Technical Details

A trojan that provides the attacker with remote access to the infected computer. It is a Windows application (PE-EXE file). 176640 bytes. UPX packed. Unpacked size – around 245 kB. Written in C++.

Installation

After launching, the trojan copies its body to the current user's Startup directory, providing it with the option to automatically launch every time the system is started. A copy is created under a random name:

%USERPROFILE%\Start Menu\Programs\Startup\<rnd>.exe

The trojan then launches the copy of the "EXPLORER.EXE" system process and enters the executable code in the address space, implementing all of its destructive functions.

Payload

The code loaded during the "EXPLORER.EXE" process runs a copy of the "SVCHOST.EXE" system process and enters the code in the address space, implementing a backdoor function and carrying out the following actions:

• deleting the original trojan file;
• hiding the previously created copy in the Startup directory;
• establishing a connection with the attacker's servers to receive commands. Depending on the commands received, the backdoor may carry out the following actions:
• update its original file, loading an update from the attacker's server;
• load other files onto the infected computer;
• track network system traffic in order to steal confidential user information;
• collect information about the infected system;
• track the user's keyboard entries;
• send the collected information to the attacker's server.

me***i38.com
a***gh.in

Removal instructions

If your computer has not been protected with anti-virus software and has been infected with malware, you will need to take the following actions to delete this:

1. Restart the computer in "safe mode" (when starting up, press F8, then select "Safe Mode" from the Windows start menu).
2. Delete the following file:

   %USERPROFILE%\Start Menu\Programs\Startup\<rnd>.exe

3. Clear the Temporary Internet Files directory which may contain infected files (How to delete infected files in the Temporary Internet Files folder?).
4. Run a full Kaspersky Antivirus scan of the computer with updated antivirus databases (download trial version).

MD5: BCB0C595A3CB7244FE00388963129476
SHA1: 9F0FCBE303BE4B8020E731DB55DA5AAB84A08AF6

23 апреля 2024 года

Обращаем внимательность на дальнейшее обновление пасмурной версии песочницы Dr.Web vxCube, в взаимоотношения с чем 24 апреля с 13:00 перед началом 14:00 по столичному времени обслуживание будет недоступен для использования.

В составе песочницы будет обновлена документация — описание работы обслуживания будет снова на... Антивирус Dr.Web

Бизнес-школа «БИЗНЕС ИНСАЙТ» и проект «ЭКСПЕРТЫ» приглашают на III Всероссийский онлайн-форум «БИЗНЕС. ВЕСНА 2024». Бизнес-форум — важнейшее событие в мире бизнеса. На одной площадке соберутся действующие предприниматели, эксперты-практики, чтобы поделиться […]

The post 25-26.05.24г. 10.00-15.00. III Всероссийский форум «БИЗН... Новости Безопастности

17 апреля 2024 года