Win32/MalPlurk [Threat Name] go to Threat
Win32/MalPlurk.B [Threat Variant Name]
| Category | trojan |
| Size | 41472 B |
| Aliases | Trojan-Downloader.Win32.FraudLoad.zivg (Kaspersky) |
| TROJ_DLOADER.FFU (TrendMicro) | |
| Gen:Variant.Kazy.8979 (BitDefender) |
Short description
The trojan serves as a backdoor. It can be controlled remotely.
Installation
The trojan does not create any copies of itself.
In order to be executed on every system start, the trojan sets the following Registry entry:
- [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
- "Load" = "%malwarepath%"
- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
- "Load" = "%malwarepath%"
Other information
The trojan acquires data and commands from a remote computer or the Internet.
The trojan contains a list of (2) URLs. The HTTP protocol is used.
The trojan collects the following information:
- user name
- computer name
- operating system version
- computer IP address
It can execute the following operations:
- download files from a remote computer and/or the Internet
- run executable files
- terminate running processes
- capture screenshots
- send the list of disk devices and their type to a remote computer
- remove itself from the infected computer
- various file system operations
- send gathered information