TROJ_UNRUY.LPM

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other Details

This Trojan connects to the following possibly malicious URL:

• ns.{BLOCKED}omain.com

NOTES:

It enumerates the entries in the following registry keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

It then overwrites the files referenced in these registries with copies of itself.

It also overwrites the all running process, except system files, with the copy of itself. The legitimate files are saved as {filename}, the extension is deleted with the hidden attribute.