TROJ_NITOL.CU

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system and executes them:

• %WINDOWS%\{random filename}.exe

Autostart Technique

This Trojan registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Stuvwx Abcdefgh Jkl
ImagePath = "%WINDOWS%\{random filename}.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Stuvwx Abcdefgh Jkl
DisplayName = "Stuvwx Abcdefgh Jklmnopq Stuv"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Stuvwx Abcdefgh Jkl
Start = "2"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Stuvwx Abcdefgh Jkl
Description = "Stuvwxya Cdefghijk Mnopqrs Uvwxyabc Efg"

It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\Stuvwx Abcdefgh Jkl

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}gk.{BLOCKED}njkc.com:8090
• {BLOCKED}kc.ddns.net

It deletes itself after execution.