TrojanSpy:Win32/Ranbyus.G

TrojanSpy:Win32/Ranbyus.G is a trojan that collects sensitive information for an attacker.

When executed, TrojanSpy:Win32/Ranbyus.G copies itself to <system folder>\dllhosl.exe.

Note: <system folder> refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

The malware modifies the following registry entries to ensure that its copy executes at each Windows start:

Adds value: "System Rescue"
With data: "c:\windows\system32\dllhosl.exe"
To subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

The malware utilizes code injection in order to hinder detection and removal. When TrojanSpy:Win32/Ranbyus.G executes, it may inject code into running processes, including the following, for example:

• svchost.exe

Contacts remote host

TrojanSpy:Win32/Ranbyus.G may contact a remote host at buhgalter1.in using port 80. Commonly, malware may contact a remote host for the following purposes:

• To report a new infection to its author
• To receive configuration or other data
• To download and execute arbitrary files (including updates or additional malware)
• To receive instruction from a remote attacker
• To upload data taken from the affected computer

This malware description was produced and published using our automated analysis system's examination of file SHA1 944208571c73f7140735dba422e67fa1b917ec38.