Threat Database Trojans Trojan.Tapaoux.B

Trojan.Tapaoux.B

By JubileeX in Trojans

Trojan.Tapaoux.B is a Trojan that opens a back door on the targeted PC. Once run, Trojan.Tapaoux.B may create the malevolent files. Trojan.Tapaoux.B may delete the 'sysconfig.ini' file if it is added to the particular locations (%System%\ and %AppData%\Microsoft\Protect). Trojan.Tapaoux.B may create the registry entries so that it can load automatically whenever the computer user is starts Windows. Trojan.Tapaoux.B adds itself into the processes such as 'wscntfy.exe', 'wuauclt.exe', 'ctfmon.exe', 'svchost.exe' and 'dwm.exe'. Trojan.Tapaoux.B then opens a back door on the compromised PC, creates a log file, and connects to one of the particular web addresses. Trojan.Tapaoux.B may fulfill the harmful actions such as run file operations (run, search, delete, copy, move, upload), grab system information and encrypt for storage (computer name, adapter information, OS), access, create, and stop any running process, make modifications to the Windows Registry, gain network connection state, decrypt data stored in .bin file, load infected DLLs and call export function called 'RunThisCode', and further configure or update the malware infection. Trojan.Tapaoux.B may erase itself.

File System Details

Trojan.Tapaoux.B may create the following file(s):
# File Name Detections
1. %System%\d[RANDOM CHARACTERS].dll
2. [TEMPLATES]\RcDll.dll
3. [TEMPLATES]\[RANDOM CHARACTERS].exe
4. %AppData%\Microsoft\Protect\SystemKey\d[RANDOM CHARACTERS].dll
5. %System%\ffffz[MM][DD][hh][mm][ss][0-3 LETTERS OR DIGITS].tmp
6. %System%\b[RANDOM CHARACTERS].bin
7. [TEMPLATES]\data
8. %AppData%\Microsoft\Protect\SystemKey\b[RANDOM CHARACTERS].bin

Registry Details

Trojan.Tapaoux.B may create the following registry entry or registry entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\"Startup" = "%UserProfile%\Application Data\Microsoft\Windows\Explorer"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS].exe" = "%SYSTEM%\[RANDOM CHARACTERS].exe"
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS].exe" = "%AppData%\Microsoft\Protect\[RANDOM CHARACTERS].exe"

URLs

Trojan.Tapaoux.B may call the following URLs:

Adobe-updates.com
News-updates.org
Online.usean.biz
Sqlengine.net

Trending

Most Viewed

Loading...