TrojanDownloader:Win32/Perkesh.F

TrojanDownloader:Win32/Perkesh.F is a trojan that attempts to stop the "Windows Security Center" service and other security-related services and attempts to download other malware from a remote website.

TrojanDownloader:Win32/Perkesh.F may be installed by other malware and may be present in the Windows folder as a file with a ".PIF" extension. When run, it executes its payload routines.

This trojan attempts to terminate the "Windows Security Center" service (wscsvc) and the following additional services:

 

The trojan executes the following command shell instructions to terminate additional tasks:

 

This trojan drops a copy of Trojan:Win32/Perkesh.F in the "%TEMP%" folder as a randomly named file. The dropped trojan copy is then executed as a service named "bv" on the affected machine. The trojan component hides the presence of TrojanDownloader:Win32/Perkesh.F. The trojan component creates a device named "\Devices\ao1" to allow communication with the installed trojan.

 

TrojanDownloader:Win32/Perkesh.F attempts to retrieve files from the remote website "fdc8888.cn". At the time of this writing, the file was not available.

 

The registry is modified to execute a file named "services.exe" if a program "egui.exe" is executed.

 

Adds value: "Debugger"

With data: "services.exe"

In subkey: HKLM\Software\Microsoft\WindowsNT\currentVersion\Image File Execution options\egui.exe