TrojanDownloader:Win32/Hoicfh.A is a trojan that connects to a certain server and downloads other malware.
Installation
Upon execution, TrojanDownloader:Win32/Hoicfh.A creates a mutex named "jiefhhfufh8zhhs8hoihojhähähd2h080hch" to make sure that only one copy of itself is executing in memory.
It drops and runs a copy of itself as the following file:
%AppData%\csrssr.exe
Note that a legitimate Windows file named "csrss.exe" exists by default in the Windows system folder. It is common practice for malware authors to use file names similar to legitimate files in an attempt to mislead you.
TrojanDownloader:Win32/Hoicfh.A creates the following registry entries to make sure that it automatically runs \every time Windows starts:
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: "Microsoft Windows Hosting Service"
With data: "%AppData%\csrssr.exe"
In subkey: HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Sets value: "Windows RPC Host Service"
With data: "%AppData%\csrssr.exe"
In subkey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "Windows Live Messenger Update Service"
With data: "%AppData%\csrssr.exe"
It also creates the following registry entries as part of its installation process:
In subkey: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "Windows (RPC) Remote Procedure Control Service"
With data: "%AppData%\csrssr.exe"
In subkey: HKLM\System\CurrentControlSet\Control\Lsa
Sets value: "Internet Explorer Update Service"
With data: "%AppData%\csrssr.exe"
Payload
Downloads other malware
TrojanDownloader:Win32/Hoicfh.A connects to the server, located in the IP address 193.107.19.89 using port 8888, to download other malware. As of this writing, the server is unavailable.
Analysis by Edgardo Diaz
