Provide feedback
Send us feedback
Tell us about your experience
Submit feedback
Thank you for your feedback
Published Dec 22, 2014
|
Updated Sep 15, 2017
TrojanDropper:Win32/Rovnix.P
Technical information
Threat behavior
Installation
This threat can create files on your PC, including:
It modifies the registry so that it runs each time you start your PC. For example:
In subkey:
HKCU\software\microsoft\windows\currentversion\run Sets value: "
BackUp2898323934 "
With data: "
%APPDATA% \backup2898323934.exe "
Payload
Connects to a remote host
We have seen this threat connect to a remote host, including:
klmdedicated.com using port 80
Malware can connect to a remote host to do any of the following:
Check for an Internet connection Download and run files (including updates or other malware) Report a new infection to its author Receive configuration or other data Receive instructions from a malicious hacker Search for your PC location Upload information taken from your PC Validate a digital certificate
We have seen this threat access online content, including:
Additional information
Creates a mutex
This threat can create one or more mutexes on your PC. For example:
Global\BDNTFS2898323934
Global\INSNTFS2898323934
Global\UACNTFS2898323934
It might use this mutex as an infection marker to prevent more than one copy of the threat running on your PC.
This malware description was published using automated analysis of file SHA1 ae6fa1ed0f84d06ebc35ede92a9d18f87955ac84 .
Prevention
Symptoms
The following can indicate that you have this threat on your PC:
You see registry modifications such as:In subkey: HKCU\software\microsoft\windows\currentversion\run Sets value: "BackUp2898323934 " With data: "%APPDATA% \backup2898323934.exe "
You see a mutex such as:
Global\BDNTFS2898323934 Global\INSNTFS2898323934 Global\UACNTFS2898323934
Debug Version = 1.0.0.0;