Trojan.BPlug.116

Technical Information

Malicious functions:

Creates and executes the following:

'<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\sqlite3.exe' extensions.sqlite
'<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\zip.exe' -qm firefox.xpi resources\infoenhancer\data\install_id

Executes the following:

'<SYSTEM32>\msiexec.exe' /i iuongfaowiechw /quiet
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /i fahmneoiawcfo /quiet

Terminates or attempts to terminate

the following user processes:

firefox.exe
chrome.exe

Modifies file system :

Creates the following files:

%WINDIR%\Installer\3ad96.msi
%WINDIR%\Installer\MSI1.tmp
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\dldcbakcjliccckkmfjcblhciilpdcil@infoenhancer.com.xpi
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\dldcbakcjliccckkmfjcblhciilpdcil
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\update.sql
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\extensions.sqlite-journal
%WINDIR%\Installer\$PatchCache$\Managed\3EA247EB59C0CC645B8CF949F2DD3906\1.3.3\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C
%WINDIR%\Installer\3ad9b.msi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\curl2_1712795097
%WINDIR%\Installer\$PatchCache$\Managed\3EA247EB59C0CC645B8CF949F2DD3906\1.3.3\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C
C:\Config.Msi\3ad99.rbs
%PROGRAM_FILES%\tooldev342\Weatherbar\TracersToolbarBHO_x86.dll
%WINDIR%\Installer\$PatchCache$\Managed\3EA247EB59C0CC645B8CF949F2DD3906\1.3.3\F_CENTRAL_atl100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\zia02940
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\zip.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\background.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\background.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\sqlite3.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\libcurl.dll
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\fgeriog
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\firefox.xpi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\fahmneoiawcfo
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\curl1_1407670620
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\resources\infoenhancer\data\install_id
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\iuongfaowiechw
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\content.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\manifest.json
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\options.html

Deletes the following files:

%WINDIR%\Installer\MSI1.tmp
C:\Config.Msi\3ad99.rbs
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\extensions.sqlite-journal
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\options.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\resources\infoenhancer\data\install_id
%WINDIR%\Installer\3ad96.msi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\curl2_1712795097
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\update.sql
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\curl1_1407670620
%WINDIR%\Installer\3ad98.ipi
%WINDIR%\Installer\3ad9b.msi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\iuongfaowiechw
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\libcurl.dll
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\firefox.xpi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\fahmneoiawcfo
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\fgeriog
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\sqlite3.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\content.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\manifest.json
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\background.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\zip.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\background.html

Moves the following files:

from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\content.js.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\content.js
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\background.js.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\background.js
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\background.html.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\background.html
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\zia02940 to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\firefox.xpi
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\options.html.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\options.html
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\manifest.json.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\chrome\manifest.json
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\zip.exe.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\zip.exe
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\firefox.xpi.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\firefox.xpi
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\fgeriog.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\fgeriog
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\fahmneoiawcfo.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\fahmneoiawcfo
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\sqlite3.exe.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\sqlite3.exe
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\libcurl.dll.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\libcurl.dll
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\iuongfaowiechw.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil659338349\iuongfaowiechw

Network activity:

Connects to:

'in###ooks.org':80

TCP:

HTTP POST requests:

in###ooks.org/install/log
in###ooks.org/install

UDP:

DNS ASK in###ooks.org

Miscellaneous:

Searches for the following windows:

ClassName: 'AutoHotkey' WindowName: '<Full path to virus>'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial