Trojan ADH – stage1.exe – b3f7ed746e3561f6412bacee3da6075d

Trojan ADH
Also known as: Trojan CI, Trojan Delf
SHA256: bb4159633c3e44de3fa99023cd9fe2e5c2f72b296347fd2eaa553b0cbb8e1a64
SHA1: a6739d85024cb831db0efe687c61b3e7f5eb722a
MD5: b3f7ed746e3561f6412bacee3da6075d
File size: 412911 bytes

Created files:

%Temp%\stage1.exe – Trojan ADH
%Temp%\Stage2.exe – Trojan ADH
%Personal%\DCSCMIN\IMDCSC.exe – Trojan ADH

Trojan ADH created autostart registry keys:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit: %WinDir%\System32\userinit.exe,%Personal%\DCSCMIN\IMDCSC.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT: %Personal%\DCSCMIN\IMDCSC.exe