Home / malwarePDF  

TrojanDropper:Win32/Notodar


First posted on 25 November 2014.
Source: Microsoft

Aliases :

There are no other names known for TrojanDropper:Win32/Notodar.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

  • \.dll


It modifies the registry so that it runs each time you start your PC. For example:

In subkey: HKLM\software\microsoft\windows\currentversion\run

Sets value: ""
With data: "\rundll32.exe "%SystemRoot%\system32\.dll" update"



Payload


Connects to a remote host

We have seen this threat connect to a remote host, including:
  • logopondr.com using port 80
Malware can connect to a remote host to:
  • Check for an Internet connection.
  • Download and run files (including updates or other malware).
  • Report a new infection to its author.
  • Receive configuration or other data.
  • Receive instructions from a malicious hacker.
  • Search for your PC location.
  • Upload information taken from your PC.
  • Validate a digital certificate.


It can stop some processes from running on your PC, including:

  • svchost.exe
This malware description was published using automated analysis of file SHA1 46e76cd8dfe389bfea860d0af2f6367db7bfae87. Symptoms

The following can indicate that you have this threat on your PC:

  • You see these files:
  • \aponl.dll
  • You see registry modifications such as:
    • In subkey: HKLM\software\microsoft\windows\currentversion\run
      Sets value: "wltprliuptfj"
      With data: "\rundll32.exe "%SystemRoot%\system32\aponl.dll" update"

Last update 25 November 2014

 

TOP