Home / malwarePDF  

TrojanDownloader:Win32/Frosparf.A


First posted on 15 September 2015.
Source: Microsoft

Aliases :

There are no other names known for TrojanDownloader:Win32/Frosparf.A.

Explanation :

Threat behavior

Installation


It can make various registry changes during its installation, including:

  • In subkey: HKLM\Software\Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32
    Sets value: "(default)"
    With data: "\mscomctl.ocx"
  • In subkey: HKLM\Software\Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32
    Sets value: "(default)"
    With data: "\mscomctl.ocx"
  • In subkey: HKLM\Software\Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32
    Sets value: "ThreadingModel"
    With data: "apartment"
  • In subkey: HKLM\Software\Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32
    Sets value: "(default)"
    With data: "\mscomctl.ocx"
  • In subkey: HKLM\Software\Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32
    Sets value: "(default)"
    With data: "\mscomctl.ocx"
  • In subkey: HKLM\Software\Classes\MSComctlLib.ListViewCtrl.2\CLSID
    Sets value: "(default)"
    With data: "{bdd1f04b-858b-11d1-b16a-00c0f0283628}"
  • In subkey: HKLM\Software\Classes\MSComctlLib.ProgCtrl.2\CLSID
    Sets value: "(default)"
    With data: "{35053a22-8589-11d1-b16a-00c0f0283628}"
  • In subkey: HKLM\Software\Classes\MSComctlLib.ProgCtrl\CLSID
    Sets value: "(default)"
    With data: "{35053a22-8589-11d1-b16a-00c0f0283628}"
  • In subkey: HKLM\Software\Classes\MSComctlLib.SBarCtrl.2\CLSID
    Sets value: "(default)"
    With data: "{8e3867a3-8586-11d1-b16a-00c0f0283628}"
  • In subkey: HKLM\Software\Classes\MSComctlLib.Slider.2\CLSID
    Sets value: "(default)"
    With data: "{f08df954-8592-11d1-b16a-00c0f0283628}"


Payload


Downloads malware or unwanted software

This threat can download other malware and unwanted software onto your PC.



Connects to a remote host

We have seen this threat connect to a remote host, including:
  • cdn.pekalongan-kummunity.com using port 53
Malware can connect to a remote host to do any of the following:
  • Check for an Internet connection
  • Download and run files (including updates or other malware)
  • Report a new infection to its author
  • Receive configuration or other data
  • Receive instructions from a malicious hacker
  • Search for your PC location
  • Upload information taken from your PC
  • Validate a digital certificate


This malware description was published using automated analysis of file SHA1 092a60d38a0a5d377c34570a1f66df798da66e62.

Symptoms

The following can indicate that you have this threat on your PC:

  • You see registry modifications such as:
    • In subkey: HKLM\Software\Classes\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "ThreadingModel"
      With data: "apartment"

    • In subkey: HKLM\Software\Classes\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

    • In subkey: HKLM\Software\Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

    • In subkey: HKLM\Software\Classes\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "ThreadingModel"
      With data: "apartment"

    • In subkey: HKLM\Software\Classes\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "ThreadingModel"
      With data: "apartment"

    • In subkey: HKLM\Software\Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

    • In subkey: HKLM\Software\Classes\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "ThreadingModel"
      With data: "apartment"

    • In subkey: HKLM\Software\Classes\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

    • In subkey: HKLM\Software\Classes\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

    • In subkey: HKLM\Software\Classes\CLSID\{C27CCE41-8596-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

    • In subkey: HKLM\Software\Classes\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

    • In subkey: HKLM\Software\Classes\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\InprocServer32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

    • In subkey: HKLM\Software\Classes\MSComctlLib.ImageComboCtl.2\CLSID
      Sets value: "(default)"
      With data: "{dd9da666-8594-11d1-b16a-00c0f0283628}"

    • In subkey: HKLM\Software\Classes\MSComctlLib.ListViewCtrl.2\CLSID
      Sets value: "(default)"
      With data: "{bdd1f04b-858b-11d1-b16a-00c0f0283628}"

    • In subkey: HKLM\Software\Classes\MSComctlLib.ProgCtrl.2\CLSID
      Sets value: "(default)"
      With data: "{35053a22-8589-11d1-b16a-00c0f0283628}"

    • In subkey: HKLM\Software\Classes\MSComctlLib.ProgCtrl\CLSID
      Sets value: "(default)"
      With data: "{35053a22-8589-11d1-b16a-00c0f0283628}"

    • In subkey: HKLM\Software\Classes\MSComctlLib.SBarCtrl.2\CLSID
      Sets value: "(default)"
      With data: "{8e3867a3-8586-11d1-b16a-00c0f0283628}"

    • In subkey: HKLM\Software\Classes\MSComctlLib.Slider.2\CLSID
      Sets value: "(default)"
      With data: "{f08df954-8592-11d1-b16a-00c0f0283628}"

    • In subkey: HKLM\Software\Classes\MSComctlLib.TreeCtrl\CLSID
      Sets value: "(default)"
      With data: "{c74190b6-8589-11d1-b16a-00c0f0283628}"

    • In subkey: HKLM\Software\Classes\TypeLib\{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}\2.0\0\win32
      Sets value: "(default)"
      With data: "\mscomctl.ocx"

Last update 15 September 2015

 

TOP

Malware :

Family: