows Scripting Host\JScripts%Application Data%\pdfforge%Program Files%\PDFCreator\Images2PDF%Program Files%\PDFCreator\Images2PDF\Languages%Program Files%\PDFCreator\COM\Dot Net\VS2005\Visual Basic%Program Files%\PDFCreator\COM\Python%Program Files%\PDFCreator\COM\Dot Net\VS2005\Visual Basic\Sample1%User Temp%\{E3D276AF-8F4C-48C6-9741-7F04A9F362A2}%Program Files%\PDFCreator\GS9.04%Program Files%\PDFCreator\COM\VB6\Sample1%Program Files%\PDFCreator\COM\Dot Net\VS2005%Program Files%\PDFCreator\COM\VB6\Sample2%Program Files%\PDFCreator\COM\MS Office%Program Files%\PDFCreator\Toolbar%Program Files%\PDFCreator\COM\Windows Scripting Host%Program Files%\PDFCreator%Program Files%\PDFCreator\PlugIns%Program Files%\PDFCreator\COM\Dot Net\VS2005\Visual Basic\Sample2%Program Files%\PDFCreator\COM\Dot Net\VS2005\C#%Program Files%\PDFCreator\COM\Dot Net\VS2005\C#\Sample2%Program Files%\PDFCreator\COM\WinBatch%All Users Profile%\Microsoft\Windows\Start Menu\Programs\PDFCreator\Images2PDF%All Users Profile%\Microsoft\Windows\Start Menu\Programs\PDFCreator%Program Files%\PDFCreator\COM\Windows Scripting Host\VBScripts%Program Files%\PDFCreator\COM\Dot Net\VS2005\C#\Sample1%Program Files%\PDFCreator\COM\DOTNET Scripting Host%Program Files%\PDFCreator\GS9.04\gs9.04\Lib(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).. %All Users Profile% is the common user's profile folder, which is usually C:\Documents and Settings\All Users on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\ProgramData on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit). . %Application Data% is the current user's Application Data folder, which is usually C:\Documents and Settings\{user name}\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Roaming on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)Autostart TechniqueThis Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SpoolerRequiredPrivileges = "\x00\x00\x00\x00\x00\x00\x00"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SpoolerRequiredPrivileges = "\x00\x00\x00\x00\x00\x00\x00\x00"It registers as
Add Comment