Home / malware

PDF

Trojan.Krompt

First posted on 17 June 2014.
Source: Symantec

Aliases :

There are no other names known for Trojan.Krompt.

Explanation :

When the Trojan is executed, it creates the following files: %UserProfile%\WindowsUpdate\System\Isass.exe %Temp%\System\Configurations.ini
Next, the Trojan creates the following registry entry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\"System." = "%UserProfile%\WindowsUpdate\System\Isass.exe"

The Trojan then connects to the following remote location to receive commands from the remote attacker:
internetexplorers.org

Last update 17 June 2014

 

TOP