Home / malware
First posted on 08 March 2018.
There are no other names known for Trojan:Win32/Dofoil.AB.
When run, this trojan drops an executable file—a randomly named copy of itself—into the %LOCALAPPDATA% folder.
To stay persistent, it creates a variably named registry entry:
In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
We have observed some samples of this trojan use names from the Uninstall key in the registry. This disguises the trojan registry entry as something created by another application.
This trojan connects to the following IP addresses, which appear to be proxies for connecting to the decentralized NameCoin network infrastructure:
It then attempts to connect to its command-and-control server located in the decentralized network:
Analyzed samples of this trojan support the following backdoor commands:
- Connect to a certain IP address
- Disconnect from an IP address
- Download and execute file from a URL
- Stop malware
- Sleep for certain period
Last update 08 March 2018