Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'THGuard' = '"%ProgramFiles(x86)%\TrojanHunter\THGuard.exe"'
- [<HKLM>\Software\Classes\TrojanHunter.LicenseFile\shell\open\command] '' = '"%ProgramFiles(x86)%\TrojanHunter\InstallLicense.exe" "%1"'
Modifies file system
Creates the following files
- %TEMP%\is-mahsr.tmp\<File name>.tmp
- %ProgramFiles(x86)%\trojanhunter\debuglog.txt
- %ProgramFiles(x86)%\trojanhunter\tools\liveupdate\settings.ini
- %ProgramFiles(x86)%\trojanhunter\unins000.dat
- %ProgramFiles(x86)%\trojanhunter\unins000.msg
- %ProgramFiles(x86)%\trojanhunter\trojanhunter.url
- %HOMEPATH%\desktop\trojanhunter.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\trojanhunter scanner.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\trojanhunter\liveupdate.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\trojanhunter\trojanhunter web page.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\trojanhunter\trojanhunter scanner.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\trojanhunter\trojanhunter guard.lnk
- %ProgramFiles(x86)%\trojanhunter\is-0r79g.tmp
- %ProgramFiles(x86)%\trojanhunter\tools\liveupdate\is-rhatt.tmp
- %ProgramFiles(x86)%\trojanhunter\rulefiles\is-2jens.tmp
- %ProgramFiles(x86)%\trojanhunter\rulefiles\is-qrliu.tmp
- %ProgramFiles(x86)%\trojanhunter\is-0e0h6.tmp
- %ProgramFiles(x86)%\trojanhunter\is-ar4aa.tmp
- %ProgramFiles(x86)%\trojanhunter\is-3bs3p.tmp
- %ProgramFiles(x86)%\trojanhunter\is-k8n2n.tmp
- %ProgramFiles(x86)%\trojanhunter\is-v6elo.tmp
- %ProgramFiles(x86)%\trojanhunter\is-nmga7.tmp
- %ProgramFiles(x86)%\trojanhunter\is-72m3i.tmp
- %ProgramFiles(x86)%\trojanhunter\submitfiles\is-b7102.tmp
- %ProgramFiles(x86)%\trojanhunter\is-gn4pq.tmp
- %ProgramFiles(x86)%\trojanhunter\is-knm6q.tmp
- %ProgramFiles(x86)%\trojanhunter\is-uotvf.tmp
- %ProgramFiles(x86)%\trojanhunter\is-fm568.tmp
- %TEMP%\is-1dufl.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-1dufl.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\trojanhunter\il.ini
- %ProgramFiles(x86)%\trojanhunter\tools\liveupdate\temp\updatelist.txt
Moves the following files
- from %ProgramFiles(x86)%\trojanhunter\is-fm568.tmp to %ProgramFiles(x86)%\trojanhunter\unins000.exe
- from %ProgramFiles(x86)%\trojanhunter\is-uotvf.tmp to %ProgramFiles(x86)%\trojanhunter\installlicense.exe
- from %ProgramFiles(x86)%\trojanhunter\is-knm6q.tmp to %ProgramFiles(x86)%\trojanhunter\options.cfg
- from %ProgramFiles(x86)%\trojanhunter\is-gn4pq.tmp to %ProgramFiles(x86)%\trojanhunter\tools.ini
- from %ProgramFiles(x86)%\trojanhunter\submitfiles\is-b7102.tmp to %ProgramFiles(x86)%\trojanhunter\submitfiles\submitfiles.exe
- from %ProgramFiles(x86)%\trojanhunter\is-72m3i.tmp to %ProgramFiles(x86)%\trojanhunter\trojanhunter.exe
- from %ProgramFiles(x86)%\trojanhunter\is-nmga7.tmp to %ProgramFiles(x86)%\trojanhunter\thguard.exe
- from %ProgramFiles(x86)%\trojanhunter\is-v6elo.tmp to %ProgramFiles(x86)%\trojanhunter\thshlicons.dll
- from %ProgramFiles(x86)%\trojanhunter\is-k8n2n.tmp to %ProgramFiles(x86)%\trojanhunter\unrar.dll
- from %ProgramFiles(x86)%\trojanhunter\is-3bs3p.tmp to %ProgramFiles(x86)%\trojanhunter\unupx.dll
- from %ProgramFiles(x86)%\trojanhunter\is-ar4aa.tmp to %ProgramFiles(x86)%\trojanhunter\unzdll.dll
- from %ProgramFiles(x86)%\trojanhunter\is-0e0h6.tmp to %ProgramFiles(x86)%\trojanhunter\zipdll.dll
- from %ProgramFiles(x86)%\trojanhunter\rulefiles\is-qrliu.tmp to %ProgramFiles(x86)%\trojanhunter\rulefiles\gen.dll
- from %ProgramFiles(x86)%\trojanhunter\rulefiles\is-2jens.tmp to %ProgramFiles(x86)%\trojanhunter\rulefiles\liveupdate.ini
- from %ProgramFiles(x86)%\trojanhunter\tools\liveupdate\is-rhatt.tmp to %ProgramFiles(x86)%\trojanhunter\tools\liveupdate\liveupdate.exe
- from %ProgramFiles(x86)%\trojanhunter\is-0r79g.tmp to %ProgramFiles(x86)%\trojanhunter\thcl.exe
Network activity
TCP
HTTP GET requests
- http://www.tr####hunter.com/rulefiles/updatelist/?x=######################
- http://www.tr####hunter.com/rulefiles/updatelist?x=######################
UDP
- DNS ASK tr####hunter.com
Miscellaneous
Searches for the following windows
- ClassName: 'TAppBuilder' WindowName: ''
- ClassName: 'TTrojanHunterLiveUpdateForm' WindowName: ''
Creates and executes the following
- '%TEMP%\is-mahsr.tmp\<File name>.tmp' /SL5="$B01FE,3799351,56832,<Full path to file>"
- '%ProgramFiles(x86)%\trojanhunter\trojanhunter.exe'
- '%ProgramFiles(x86)%\trojanhunter\tools\liveupdate\liveupdate.exe' /auto
- '%ProgramFiles(x86)%\trojanhunter\tools\liveupdate\liveupdate.exe' /auto' (with hidden window)
