TROJ_OBFUSC.TRR

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. It may be dropped by other malware.

It connects to certain URLs. It may do this to remotely inform a malicious user of its installation. It may also do this to download possibly malicious files onto the computer, which puts the computer at a greater risk of infection by other threats.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It may be dropped by the following malware:

• TROJ_ARTIEF.TRR

Autostart Technique

This Trojan adds the following registry entries to enable its automatic execution at every system startup:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
WINSVR = "{Malware Path and File name}"

Download Routine

This Trojan connects to the following malicious URLs:

• {BLOCKED}.{BLOCKED}.241.144
• {BLOCKED}.{BLOCKED}.204.207
• qq.{BLOCKED}rbe.org