Trojan.MSIL.KILLAV.C

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

It does not have any information-stealing capability.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following processes:

• powershell Set-MpPreference -DisableRealtimeMonitoring $true
• powershell Set-MpPreference -DisableBehaviorMonitoring $true
• powershell Set-MpPreference -DisableBlockAtFirstSeen $true
• powershell Set-MpPreference -DisableIOAVProtection $true
• powershell Set-MpPreference -DisablePrivacyMode $true
• powershell Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
• powershell Set-MpPreference -DisableArchiveScanning $true
• powershell Set-MpPreference -DisableIntrusionPreventionSystem $true
• powershell Set-MpPreference -DisableScriptScanning $true
• powershell Set-MpPreference -SubmitSamplesConsent 2
• powershell Set-MpPreference -MAPSReporting 0
• powershell Set-MpPreference -HighThreatDefaultAction 6 -Force
• powershell Set-MpPreference -ModerateThreatDefaultAction 6
• powershell Set-MpPreference -LowThreatDefaultAction 6
• powershell Set-MpPreference -SevereThreatDefaultAction 6

Other System Modifications

This Trojan modifies the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows Defender\Features
TamperProtection = 0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableOnAccessProtection = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender\Real-Time Protection
DisableScanOnRealtimeEnable = 1

Propagation

This Trojan does not have any propagation routine.

Backdoor Routine

This Trojan does not have any backdoor routine.

Rootkit Capabilities

This Trojan does not have rootkit capabilities.

Process Termination

This Trojan terminates the following processes if found running in the affected system's memory:

• MBSetup.exe
• avg_free_antivirus_setup.exe
• avast_internet_security_setup.exe
• MCAFEE_INSTALLER.exe
• MCPR.exe
• Setup.exe
• kis21.0.1.235de-1G.exe
• bitdefender_online.exe
• NSDownloader.exe
• avast_free_antivirus_setup_online.exe
• avast.exe
• AVG.exe
• McAfee.exe
• AhnLab-V3.exe
• AlibabaSetup.msi
• AviraNoCloudInstaller.exe
• BaiduProtection.exe
• ClamAVInstaller.exe
• CMCSetup.exe
• CybereasonProtection.msi
• DrWebSetup.exe
• ESET-NOD32Installer.exe
• GridinsoftNoCloudSetup.exe
• IkarusProtection.exe
• JiangminInstaller.msi
• K7AntiVirusSetup.exe
• K7GWInstaller.exe
• NANO-AntivirusSetup.exe
• PaloAltoNetworksInstaller.msi
• QuickHealSetup.exe
• SUPERAntiSpywareInstaller.exe
• TACHYONSetup.exe
• TEHTRISInstaller.msi
• TencentProtection.exe
• VBA32Setup.exe
• VirITInstaller.msi
• ViRobotSetup.exe
• WebrootInstaller.exe
• WithSecureSetup.msi
• XcitiumInstaller.exe
• YandexProtectionSetup.exe
• ZillyaInstaller.msi
• ZonerSetup.exe
• AvastMobileInstaller.apk
• TrendMicro-HouseCall.exe
• VIPRESetup.exe
• VaristInstaller.msi
• TrendMicroInstaller.exe
• TrellixFireEyeSetup.exe
• SymantecSetup.exe
• SophosInstaller.exe
• SkyhighSWGSetup.exe
• SentinelOneStaticMLInstaller.exe
• SecureAgeSetup.exe
• SangforEngineZeroInstaller.msi
• RisingSetup.exe
• PandaInstaller.exe
• MaxSecureSetup.exe
• MAXInstaller.exe
• LionicSetup.exe
• KingsoftInstaller.exe
• GDataSetup.exe
• eScanInstaller.exe
• EmsisoftSetup.exe
• ElasticInstaller.exe
• DeepInstinctSetup.exe
• CynetInstaller.msi
• CylanceSetup.exe
• CrowdStrikeFalconSetup.exe
• BkavProInstaller.exe
• BitDefenderThetaSetup.exe
• BitDefenderInstaller.exe
• Antiy-AVLSetup.exe
• ArcabitInstaller.exe
• ALYacSetup.exe
• SystemSettingsAdminFlows.exe

Information Theft

This Trojan does not have any information-stealing capability.

Other Details

This Trojan does the following:

• It checks if the current user has administrator privileges.
• It checks for the presence drivers\etc\hosts in the system.
• It checks for installed security-related services by using the following format:
  • 127.0.0.1 {domain name}
  • 127.0.0.1 www.{domain name}
• It checks for the following domain names:
  • virustotal.com
  • avast.com
  • totalav.com
  • scanguard.com
  • totaladblock.com
  • pcprotect.com
  • mcafee.com
  • bitdefender.com
  • us.norton.com
  • avg.com
  • malwarebytes.com
  • pandasecurity.com
  • avira.com
  • norton.com
  • eset.com
  • zillya.com
  • kaspersky.com
  • usa.kaspersky.com
  • sophos.com
  • home.sophos.com
  • adaware.com
  • bullguard.com
  • clamav.net
  • drweb.com
  • emsisoft.com
  • f-secure.com
  • zonealarm.com
  • trendmicro.com
  • ccleaner.com
  • gdata.de
  • arcabit.com
  • ahnlab.com
  • securelist.com
  • quickheal.com
  • vipre.com
  • cyren.com
  • comodo.com
  • fortinet.com
  • ikarussecurity.com
  • maxsecureantivirus.com
  • baidu.com
  • antiy.net
  • kingsoft.com
  • superantispyware.com
  • spybot.info
  • pcmatic.com
  • hitmanpro.com
  • sophoshome.com
  • defender-pro.com
  • norman.com
  • webroot.com
  • qihoo.com
  • tencent.com
  • baesystems.com
  • carbonblack.com
  • reasonlabs.com
  • lenovo.com
  • cyradar.com
  • intego.com
  • panda.com
  • surfshark.com
  • webroot.com
  • nordvpn.com

It does not exploit any vulnerability.