Trojan.BPlug.1

Technical Information

Malicious functions:

Terminates or attempts to terminate

the following user processes:

chrome.exe

Modifies file system :

Creates the following files:

<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\zip.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\sqlite3.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\firefox.xpi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\curl1_750640506
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\x64.msi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\x86.msi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\background.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\background.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\libcurl.dll
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\options.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\manifest.json
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\content.js

Deletes the following files:

<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\background.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\background.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\content.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\options.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\manifest.json
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\zip.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\libcurl.dll
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\firefox.xpi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\sqlite3.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\x86.msi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\x64.msi

Moves the following files:

from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\background.js.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\background.js
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\background.html.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\background.html
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\content.js.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\content.js
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\options.html.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\options.html
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\manifest.json.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\chrome\manifest.json
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\zip.exe.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\zip.exe
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\libcurl.dll.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\libcurl.dll
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\firefox.xpi.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\firefox.xpi
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\sqlite3.exe.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\sqlite3.exe
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\x86.msi.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\x86.msi
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\x64.msi.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil415201209\x64.msi

Network activity:

Connects to:

'ex######n.infoenhancer.com':80

TCP:

HTTP POST requests:

ex######n.infoenhancer.com/install

UDP:

DNS ASK ex######n.infoenhancer.com

Miscellaneous:

Searches for the following windows:

ClassName: 'AutoHotkey' WindowName: '<Full path to virus>'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial