Home / malware

PDF

TrojanDropper:Win32/Dexel.A

First posted on 15 February 2019.
Source: Microsoft

Aliases :

TrojanDropper:Win32/Dexel.A is also known as Trojan-Dropper.Win32.FrauDrop.ajrit, Mal_OtorunP.

Explanation :

Installation This threat can create files on your PC, including:
c:usersadministratorappdatalocal emp{09a405f0-0a5f-4cfe-a424-a56e9a3186f}windefender.exe c:usersadministratorappdatalocal empxelag.exe c:usersadministratorappdata
oamingmicrosoftwindowsstart menuprogramsstartupdownload_manager.exe

It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKCUSoftwareMicrosoftWindowsCurrentVersionRun
Sets value: "Msiexec"
With data: "c:usersadmini~1appdatalocal emp{09a405f0-0a5f-4cfe-a424-a56e9a3186f}windefender.exe"
Sets value: "MSKERNEL"
With data: "c:usersadmini~1appdatalocal empxelag.exe"
In subkey: HKLMSoftwareMicrosoftWindowsCurrentVersionRun
Sets value: "MSKERNEL"
With data: "c:usersadmini~1appdatalocal empxelag.exe"

The malware uses code injection to make it harder to detect and remove. It can inject code into running processes.

Payload

Installs malware or unwanted software

This trojan can install other malware or unwanted software onto your PC.

This malware description was published using automated analysis of file SHA1 0c22132b72893a8c769086742b040fb11a62649d.

Last update 15 February 2019

 

TOP