Skip to main content

Trojan-Downloader:W32/Streedom.A

Classification

Category:Malware
Type:Trojan-Downloader
Platform:W32
Aliases:

Trojan-Downloader:W32/Streedom.A

Summary

Trojan-Downloader:W32/Streedom.A is a file embedded within Trojan:W97M/Streedom.A. Trojan-Downloader:W32/Streedom.A downloads and runs a file from a website.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Trojan-Downloader:W32/Streedom.A arrives to the system as an embedded binary executable file from within a malicious .RTF file, which is detected as Trojan:W97M/Streedom.A.

Upon execution of the embedded file, it will drop a copy of itself in the following path and file name:

  • %sysdir%\linkuyy.exe

To enable automatic execution upon boot up, Trojan-Downloader:W32/Streedom.A adds the following auto start registry entry:

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run linkyuu = %sysdir%\linkuyy.exe

Trojan-Downloader:W32/Streedom.A creates this file and then deletes it again:

  • c:\ali.html

Note: this is a hard coded string

Trojan-Downloader:W32/Streedom.A uses the default Internet Browser installed on the system to download Trojan-Dropper:W32/Streedom.A. In order to do this, it creates a process for the browser and then injects itself. Afterwards, it will remotely trigger a thread that contains the main payload, which is the download routine.

Trojan-Downloader:W32/Streedom.A will only start downloading if an Internet Connection is available. Internet availability is checked by establishing a connection to the following site:

  • http://www.google.com

If an Internet connection is unavailable, it will infinitely try establishing a connection every 10000 ms or 10 seconds.

Here is the URL from where it downloads Trojan-Dropper:W32/Streedom.A:

  • http://www.nightcrossings.com/g[REMOVED]/inv.exe

The downloaded file is saved and executed in the following path and filename:

  • %windir%\tnc.exe

The creator of this malware uses message boxes to debug this program.

This message box for instance, shows up when it fails to launch a process of the default browser:

Here are more of the other message boxes:

This malware has been packed with FSG 2.0.

More Support

Community

Ask questions in our Community.

User guides

Check the user guide for instructions.

Contact Support

Chat with with or call an agent.

Submit a Sample

Submit a file or URL for analysis.