Trojan.InstallCube.152

Added to the Dr.Web virus database: 2015-04-13

Virus description added: 2015-04-13

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\PING.EXE' -n 1 -w 100 localhost

Terminates or attempts to terminate

the following user processes:

opera.exe
chrome.exe

Modifies file system :

Creates the following files:

<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\content.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon16.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon48.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\manifest.json
<Current directory>\mywidget.dat
<Current directory>\prefs.dat
<Current directory>\widgets.dat
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon128.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon128.png
%TEMP%\signal.dat
%TEMP%\d.bat
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon48.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\manifest.json
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\content.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon16.png
<Current directory>\background.js
<Current directory>\chrome.manifest
<Current directory>\core.xul
<Current directory>\content_ff.js
<Current directory>\install.rdf
<Current directory>\manifest.json
<Current directory>\content.js
<Current directory>\secref.txt
<Current directory>\myextension.json
<Current directory>\icon128.png
<Current directory>\config.xml
<Current directory>\index.html
<Current directory>\icon64.png
<Current directory>\icon16.png
<Current directory>\icon18.png
<Current directory>\icon48.png

Sets the 'hidden' attribute to the following files:

%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\content.js
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\manifest.json
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon16.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon128.png
%APPDATA%\Roaming\Opera Software\Opera Stable\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon48.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\content.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\manifest.json
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon16.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon128.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\bdmjagdcpkfpebaaffpafncgkleijako\2.4.2\icons\icon48.png

Deletes the following files:

<Current directory>\icon128.png
<Current directory>\config.xml
<Current directory>\icon64.png
<Current directory>\icon48.png
<Current directory>\index.html
<Current directory>\prefs.dat
<Current directory>\widgets.dat
<Current directory>\background.js
<Current directory>\mywidget.dat
<Current directory>\icon18.png
<Current directory>\secref.txt
<Current directory>\install.rdf
<Current directory>\manifest.json
<Current directory>\content.js
<Current directory>\chrome.manifest
<Current directory>\myextension.json
<Current directory>\icon16.png
<Current directory>\core.xul
<Current directory>\content_ff.js

Deletes itself.

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial