TROJ_BUBLIK.KA

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan adds the following folders:

• {All User's Profile}\{random}
• {All User's Profile}\{random}\{random 2}
• {All User's Profile}\{random}\{random 2}\{random 3}
• {All User's Profile}\{random}\{random 2}\{random 3}\{random 4}

It drops the following files:

• {All User's Profile}\{random filename}

It drops the following copies of itself into the affected system:

• {All User's Profile}\{random}\{random 2}\{random 3}\{random 4}\{random filename}.exe

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
{random} = "{All User's Profile}\{random}\{random 2}\{random 3}\{random 4}\{random filename}.exe"

Other System Modifications

This Trojan adds the following registry entries as part of its installation routine:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion
Explore = "BD74A42C-7664A42A"

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}c14.blogspot.com.br
• {BLOCKED}suszas.hu
• {BLOCKED}res.com.br