Name :	Trojan-Downloader:W32/Hiloti
Detection Names :	Gen:variant.hiloti.1 Trojan-Downloader.Win32.Mufanom
Aliases :	Trojan:Win32/Hiloti.gen!D (Microsoft)
Category:	Malware
Type:	Trojan-Downloader
Platform:	W32

This type of trojan secretly downloads malicious files from a remote server, then installs and executes the files.

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Trojan-Downloader:W32/Hiloti identifies a family of programs that download and execute malicious files onto the affected system.

Variants in this family may also be identified as variants in the Trojan-Downloader:W32/Mufanom family.

The details below are for a representative variant in the Hiloti family.


Execution

The variant drops a file at %windir% as:


And loads it using rundll32.exe.
     
The malware then downloads a file from: 


And saves it to the following location: %windir%\[random filename].dll

The malware then performs DNS Query using the infected system's information, for example:


Registry Changes

During execution, the malware creates a registry key to create a launchpoint:


  Then it creates random registry keys:


It also creates 8-character mutexes with random name, such as 4fef8c25, 1dfefa41, and ef485b09.