Trojan Swisyn – csboyDVD.dll – c879e200c4476bd6a5e68642277b80dc

Trojan Swisyn
Also known as: Trojan CI, Trojan Agent
SHA256: 73ebf16d2fae5fdeb6a217876c3702754bc7c6f3251f426bb6a86667e3b58c14
SHA1: fa79c846edffb3e894add4046c7411cc6e7c4fb1
MD5: c879e200c4476bd6a5e68642277b80dc
File size: 299520 bytes

Created files:

%Program Files Common%\Services\csboyDVD.dll – Trojan Swisyn
%Program Files Common%\Services\csboyDvd.ocx – Trojan Swisyn
%Program Files Common%\Services\csboyTj.ocx – Trojan Swisyn
%Program Files Common%\Services\csboyTT.dll – Trojan Swisyn
%Program Files Common%\Tencent\AMGR8888.dll – Trojan Swisyn
%Program Files Common%\Tencent\AMGR8AuTo.ocx – Trojan Swisyn
%Program Files Common%\Tencent\AMGR8Dw.ocx – Trojan Swisyn
%Program Files Common%\Tencent\svchest.exe – Trojan Swisyn
%Temp%\new_hz.exe_B652B9CC67B9AC57901BCE4A57CB062CCAA85B86.exe – Trojan Swisyn

Trojan Swisyn created autostart registry keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ttplay: %Program Files Common%\Tencent\svchest.exe
HKLM\System\CurrentControlSet\Services\diskmanage\Type: 10000000
HKLM\System\CurrentControlSet\Services\diskmanage\Start: 02000000
HKLM\System\CurrentControlSet\Services\diskmanage\DisplayName: windows Disk Manager
HKLM\System\CurrentControlSet\Services\diskmanage\ImagePath: %Program Files Common%\Tencent\AMGR8888.dll
HKLM\System\CurrentControlSet\Services\diskmanage\SBIE_StartTicks: 71C94100