Win32/Spy.Buhtrap [Threat Name] go to Threat

Win32/Spy.Buhtrap.L [Threat Variant Name]

Category	trojan
Size	267224 B
Aliases	TrojanProxy:Win32/Chrofprox (Microsoft)
	Trojan.Proxy2.434 (Dr.Web)

Win32/Spy.Buhtrap.L is a trojan that steals passwords and other sensitive information.

When executed, the trojan creates the following files:

In order to be executed on every system start, the trojan sets the following Registry entry:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "Red Media Player" = "%appdata%\Red Media Player\bin\rmp.exe"

The trojan creates the following files:

The file is a shortcut to a following file:

This way the trojan ensures that the file is executed on every system start.

Win32/Spy.Buhtrap.L is a trojan that steals passwords and other sensitive information.

The following information is collected:

The trojan gathers sensitive information from processes which contain any of the following strings in their path:

The collected information is stored in the following files:

The trojan contains a URL address. The trojan may attempt to download files from the Internet.

The file is stored in the following location:

A string with variable content is used instead of %variable% .

The file is then executed. The HTTP protocol is used in the communication.