Win32/Tozolu [Threat Name] go to Threat

Win32/Tozolu.A [Threat Variant Name]

Category trojan
Size 3121664 B
Aliases Trojan.Win32.Agent.neuyoy (Kaspersky)
  Trojan:Win32/Dynamer!ac (Microsoft)
  Infostealer.Limitail (Symantec)
Short description

Win32/Tozolu.A is a trojan which tries to download other malware from the Internet. It can be controlled remotely.


When executed, the trojan copies itself into the following location:

  • %startup%\­defender.exe

This causes the trojan to be executed on every system start.

The trojan creates the following files:

  • %appdata%\­Microsoft\­Notepad\­unzip.exe (164864 B)
  • %appdata%\­Microsoft\­Notepad\­ (2561216 B)
  • %appdata%\­Microsoft\­Notepad\­libeay32.dll (1989120 B)
  • %appdata%\­Microsoft\­Notepad\­libevent-2-0-5.dll (719217 B)
  • %appdata%\­Microsoft\­Notepad\­libevent_core-2-0-5.dll (417759 B)
  • %appdata%\­Microsoft\­Notepad\­libevent_extra-2-0-5.dll (411369 B)
  • %appdata%\­Microsoft\­Notepad\­libgcc_s_sjlj-1.dll (523262 B)
  • %appdata%\­Microsoft\­Notepad\­libssp-0.dll (92599 B)
  • %appdata%\­Microsoft\­Notepad\­ssleay32.dll (398336 B)
  • %appdata%\­Microsoft\­Notepad\­svchost64.exe (2420224 B)
  • %appdata%\­Microsoft\­Notepad\­zlib1.dll (107520 B)

The trojan executes the following files:

  • %appdata%\­Microsoft\­Notepad\­unzip.exe
  • %appdata%\­Microsoft\­Notepad\­svchost64.exe
Information stealing

The trojan collects the following information:

  • computer name
  • user name

The trojan attempts to send gathered information to a remote machine.

Other information

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of (2) URLs. It communicates via the TOR anonymity network.

It can execute the following operations:

  • download files from a remote computer and/or the Internet
  • run executable files
  • send gathered information

The trojan keeps various information in the following files:

  • %appdata%\­Microsoft\­Notepad\­payload\­service.txt
  • %appdata%\­Microsoft\­Notepad\­payload\­run.txt

Please enable Javascript to ensure correct displaying of this content and refresh this page.