Home Malware Programs Trojans Trojan.Tredpaf

Trojan.Tredpaf

Posted: May 30, 2013

Threat Metric

Threat Level: 9/10
Infected PCs: 9
First Seen: May 30, 2013
Last Seen: October 13, 2024
OS(es) Affected: Windows

Trojan.Tredpaf is a Trojan that opens a back door and may download more malware threats onto the infected computer. Trojan.Tredpaf may be downloaded by other PC threats or sent through spam emails. When executed, Trojan.Tredpaf may create potentially malicious files. Trojan.Tredpaf may create the registry entry so that it can be executed whenever Windows is started. Trojan.Tredpaf may also create registry entries under the registry subkeys. Trojan.Tredpaf may modify any of the numerous registry entries. Trojan.Tredpaf may execute malicious actions such as act as a proxy, connect to a web address, list and kill processes, get operating system information, stop executing and delete itself from the compromised PC, run arbitrary shell commands, upload, download, and execute files, and other.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%System%\Microsoft\Protect\[SID]\Preferre\cap.cfg File name: %System%\Microsoft\Protect\[SID]\Preferre\cap.cfg
Mime Type: unknown/cfg
Group: Malware file
%System%\Microsoft\Protect\[SID]\[GUID\cap.cfg File name: %System%\Microsoft\Protect\[SID]\[GUID\cap.cfg
Mime Type: unknown/cfg
Group: Malware file
C:\Documents and Settings\<username>\Application Data\Microsoft\Crypto\RSA\MachineKeys[KEY VALUE\cap.cfg File name: C:\Documents and Settings\<username>\Application Data\Microsoft\Crypto\RSA\MachineKeys[KEY VALUE\cap.cfg
Mime Type: unknown/cfg
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\"load" = "[PATH TO TROJAN]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\[HEXADECIMAL STRING]\"Blob" = "[BINARY VALUE]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\Control\"NewlyCreated" = "0"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\My\Certificates\[HEXADECIMAL STRING]\"Blob" = "[BINARY VALUE]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\My\Keys\[HEXADECIMAL STRING]\"Blob" = "[BINARY VALUE]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\"Legacy" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\"ConfigFlags" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\Control\"ActiveService" = "HTTPFilter"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\"Service" = "HTTPFilter"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\"NextInstance" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\"Class" = "LegacyDriver"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\"ClassGUID" = "{GUID 2}"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443\"DefaultSslCertCheckMode" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443\"DefaultSslRevocationFreshnessTime" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443\"SslCertHash" = "[BINARY VALUE]"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443\"AppId" = "00 00 00 00 00 00 00 00 00 00 00 00 00 00 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTPFilter\Enum\"0" = "Root\LEGACY_HTTPFILTER\0000"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTPFilter\Enum\"Count" = "1"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTPFilter\Enum\"NextInstance" = "1" HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443\"DefaultSslRevocationUrlRetrievalTimeout" = "0"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443\"DefaultFlags" = "0"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\KeysHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates\[HEXADECIMAL STRING]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\[HEXADECIMAL STRING]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Keys\[HEXADECIMAL STRING]HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTERHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\ControlHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTPFilter\EnumHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_HTTPFILTER\0000\DeviceDesc: "HTTP SSL"
Loading...