Trojan.Busky Description

Trojan.Busky is a Trojan Downloader that is further identified as a Browser Helper Object. Trojan.Busky typically enters the computer system via dubious scripts, embedded in JavaScript or VBS. Trojan.Busky (also referred to as Trojan.Busky.B, Trojan.Busky.EI, Trojan.Busky.O, and Trojan.Busky.EC) usually causes problems like slow computer performance, obessive pop-up windows appearing on the computer continuously, and new desktop shortcuts or a change in homepage.

Type: Trojans

Automatic Detection of Trojan.Busky

Trojan.Busky Technical Report

As new Trojan.Busky details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following Trojan.Busky files with its MD5s were created in the system:

Trojan.Busky has typically the following processes in memory:

• epajslul.exe
• pchyjqtw.exe
• gjctitkx.exe
• vmtmhuhc.exe
• pqrspmlq.exe
• efkpgpyf.exe
• rgbchirk.exe
• revkxadi.exe
• zmlonwlu.exe
• nsdsnajk.exe
• ejyjmlwr.exe
• uhybkxen.exe
• jojmrgdu.exe
• inudylen.exe
• sjelcvad.exe
• fqjetcxm.exe
• hkxqdwbq.exe
• repsrylq.exe
• zojipsfi.exe
• tejcxabw.exe
• pgrabiva.exe
• wjalwrgl.exe
• ofctitup.exe
• tqnknmfw.exe
• nctqlyds.exe
• mharsxyt.exe

Trojan.Busky creates the following registry entries:

• RUNNING PROGRAM\epajslul.exe
• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ zsfrnuoh
• RUNNING PROGRAM\gjctitkx.exe
• RUNNING PROGRAM\vmtmhuhc.exe
• RUNNING PROGRAM\pqrspmlq.exe
• RUNNING PROGRAM\efkpgpyf.exe
• RUNNING PROGRAM\rgbchirk.exe
• RUNNING PROGRAM\revkxadi.exe
• RUNNING PROGRAM\zmlonwlu.exe
• RUNNING PROGRAM\nsdsnajk.exe
• RUNNING PROGRAM\ejyjmlwr.exe
• RUNNING PROGRAM\uhybkxen.exe
• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ 9294G80P8A
• RUNNING PROGRAM\inudylen.exe
• RUNNING PROGRAM\sjelcvad.exe
• RUNNING PROGRAM\fqjetcxm.exe
• RUNNING PROGRAM\hkxqdwbq.exe
• RUNNING PROGRAM\repsrylq.exe
• RUNNING PROGRAM\zojipsfi.exe
• RUNNING PROGRAM\tejcxabw.exe
• RUNNING PROGRAM\pgrabiva.exe
• RUNNING PROGRAM\wjalwrgl.exe
• RUNNING PROGRAM\ofctitup.exe
• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ OJtGEKd5UE
• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ iuggasyw
• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\ yvmoghns

Important Article Disclaimer