Python/SeaDuke [Threat Name] go to Threat

Python/SeaDuke.A [Threat Variant Name]

Category trojan
Size 3132974 B
Detection created Jul 22, 2015
Detection database version 11980
Aliases Trojan.Win32.PeaceDuke.get (Kaspersky)
  Trojan.Seaduke (Symantec)
  Trojan:Win32/Dynamer!ac (Microsoft)
Short description

The trojan serves as a backdoor. It can be controlled remotely. It is written in Python .

Installation

The trojan may create copies of the following files (source, destination):

  • %malwarefilepath%, %windir%\­LogonUI.exe
  • %malwarefilepath%, %localappdata%\­LogonUI.exe\­LogonUI.exe

The trojan schedules a task that causes the following file to be executed on every system start:

  • %windir%\­LogonUI.exe

The trojan may set the following Registry entries:

  • [HKEY_LOCAL_MACHINE\­SOFTWARE\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "LogonUI.exe" = "%variable%"
  • [HKEY_CURRENT_USER\­SOFTWARE\­Microsoft\­Windows\­CurrentVersion\­Run]
    • "LogonUI.exe" = "%variable%"

The %variable% is one of the following strings:

  • %windir%\­LogonUI.exe
  • %localappdata%\­LogonUI.exe\­LogonUI.exe

This causes the trojan to be executed on every system start.


The trojan may create the following files:

  • %startup%\­LogonUI.exe.lnk

The file is a shortcut to a malicious file.


This causes the trojan to be executed on every system start.

Information stealing

The trojan collects the following information:

  • external IP address of the network device
  • user name
  • computer name
  • CPU information
  • operating system version
  • information about the operating system and system settings
  • network adapter information
  • memory status
  • the path to specific folders
Other information

The trojan acquires data and commands from a remote computer or the Internet.


The trojan contains a URL address. The HTTP protocol is used in the communication.


It can execute the following operations:

  • download files from a remote computer and/or the Internet
  • run executable files
  • send gathered information
  • execute shell commands
  • send requested files
  • stop itself for a certain time period
  • uninstall itself

The trojan keeps various information in the following files:

  • %localappdata%\­.%variable%
  • %temp%\­.%variable%.tmp

A string with variable content is used instead of %variable% .

Please enable Javascript to ensure correct displaying of this content and refresh this page.