Home / malware

PDF

TrojanDropper:Win32/Notodar

First posted on 25 November 2014.
Source: Microsoft

Aliases :

There are no other names known for TrojanDropper:Win32/Notodar.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

• \.dll

It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKLM\software\microsoft\windows\currentversion\run

Sets value: ""
With data: "\rundll32.exe "%SystemRoot%\system32\.dll" update"



Payload


Connects to a remote host

We have seen this threat connect to a remote host, including:

• logopondr.com using port 80

Malware can connect to a remote host to:

• Check for an Internet connection.
• Download and run files (including updates or other malware).
• Report a new infection to its author.
• Receive configuration or other data.
• Receive instructions from a malicious hacker.
• Search for your PC location.
• Upload information taken from your PC.
• Validate a digital certificate.

It can stop some processes from running on your PC, including:

• svchost.exe

This malware description was published using automated analysis of file SHA1 46e76cd8dfe389bfea860d0af2f6367db7bfae87. Symptoms

The following can indicate that you have this threat on your PC:

• You see these files:
• \aponl.dll

• You see registry modifications such as:
  
  • In subkey: HKLM\software\microsoft\windows\currentversion\run
    Sets value: "wltprliuptfj"
    With data: "\rundll32.exe "%SystemRoot%\system32\aponl.dll" update"
    
    

Last update 25 November 2014

 

TOP