Home / malware

PDF

TrojanDropper:Win32/Sventore.A

First posted on 12 October 2019.
Source: Microsoft

Aliases :

There are no other names known for TrojanDropper:Win32/Sventore.A.

Explanation :

Installation This threat creates the folder %TEMP%
, for example %TEMP%
163.   It then creates a file with the same name, but replaces the 'n' with an 's'. For example: 

%TEMP%
163s163.exe

%TEMP%
1027s1027.exe %TEMP%
1611s1611.exe %TEMP%
6861s6861.exe %TEMP%
5553s5553.exe Payload

Installs malware or unwanted software

This trojan can install other malware or unwanted software onto your PC.

Connects to a remote host

We have seen this threat connect to the following remote host on the socdn.com domain using port 80: 4008.northstar.api.socdn.com b9d07.northstar.api.socdn.com facd.northstar.api.socdn.com fabe.northstar.api.socdn.com d3c8.ultron.api.socdn.com Malware can connect to a remote host to do any of the following: Check for an Internet connection Download and run files (including updates or other malware) Report a new infection to its author Receive configuration or other data Receive instructions from a malicious hacker Search for your PC location Upload information taken from your PC Validate a digital certificate

The threat contacts a remote hosts and sends a GET requests in the following format, where 'x' denotes a hexadecimal digit and 'y' denotes a decimal digit:

/installer/xxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx/yyyyyyyy/config

It requests POST data starting with the following string and followed by more than 1 KB of encoded data:

 /installer/xxxxxxxx-xxxx-xxxx-xxxxxxxxxxxx/yyyyyyyy/event Additional information

Creates a mutex

This threat can create one or more mutexes on your PC. For example:

{84b06608-8026-11d2-b1f2-00c04fd912b2} CB35EF5D-4591-41d9-BBA2-0363342F3783 NetCfgWriteLock

It might use this mutex as an infection marker to prevent more than one copy of the threat running on your PC.

Analysis by Jakub Kaminski

Last update 12 October 2019

 

TOP