TROJ_UNRUY.SMP2

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following copies of itself into the affected system:

• {Any folder}\{user's filename}.exe

Other Details

This Trojan connects to the following possibly malicious URL:

• {BLOCKED}s.{BLOCKED}3-domain.com

It does the following:

• It renames the user's executable files and sets the attribute of the original executable files as hidden:
  • {user's filename}.exe to {user's filename}
    such as C:\Program Files\7-Zip\7z.exe to 7z (with attribute hidden)
• It then drops copies of itself using the filename of the user's executable files