Home / malware TrojanSpy:Win32/Drigo.A
First posted on 29 October 2014.
Source: MicrosoftAliases :
There are no other names known for TrojanSpy:Win32/Drigo.A.
Explanation :
Threat behavior
Installation
TrojanSpy:Win32/Drigo.A changes the following registry entries so that it runs each time you start your PC:
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "Malware"
With data: ".exe" The malware creates the following files on your PC:
- c:\documents and settings\administrator\local settings\temp\~fd7k25.tmp
Payload
Contacts remote host
TrojanSpy:Win32/Drigo.A might contact a remote host at accounts.google.com using port 443. Commonly, malware does this to:This malware description was produced and published using automated analysis of file SHA1 2d98ddf8f5128853dd33523bcbbd472b8d362705.Symptoms
- Report a new infection to its author
- Receive configuration or other data
- Download and run files, including updates or other malware
- Receive instructions from a remote hacker
- Upload data taken from your PC
System changes
The following could indicate that you have this threat on your PC:
- You have these files:
c:\documents and settings\administrator\local settings\temp\~fd7k25.tmp
- You see these entries or keys in your registry:
Sets value: "Malware"
With data: ".exe"
In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunLast update 29 October 2014