Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Short description
Win32/TrojanDownloader.Perkesh.A is a trojan which tries to download other malware from the Internet. The trojan terminates various security related applications. The file is run-time compressed using UPX .
Installation
When executed, the trojan creates the following files:
  • %temp%\dll%random1%.dll (25600 B)
  • %system%\%random2%.dll (25600 B)
  • %system%\winavproc.dll (3584 B)
  • %system%\drivers\NsDnldr3.sys (3056 B)
  • %system%\drivers\NsPass0.sys (8256 B)
more...
The %random1-2% stands for a random number.

The trojan registers itself as a system service using the following name:
  • Microsoft Kernel %variable% Service
A string with variable content is used instead of %variable% .

Installs the following system drivers (path, name):
  • %system%\drivers\NsDnldr3.sys (my260)
  • %system%\drivers\NsPass0.sys (mymydk00)
  • %system%\drivers\NsPass1.sys (mymydk01)
  • %system%\drivers\NsPass2.sys (mymydk02)
  • %system%\drivers\NsPass3.sys (mymydk03)
  • %system%\drivers\NsPass4.sys (mymydk04)


The following Registry entries are created:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
    CurrentVersion\Image File Execution Options\360safe.exe]
    "Debugger" = "svchost.exe"
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
    CurrentVersion\Image File Execution Options\360safebox.exe]
    "Debugger" = "svchost.exe"
more...