Avira Virus Lab

‹ Back

TR/Dldr.Agent.254464.4

Summary
  • Name
    TR/Dldr.Agent.254464.4
  • Date discovered
    Oct 1, 2015
  • VDF version
    7.11.183.160 (2014-11-07 09:19)
Description

The term 'TR' denotes a trojan horse that is able to spy out data, violate your privacy, or perform unwanted modifications to the system.

The term 'Dldr' denotes part of a malware sample which downloads another malicious file from the Internet.

  • VDF
    7.11.183.160 (2014-11-07 09:19)
  • Aliases
    AVG: Generic6.BRWT
    Dr. Web: Adware.Downware.11745
    G Data: Gen:Variant.Adware.Graftor.200386
    Kaspersky Lab: HEUR:Trojan-Downloader.Win32.Generic
    Bitdefender: Gen:Variant.Adware.Graftor.200386
    ESET: Win32/Adware.Imali.E application
  • Files
    The following files are created:
    • %TEMPDIR%\fsd1.tmp
    • %temporary internet files%\Content.IE5\QH9ZEEV0\FinalInstaller_dotnet4[1].exe
    • %TEMPDIR%\fsd1.exe
    The following files are changed:
    • %temporary internet files%\Content.IE5\index.dat
    • %USERPROFILE%\Cookies\index.dat
    • %USERPROFILE%\Local Settings\History\History.IE5\index.dat
  • Registry
    The following registry entries are added:
    • HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings ("ProxyEnable": dword:00000000)
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TAPISRV\0000\Control ("ActiveService": "TapiSrv")
    • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_RASMAN\0000\Control ("ActiveService": "RasMan")
  • HTTP Requests
    • www.*****.info/?domain=afsbdfgds.net&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=362&setup_id=800
    • events.*****fgds.nethttp://events.afsbdfgds.net/?p=cHViX2lkPTM2MiZzZXR1cF9pZD04MDAmZXh0cmFfcGFyYW1zPXN0YXJ0byZldmVudD0xJnNpZD02NjYmbWFjPTc3Nw==
    • installer.*****fgds.nethttp://installer.afsbdfgds.net/installer.php?id=800&env=2&setup_version=42.4&srcid=&dbb=Z2c=&pub_id=362&os=5.1&dotnet=4
    • bi.*****fgds.nethttp://bi.afsbdfgds.net/?pageNumber=0&event=document_ready&description=window_of_setup_loaded&pub_id=362&setup_id=800
    • bi.*****fgds.nethttp://bi.afsbdfgds.net/?pageNumber=1&event=window_close&description=user_clicked_close_button&pub_id=362&setup_id=800
    • bi.*****fgds.nethttp://bi.afsbdfgds.net/?setup_closed&ReportAdvPath&adv_path=&pub_id=362&setup_id=800
    • events.*****fgds.nethttp://events.afsbdfgds.net/?p=cHViX2lkPTM2MiZzZXR1cF9pZD04MDAmZXh0cmFfcGFyYW1zPWZpbml0byZldmVudD03JnNpZD02NjYmbWFjPTc3Nw==