Win32/TrojanDownloader.Unruy [Threat Name] go to Threat

Win32/TrojanDownloader.Unruy.AA [Threat Variant Name]

Category	trojan
Size	29200 B
Aliases	Trojan.Win32.Buzus.ddrm (Kaspersky)
	VirTool:Win32/CeeInject.gen!J (Microsoft)
	BackDoor-DOQ (McAfee)

Win32/TrojanDownloader.Unruy.AA is a trojan which tries to download other malware from the Internet.

The trojan modifies executables referenced by the following Registry entry:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
- "*" = "%path%\%filename%.exe"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
- "*" = "%path%\%filename%.exe"

The trojan may replace these files with a copy of itself.

This causes the trojan to be executed on every system start.

It avoids files which contain any of the following strings in their path:

The original file is stored in the following location:

The trojan quits immediately if it detects a running process containing one of the following strings in its name:

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (1) URLs. The HTTP protocol is used.

It can execute the following operations: