RemoteAccess.GhostRadmin Description

RemoteAccess.GhostRadmin is a dangerous remote administration tool. Upon installation of RemoteAccess.GhostRadmin, it can open up the infected system to a remote attacker where information can be compromised. After installed, RemoteAccess.GhostRadmin can add malicious executable files and registry entries to the system without notification to the computer user.

Type: Remote Administration Tools

How Can You Detect RemoteAccess.GhostRadmin?

RemoteAccess.GhostRadmin Technical Report

As new RemoteAccess.GhostRadmin details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following RemoteAccess.GhostRadmin files with its MD5s were created in the system:

RemoteAccess.GhostRadmin has typically the following processes in memory:

• r_server.exe
• FireDaemon.EXE

RemoteAccess.GhostRadmin creates the following registry entries:

• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesRemote Administrator Service
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSystemSRA

Important Article Disclaimer