Home / malware TrojanDownloader:Win32/Derkef.A
First posted on 11 June 2014.
Source: MicrosoftAliases :
There are no other names known for TrojanDownloader:Win32/Derkef.A.
Explanation :
Threat behavior
Installation
TrojanDownloader:Win32/Derkef.A copies itself to %windir%\def.exe. The malware changes the following registry entries so that it runs each time you start your PC:
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "winnet32"
With data: "c:\windows\def.exe"
Payload
Contacts remote host
TrojanDownloader:Win32/Derkef.A might contact a remote host at extra-cam.netne.net using port 80. Commonly, malware does this to:This malware description was produced and published using automated analysis of file SHA1 bd837201b6c87bd04120e4de7fe1ebfb46a31ed4.Symptoms
- Report a new infection to its author
- Receive configuration or other data
- Download and run files, including updates or other malware
- Receive instructions from a remote hacker
- Upload data taken from your PC
System changes
The following could indicate that you have this threat on your PC:
- You have these files:
%windir%\def.exe
- You see these entries or keys in your registry:
Sets value: "winnet32"
With data: "c:\windows\def.exe"
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunLast update 11 June 2014