Win32/TrojanDownloader.Tracur [Threat Name] go to Threat

Win32/TrojanDownloader.Tracur.AL [Threat Variant Name]

Win32/TrojanDownloader.Tracur.AL is a trojan which tries to promote certain web sites.

The trojan is probably a part of other malware.

When executed, the trojan copies itself into the following location:

The trojan may set the following Registry entries:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "%variable1%%variable2%.dll" = "%system32%\rundll32.exe "%appdata%\%variable1%%variable2%.dll",DllRegisterServer"

This causes the trojan to be executed on every system start.

The trojan may create the following folders:

The trojan may create the following files:

%appdata%\%variable3%%variable4%\%variable11%%variable12%.%variable13%
%appdata%\%variable3%%variable4%\%variable7%%variable8%\%variable14%%variable15%.js
%appdata%\%variable3%%variable4%\%variable7%%variable8%\manifest.json
%appdata%\%variable9%%variable10%\Temp\etilqs_%variable16%

Win32/TrojanDownloader.Tracur.AL installs the following software:

The trojan creates the following files:

%appdata%\%variable3%%variable4%\%variable5%%variable6%\browser.exe
%appdata%\%variable3%%variable4%\%variable5%%variable6%\VisualElementsManifest.xml
%appdata%\%variable3%%variable4%\%variable5%%variable6%\36.0.1985.143\%chromefiles%
%appdata%\%variable9%%variable10%\Application Data\Google\Chrome\User Data\%chromefiles%

The %variable1,3,5,7,9,11,14% is one of the following strings:

The %variable2,4,6,8,10,12,15% is one of the following strings:

The %variable13% is one of the following strings:

The trojan quits immediately if it is run within a debugger.

The trojan terminates its execution if it detects that it's running in a specific virtual environment.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (4) URLs. The HTTP protocol is used in the communication.

It may perform the following actions: