Home Malware Programs Trojans Downloader.Drepitt

Downloader.Drepitt

Posted: December 23, 2011

Threat Metric

Ranking: 10,379
Threat Level: 9/10
Infected PCs: 3,003
First Seen: December 23, 2011
Last Seen: February 6, 2025
OS(es) Affected: Windows

Downloader.Drepitt is a Trojan downloader which targets PCs running Microsoft Windows operating system. Downloader.Drepitt is created to exploit system vulnerabilities and to download malicious files to the infected computers. When running, Downloader.Drepitt will download and install additional malware threats onto the affected machine. Downloader.Drepitt will communicate with remote websites to get instructions and download and execute malicious files. Downloader.Drepitt can block the network or web browser. Downloader.Drepitt can cause reboots of the PC system or sudden shut downs of programs. Downloader.Drepitt also modifies the registry so that it can run every time you start Windows. You should remove Downloader.Drepitt immediately after detection.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Temp%\[RANDOM CHARACTERS].dll File name: %Temp%\[RANDOM CHARACTERS].dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%UserProfile%\Application Data\[RANDOM CHARACTERS].exe File name: %UserProfile%\Application Data\[RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%UserProfile%\Application Data\[RANDOM CHARACTERS].exe" = "%UserProfile%\Application Data\[RANDOM CHARACTERS].exe:*:EnableHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\”%UserProfile%\Application Data\[RANDOM CHARACTERS].exe" = "%UserProfile%\Application Data\[RANDOM CHARACTERS].exe:*:En
Loading...