TROJ_FAKEAV.HPF

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It deletes itself after execution.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan creates the following folders:

• %User Profile%\Application Data\529C50B4000DF75B69AD8E572830AC72

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Dropping Routine

This Trojan drops the following files:

• %User Profile%\529C50B4000DF75B69AD8E572830AC72\529C50B4000DF75B69AD8E572830AC72
• %User Profile%\529C50B4000DF75B69AD8E572830AC72\529C50B4000DF75B69AD8E572830AC72.exe

(Note: %User Profile% is the current user's profile folder, which is usually C:\Windows\Profiles\{user name} on Windows 98 and ME, C:\WINNT\Profiles\{user name} on Windows NT, and C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003.)

Other Details

This Trojan connects to the following possibly malicious URL:

• http://{BLOCKED}.173.15:65243/api/urls/?ts=3b91c6ff&affid=56300
• http://{BLOCKED}.173.15:65243/api/stats/install/?{random characters}

It deletes itself after execution.

This report is generated via an automated analysis system.