Home / malware

PDF

Trojan.Eupuds

First posted on 04 July 2014.
Source: Symantec

Aliases :

There are no other names known for Trojan.Eupuds.

Explanation :

When the Trojan is executed, it creates the following file:
%UserProfile%\Application Data\[RANDOM CHARACTERS].exe

Next, the Trojan creates the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS].exe" = "%UserProfile%\Application Data\[RANDOM CHARACTERS].exe"

The Trojan then monitors the following Web browsers to intercept and modify Web traffic: Internet ExplorerFireFoxChrome
Next, the Trojan steals account information for the following websites: live.comhotmail.comfacebook.com
The Trojan then sends this information to the following remote locations: 75.102.25.19075.102.25.19675.102.25.197205.234.130.202205.234.130.201216.246.30.4216.246.30.5216.246.91.221216.246.91.220

Last update 04 July 2014

 

TOP