TrojanDropper:Win32/Gamarue.A

Installation

TrojanDropper:Win32/Gamarue.A dopies itself into your computer as "%TEMP%\07.tmp".

It creates the following registry entries as part of its installation process:

In subkey: HKLM\SOFTWARE\Microsoft
Sets value: "<random hexadecimal number>"
With data: "p...."

In subkey: HKCU\SOFTWARE
Sets value: "e_magic"
With data: "<binary data>"

Payload

Drops and runs files

TrojanDropper:Win32/Gamarue.A drops and runs files, which might be detected as other malware. The dropped file might belong to the Win32/Gamarue family of malware.

The dropped file is saved in the %TEMP% folder, usually with a random file name.

Additional information

This trojan checks if the Kaspersky program "avp.exe" is running in your computer. If it is, then this trojan drops the file using the file name "\$MSI\~msiexec.exe" (where $ denotes a hidden folder). It might do this to try to pass itself off as a Microsoft file.

Analysis by Chris Stubbs