Troj/Krap-F is a Trojan for the Windows platform.
Troj/Krap-F includes functionality to:
- run automatically
- copy itself to the <System> folder
- create files in the <System> folder
- steal confidential information
- access the internet and communicate with a remote server via HTTP
Troj/Krap-F communicates via HTTP with the following locations:
contexstyle . ru
When Troj/Krap-F is installed the following files are created:
<System>\lowsec\local.ds
<System>\lowsec\user.ds
<System>\lowsec\user.ds.lll
<System>\sdra64.exe
Registry entries are set as follows:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Connections
DefaultConnectionSettings
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
Winlogon
Userinit
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Connections
SavedLegacySettings
Registry entries are created under:
HKCU\Software\Microsoft\Protected Storage System Provider