TROJ_FAKEAV.MPD

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Internet Security = "{Malware path and file name}.exe"

Other System Modifications

This Trojan adds the following registry entries:

HKEY_CURRENT_USER\Software\393CF9648D3D8BB3900DA2F0A17DEB0A
FRun = "0"

HKEY_CURRENT_USER\Software\393CF9648D3D8BB3900DA2F0A17DEB0A
O`ld = "Houdsodu!Rdbtshux"

HKEY_CURRENT_USER\Software\393CF9648D3D8BB3900DA2F0A17DEB0A
Q`ui = "{random string}"

It adds the following registry keys as part of its installation routine:

HKEY_CURRENT_USER\Software\393CF9648D3D8BB3900DA2F0A17DEB0A

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}e.bill3dpayusauto.com:443
• http://{BLOCKED}rtal360.com/404.php?id=48
• http://{BLOCKED}tsecurity.com/buynow.php?bid=48
• http://{BLOCKED}e.bill3dpayusauto.com:443
• http://{BLOCKED}echeck24.com/activate/activate.php?id=%uid%&mail=%email%&order_id=%order%
• http://{BLOCKED}einternational.com/support.php
• http://{BLOCKED}yhelpsupport.com