SHA1 hash:
- e517577a8e2166335fa1b640578fd8a1cb353c6d (dokson.exe)
Description
A trojan written in C++ and designed to run on Microsoft Windows operating systems. Its primary function is to download and install Trojan.Updatar.3 — the main component of the Updatar backdoor — as a service on the target system. The trojan’s code is obfuscated.
Operating routine
Upon execution, Trojan.Updatar.2 checks whether the Trojan.Updatar.3 backdoor is already present in the system. If detected, it uninstalls it. The trojan first verifies the existence of the directory %localappdata%\Default. This directory is expected to contain the backdoor’s files. It then terminates all processes associated with this directory and deletes all files stored in it.
Afterward, Trojan.Updatar.2 downloads Trojan.Updatar.3 from the C2 server at hxxp://adobe-updater[.]net/download/zhu2nf2fffase222. It saves the file in the target directory under the name Microsoft Update Service.exe.
The trojan then attempts to install the backdoor. It creates the registry key MicrosoftService in the branch HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, indicating the path to the trojan’s executable file, and then launches the malware. From this point on, Trojan.Updatar.3 will start automatically when the system boots.
More about Trojan.Updatar.1
More about Trojan.Updatar.3
News about the trojan
Indicators of compromise
