Sāls
Draudu rādītāju karte
EnigmaSoft draudu rādītāju karte
EnigmaSoft draudu rādītāju kartes ir dažādu ļaunprātīgas programmatūras draudu novērtējuma ziņojumi, kurus ir apkopojusi un analizējusi mūsu pētnieku komanda. EnigmaSoft draudu rādītāju kartes novērtē un sarindo draudus, izmantojot vairākus rādītājus, tostarp reālos un iespējamos riska faktorus, tendences, biežumu, izplatību un noturību. EnigmaSoft draudu rādītāju kartes tiek regulāri atjauninātas, pamatojoties uz mūsu pētījumu datiem un metriku, un tās ir noderīgas plašam datoru lietotāju lokam, sākot no gala lietotājiem, kuri meklē risinājumus ļaunprātīgas programmatūras noņemšanai no savām sistēmām, līdz drošības ekspertiem, kas analizē draudus.
EnigmaSoft Threat Scorecards parāda dažādu noderīgu informāciju, tostarp:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Smaguma pakāpe: objekta noteiktais smaguma līmenis, kas attēlots skaitliski, pamatojoties uz mūsu riska modelēšanas procesu un izpēti, kā paskaidrots mūsu draudu novērtēšanas kritērijos .
Inficēti datori: apstiprināto un aizdomīgo gadījumu skaits par konkrētu apdraudējumu, kas atklāts inficētos datoros, kā ziņo SpyHunter.
Skatīt arī draudu novērtēšanas kritērijus .
| Popularity Rank: | 5,655 |
| Draudu līmenis: | 70 % (Augsts) |
| Inficētie datori: | 19,774 |
| Pirmo reizi redzēts: | July 24, 2009 |
| Pēdējo reizi redzēts: | January 28, 2026 |
| Ietekmētā(s) OS(-es): | Windows |
Sality ir sarežģīts, sarežģīts un ārkārtīgi bīstams datorvīruss. Ja jums ir mājiens, ka jūsu dators ir inficēts ar Sality, jums jārīkojas piesardzīgi un jārīkojas ar Sality pēc iespējas ātrāk. Sality var būt kaitīgs jūsu datoram un jums satriecoši dažādos veidos, jo Sality ietver visu galveno ļaunprātīgas programmatūras veidu līdzekļus vai komponentus un regulāri maina sevi, nepārtraukti kļūstot ļaunprātīgākam un grūtāk atklājamam nekā iepriekš.
Satura rādītājs
Sality vēsture
Sality vīruss pirmo reizi parādījās Krievijā 2003. gadā. Kopš tā laika Sality joprojām ir drauds, un Sality ir izplatījies visā pasaulē, vēsturiski ar īpaši spēcīgu klātbūtni Brazīlijā. Sāls bija viens no 2010. gada izplatītākajiem vīrusiem, un gada beigās, kad parādījās jauna vīrusa mutācija, bija ievērojams infekciju skaita pieaugums. Daži pētnieki ir paziņojuši, ka Sality pašlaik ir viens no pieciem visbiežāk sastopamajiem draudiem, kas tiek atklāti datoros.
Stingri sakot, Sality sākās kā aizmugures durvis kā veids, kā apiet parastos datoru drošības pasākumus. Lai gan Sality joprojām ir šī funkcija un infekcija joprojām sākas ar aizmugures durvīm, Sality gadu gaitā ir audzis un attīstījies, lai iekļautu savā darbībā praktiski visas zināmās ļaunprogrammatūras. Tas nav pārspīlēts — papildus aizmugures durvīm Sality funkcijās ietilpst vīrusi, taustiņu bloķētāji, sakņu komplekti, tārpi, Trojas zirgi, lejupielādētāji, robottīkli, reklāmprogrammatūra un nulles stundu Windows ļaunprātīgas darbības. Sality ir klasiska vīrusa kopīgas iezīmes, kā arī dažas ļoti modernas un ļoti bīstamas iespējas.
Kā Sality darbojas
Pašlaik Sality infekcija var sākties, izmantojot inficētu īkšķi, kas inficēs jūsu datoru, sākot ar tārpu, vai Sality var inficēt jūsu datoru, sākot ar Trojas zirgu pēc tam, kad noklikšķināt uz inficēta surogātpasta e-pasta vai lejupielādējat inficētu failu. Vienā vai otrā veidā, tiklīdz Sality ir klāt, Sality atver aizmugures durvis un var lejupielādēt citu ļaunprātīgu programmatūru; vai slepeni sazināties ar robottīkla kontrolieri vai jebkuru personu, kas vispirms izplatīja vīrusu.
Tad Sality nolemj nodarīt kaitējumu. Sality apskata, kas atrodas jūsu sistēmā, inficē vietējos .exe un .scr failus, atspējo vai dzēš drošības programmatūru un ugunsmūrus un raksta ļaunprātīgus failus. Sality var pat mainīt jūsu datoru, lai Windows nevarētu startēt drošajā režīmā. Pēc tam tas var instalēt taustiņu bloķētāju, lai tvertu taustiņsitienus un nozagtu lietotājvārdus un paroles, kredītkaršu numurus vai citu sensitīvu informāciju. Sality var arī radīt tārpu, kas inficēs visus noņemamos datu nesējus, jo īpaši USB zibatmiņas diskus, un izraisīs vīrusa automātisku instalēšanu jebkurā datorā, kuram pievienosit USB disku.
Jaunas Sality attīstības tendences
Nesen Sality tika izmantots, lai izveidotu "zombiju datorus" un pievienotu inficētus datorus robottīkliem. Citiem vārdiem sakot, Sality tiek izmantota, lai sniegtu hakeriem attālu piekļuvi inficētām sistēmām un izmantotu šīs sistēmas, lai izplatītu surogātpastu, radītu krāpnieciskus klikšķus tīmeklī vai veiktu pakalpojuma atteikuma uzbrukumus mērķētām vietnēm — un tas viss notiek bez vietnes īpašnieku ziņas. inficētie datori. Nesen veiktā Sality robottīkla lieluma aplēse liecina, ka ar Sality pieslēgto datoru skaits ir 100 000.
Sākot ar 2010. gada vasaru, tika ziņots, ka Sality inficē datorus, izmantojot Trojas zirgu, kas izmanto tā saukto Windows “nulles stundas” ievainojamību, izmantojot veidu, kā Windows apstrādā īsinājumtaustiņus. Tādā veidā Sality ir līdzīgs vīrusam Stuxnet . Būtībā Trojas zirgs inficē datoru un kaut kur izveido .dll failu un .lnk failu, un, tiklīdz jūs virzāties uz direktoriju, kurā tiek glabāts .lnk fails, .dll tiek aktivizēts un Sality sāk darboties. Kopš ievainojamības atklāšanas Microsoft ir izdevusi Windows atjauninājumus, lai novērstu ievainojamību. Tomēr pēdējā laikā šī ievainojamība ir bijis galvenais Sality inficēšanās līmeņa pieauguma iemesls, jo daudzi cilvēki vienkārši neatjaunina Windows pietiekami bieži vai vispār neatjaunina.
Sāls joprojām ir nozīmīgs drauds, galvenokārt tā polimorfā rakstura dēļ. Tas var mainīt savu kodu, šifrējot sevi atšķirīgi katram failam vai datoram, ko Sality inficē, kas ir paredzēts, lai apgrūtinātu Sality atklāšanu skenēšanas laikā. Jebkurā gadījumā eksperti uzskata, ka Sality veidotāju galvenais mērķis ir izmantot Sality, lai savāktu un iekļautu pēc iespējas vairāk kaitīga un kaitīga koda. Tāpēc pārskatāmā nākotnē, visticamāk, būs nepieciešama pastāvīga modrība pret Sality.
Pseidonīmi
15 drošības pārdevēji atzīmēja šo failu kā ļaunprātīgu.
| Antivirus Vendor | Atklāšana |
|---|---|
| TrendMicro | TROJ_SALITY.AM |
| Symantec | W32.Sality.AB |
| Sophos | W32/Sality-AM |
| Prevx1 | Cloaked Malware |
| Panda | W32/Sality.AC.worm |
| NOD32 | Win32/Sality.AD |
| Microsoft | Worm:Win32/Sality.AH!dll |
| McAfee | W32/Sality.dll |
| Ikarus | Virus.Win32.Sality |
| Fortinet | W32/KillAV.NH!tr |
| F-Secure | Trojan.Win32.KillAV.nh |
| eTrust-Vet | Win32/Maazben!generic |
| eSafe | Win32.KillAV.nh |
| Comodo | Win32.Sality.AD |
| ClamAV | Trojan.Small-4845 |
SpyHunter atklāj un noņem Sāls
Sīkāka informācija par failu sistēmu
Sāls var izveidot šādu(s) failu(s):
| # | Faila nosaukums | MD5 |
Atklājumi
Atklāšanas gadījumi: apstiprināto un aizdomīgo gadījumu skaits par konkrētu apdraudējumu, kas atklāts inficētos datoros, kā ziņo SpyHunter.
|
|---|---|---|---|
| 1. | 256f4b43f77e46cc37dbb0701850f7d38353a0f6e980174c0e79716641ac4e65 | 72410784cc6a484cc839f254d68e0eea | 3 |
| 2. | Virus.Win32.Iframer.c | 334215be25fe0b1d4ce4286318fd0472 | 2 |
| 3. | file.exe | 627b8095b1024a0ddfdfa01bf9aff803 | 1 |
| 4. | sa-643166.exe | e3bec9eb5e9375f37d681dd17bbbdd4e | 0 |
| 5. | Msmsgs.exe | 9e35482e8ef527840071f91218658932 | 0 |
| 6. | winjmxy.exe | c24411d4e373e19404eb3154f3233ad0 | 0 |
| 7. | 7g7G8B2C.exe | f339095d454772ad8cb9c340f13e1678 | 0 |
| 8. | bd3q0qix.exe | b503241f1dcc27fe6fb0998d2b05fdb4 | 0 |
| 9. | iii[1].exe | 5fc359ad746100efc0d82d6e1c29f77d | 0 |
| 10. | bd3q0qix.exe,vamsoft.exe | e7b53d00459864b22552f7119179fd29 | 0 |
| 11. | TckBX673.exe | 046f1a09caa11f2e69162af783d7e89c | 0 |
| 12. | load[1].exe | 426444c904c4d960118913467204ed0d | 0 |
| 13. | winkfmc.exe | f718b5d0f994207183694e207046ac69 | 0 |
| 14. | ParisHilton[1].exe | 4358fc8cb0254b909eab71431332918c | 0 |
Analīzes ziņojums
Galvenā informācija
| Family Name: | Virus.Sality |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
de738ab0e456a4fc7a15462d2f442755
SHA1:
b3cbc2a422889211b42469434ae53b42968411bc
Faila lielums:
136.99 KB, 136992 bytes
|
|
MD5:
dfcf08b8ed815850e6933187cea6d039
SHA1:
5b63fab6ab6a9d9efa9df45fa8f867b3d0878908
Faila lielums:
103.14 KB, 103140 bytes
|
|
MD5:
6a6807cf3039b85a8e9a77be7b801e6d
SHA1:
6aeb7b7c20d664e237b2af5cd175bdc1342b758d
Faila lielums:
103.14 KB, 103140 bytes
|
|
MD5:
6f8abefb5fcb91f0652e558f1ade51cc
SHA1:
21c11e0aa0bb8ac2446bf5dbc355bdeb2264280d
Faila lielums:
218.91 KB, 218912 bytes
|
|
MD5:
9233013357f95eab175140bc9f590858
SHA1:
4919d37fdeab3713fe914978858ddd3d865d51c1
SHA256:
6736037AFD5AEDCAD934247E4343D7DCB9DF0452A22A1E01B591447E2E46A2FA
Faila lielums:
103.14 KB, 103140 bytes
|
Show More
|
MD5:
cf1562fe8d02b1485686c6fd5cad0c79
SHA1:
1b05e5ea5716bfd8b0bd0deb6fecd05ff904b61f
SHA256:
3B8B07E341BD408512D47BBA421C95A14CC61CB76525BB16E7C3DAF1FDA6DE83
Faila lielums:
9.93 MB, 9926976 bytes
|
|
MD5:
b53a7ba023575b096f71bc8d2da5f67a
SHA1:
35d3bf379e95684f671bc5efb5dbbc154b73a3bc
SHA256:
8A619A448C2FFE0D37ABEB21288674952E4E65AFA57C23A1047CCCA0B19E933E
Faila lielums:
103.14 KB, 103140 bytes
|
|
MD5:
8306b38ea1d2083e943d6273fa8b3e4f
SHA1:
6676fdd6fd646a2c31352f7af41d08d5c6a8b109
SHA256:
5BDA53053924C8077A6ED322440DD176624474525A61936565668852EC4B5D13
Faila lielums:
1.93 MB, 1926448 bytes
|
|
MD5:
5f711b5ae8a4f9c69c3124df020f9698
SHA1:
2557ff72979a7773afb366d128d5b34faad4fa03
SHA256:
B4DD13C469CAA0D4051CAA0B86B0A22D1DD65FC4AA75548DC97B568B0D39F65E
Faila lielums:
1.12 MB, 1118949 bytes
|
|
MD5:
ef61d174c365813a12bbccede429d234
SHA1:
b0a1ea3966d8bd4b028802d5a680607cb9f70dea
SHA256:
23CE0F89F74D21C2321CE8C7BE641D4B6C56D573CE9DCBB42B9D57E41F420644
Faila lielums:
103.14 KB, 103140 bytes
|
|
MD5:
81869a5a1b0959d3c4443b9eda565e2a
SHA1:
e3ead28be912b13aa0816ad3d6b2289cecb7ccfd
SHA256:
C3E074C3058AE6F8C5788E0251AC59C838D9CE6637FF5C16D2895C32B136CD12
Faila lielums:
103.14 KB, 103140 bytes
|
|
MD5:
863c155b65d5831e4f577804ee2c4b79
SHA1:
78c037c4d0a828e877cac4d4e1fdb9c1d3982c96
SHA256:
B006A8A56D8F91D43EA438B0BEEE23ADFBA8A162D8D85BEBE326C9F64502EF13
Faila lielums:
103.14 KB, 103140 bytes
|
|
MD5:
095fac5b98fc4f60f4d02cd49bf57846
SHA1:
7bcd2767c5edb9847c6cc934f64551df2b42c5f9
SHA256:
D26AC358A19D3465CFC4F146C65F48E23DD5A6D5DD0B859D1F4FC643342E677F
Faila lielums:
103.14 KB, 103140 bytes
|
|
MD5:
a652034dec8f99577903918c506e1987
SHA1:
1edd77bf74fb8a10bf1c688073e3f29c33108e8f
SHA256:
78826624ECB5E6624A9925E59E01B44505B489140B6C09AC7E89261E6399690E
Faila lielums:
103.14 KB, 103140 bytes
|
|
MD5:
c803c8286377c3f155998fbbaa1ff443
SHA1:
4d9e7482fc372c1deffc7d500fd677ff7b39b615
SHA256:
902B61D51F5519D32AD1476D918E28C6FACC9022F6D8E0A5BAE127517D7D8CD8
Faila lielums:
159.74 KB, 159744 bytes
|
|
MD5:
12e604fcd646871fb046367a336f4276
SHA1:
1740006d2579aa33c94a41fd0af544387c2c5fb7
SHA256:
C2A185F0B504F814DDC64698319E0E61B39FA3AA31CC08F59FB99662C294D612
Faila lielums:
133.55 KB, 133552 bytes
|
|
MD5:
de1cde02a70e2fc28399986a44e3fa1e
SHA1:
e0e9d1c3e11b55499298bac412418762959797e6
SHA256:
F056292A4C0C01462B6CA713E04CC7F664D5EFDFC6A577DD950C4C1B3E96C2C1
Faila lielums:
311.02 KB, 311019 bytes
|
|
MD5:
85ee116968a3c618652c5a6ce25ffe8d
SHA1:
25d7f982048408b6510cd65a84ff9a5b7ea7866e
SHA256:
6B9002CBFA2796AA9CD1069ABCEA6932FF492152188EDAE7FBE6FA6350F511FE
Faila lielums:
5.82 MB, 5822483 bytes
|
|
MD5:
aec3db01890ba541c99bbc36c8fcc1d9
SHA1:
c0a832646e7683486c180f4a9f57d810973a19df
SHA256:
F647214C0B976702535396D761353D4342A95BD252DBD5CD05FA88D5E061B636
Faila lielums:
932.35 KB, 932352 bytes
|
|
MD5:
4df76bd0e97fc049271daf2717743520
SHA1:
799ae57c793a8c9802443e5756487e850c9433e9
SHA256:
2CAE82F9B3CD3F7924E5A07F8AF404B70120FA3EDCF4EDA9DF2849C3764E17D0
Faila lielums:
98.64 KB, 98640 bytes
|
|
MD5:
982b3e5987cbc6cf6be1a369599b5ec5
SHA1:
ed67200761fff0f5d678df451e6f625f190bc0e1
SHA256:
76A4B68966AE3ADDE038149A803CA5086F54C1D01FF441F9FBCDDF7B406BA6A1
Faila lielums:
99.33 KB, 99328 bytes
|
|
MD5:
64697fe83d6085b5c0566d6872be829a
SHA1:
ce94f779ebc4ff8ca36722f70194468d56f24d14
SHA256:
7BC4476EE502207D868A6A7BA2260F67A0B27D1B84D3736FA1698CF306D60757
Faila lielums:
469.61 KB, 469608 bytes
|
|
MD5:
cb1b67fba623a326d96a2ae7483ec15e
SHA1:
8c57dbab3f5aa56a88dddf36236bec1e583553a6
SHA256:
9B5568A9D9F549F40746883BD9DBB3EAFEF02F344F386EE8C4C8D6E5DDE50FE7
Faila lielums:
99.33 KB, 99328 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Vārds | Vērtība |
|---|---|
| Comments | iProg Pro |
| Company Name |
|
| File Description |
|
| File Version |
|
| Full Version |
|
| Internal Build Number | 77018 |
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- 2+ executable sections
- big overlay
- HighEntropy
- imgui
- Installer Manifest
- Installer Version
- No Version Info
- SusSec
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 0 |
| Unknown Blocks: | 0 |
Visual Map
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- BadJoke.XA
- Banker.YA
- Delf.Spy.B
- Delf.XB
- Expiro.C
Show More
- Injector.DFF
- Injector.FCH
- Injector.FHBA
- Injector.KS
- KillAV.X
- Kryptik.RA
- Kryptik.YHB
- Nockat.A
- Sality.A
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\002ca755_rar\ce94f779ebc4ff8ca36722f70194468d56f24d14_0000469608 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\002ca755_rar\ce94f779ebc4ff8ca36722f70194468d56f24d14_0000469608 | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\002ca755_rar\ce94f779ebc4ff8ca36722f70194468d56f24d14_0000469608 | Generic Write,Read Attributes,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\002ca755_rar\ce94f779ebc4ff8ca36722f70194468d56f24d14_0000469608 | Generic Write,Read Attributes,LEFT 262144 |
| c:\users\user\appdata\local\temp\002ca755_rar\ce94f779ebc4ff8ca36722f70194468d56f24d14_0000469608 | Generic Write,Read Data,Read Attributes,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\002ca755_rar\ce94f779ebc4ff8ca36722f70194468d56f24d14_0000469608 | Generic Write,Read Data,Read Attributes,LEFT 262144 |
| c:\users\user\appdata\local\temp\bpck.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show More
| c:\users\user\appdata\local\temp\bpck.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\bpck.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\jvqomr.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\jvqomr.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\jvqomr.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\winllhw.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\winllhw.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\winllhw.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\winqwisr.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\winqwisr.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\winqwisr.exe | Synchronize,Write Attributes |
| c:\windows\20b848 | Generic Write,Read Attributes |
| c:\windows\20b951 | Generic Write,Read Attributes |
| c:\windows\20bc01 | Generic Write,Read Attributes |
| c:\windows\92a247c | Generic Write,Read Attributes |
| c:\windows\system.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Dati | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\policies\system::disabletaskmgr | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\policies\system::disableregistrytools | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::antivirusoverride | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::firewalloverride | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::uacdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows\currentversion\policies\system::enablelua | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications | RegNtPreCreateKey | |
| HKCU\software\apcr\1214104697::1919251317 | y | RegNtPreCreateKey |
| HKCU\software\apcr\1214104697::-456464662 | RegNtPreCreateKey | |
| HKCU\software\apcr\1214104697::1462786655 | RegNtPreCreateKey | |
| HKCU\software\apcr\1214104697::-912929324 | # | RegNtPreCreateKey |
| HKCU\software\apcr\1214104697::1006321993 | ƃ | RegNtPreCreateKey |
| HKCU\software\apcr\1214104697::-1369393986 | http://cikmayedekparca.com/images/logos.gif http://brucegarrod | RegNtPreCreateKey |
| HKCU\software\apcr\1214104697::549857331 | RegNtPreCreateKey | |
| HKCU\software\apcr::u1_0 | ᅕ쒧 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_0 | ♨ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_0 | 権ă | RegNtPreCreateKey |
| HKCU\software\apcr::u4_0 | RegNtPreCreateKey | |
| HKCU\software\apcr::u1_1 | 謭믨 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_1 | 擷牥 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_1 | ᥜ獦 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_1 | 獵牥 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_2 | ꮧ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_2 | ｻ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_2 | 賃 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_2 | | RegNtPreCreateKey |
| HKCU\software\apcr::u1_3 | პ낭 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_3 | 䘺地 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_3 | ぶ嘳 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_3 | 婟地 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_4 | Ȓ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_4 | 큥즕 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_4 | ꟽ좖 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_4 | 췔즕 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_5 | 鸫珊 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_5 | 娔㯻 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_5 | ⭠㫸 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_5 | 䅉㯻 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_6 | 惜Ἀ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_6 | 꾺깠 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_6 | RegNtPreCreateKey | |
| HKCU\software\apcr::u4_6 | 뒾깠 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_7 | ➞▢ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_7 | 㹆 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_7 | 䈚⇅ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_7 | ⠳ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_8 | 蠅 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_8 | 뮣錫 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_8 | 鈨 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_8 | 鮨錫 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_9 | ຣ㖺 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_9 | ᖘ֑ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_9 | 攴Ғ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_9 | ༝֑ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_10 | 벘 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_10 | ꄧ矶 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_10 | 盵 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_10 | 芒矶 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_11 | 腈焋 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_11 | | RegNtPreCreateKey |
| HKCU\software\apcr::u3_11 | 鰮 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_11 | | RegNtPreCreateKey |
| HKCU\software\apcr::u1_12 | ጪ轱 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_12 | 糋峁 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_12 | ͕巂 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_12 | 楼峁 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_13 | 덌㎠ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_13 | ﹶ켦 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_13 | 뛘츥 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_13 | RegNtPreCreateKey | |
| HKCU\software\apcr::u1_14 | ؋ࣆ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_14 | 䞈䆌 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_14 | 㩏䂏 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_14 | 偦䆌 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_15 | 꼜 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_15 | RegNtPreCreateKey | |
| HKCU\software\apcr::u3_15 | ꧲닲 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_15 | 쏛돱 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_16 | 䠆ꇪ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_16 | ♗ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_16 | 嵹❔ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_16 | 㝐♗ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_17 | ᢘ튽 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_17 | 똢颼 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_17 | 샬馿 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_17 | 颼 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_18 | 멃瓆 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_18 | 㷫ଢ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_18 | 琓ਡ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_18 | Ḻଢ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_19 | 䞈 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_19 | 蓅綇 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_19 | ﮆ粄 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_19 | 醯綇 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_20 | 彪儖 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_20 | ☧ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_20 | 漍 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_20 | Ԥ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_21 | 痺 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_21 | 曆扒 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_21 | ኰ捑 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_21 | 碙扒 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_22 | 塑伞 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_22 | 磻풷 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_22 | 蘧햴 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_22 | 풷 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_23 | 꿍棝 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_23 | 䑠䜝 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_23 | 㖪䘞 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_23 | 徃䜝 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_24 | ꆡ궃 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_24 | 쩿릂 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_24 | 룑뢁 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_24 | 틸릂 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_25 | RegNtPreCreateKey | |
| HKCU\software\apcr::u2_25 | 搐⯨ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_25 | ⱄ⫫ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_25 | 䙭⯨ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_26 | RegNtPreCreateKey | |
| HKCU\software\apcr::u2_26 | ꐟ鹍 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_26 | 폋齎 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_26 | 맢鹍 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_27 | RegNtPreCreateKey | |
| HKCU\software\apcr::u2_27 | ㅯႳ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_27 | 䝾ᆰ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_27 | ⵗႳ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_28 | 튕ⵝ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_28 | 뮿茘 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_28 | 쫥舛 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_28 | ꃌ茘 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_29 | 昘⸞ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_29 | | RegNtPreCreateKey |
| HKCU\software\apcr::u3_29 | 繨 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_29 | ᑁ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_30 | 껻履 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_30 | 鬈柣 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_30 | 曠 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_30 | 螶柣 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_31 | 腾蔝 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_31 | RegNtPreCreateKey | |
| HKCU\software\apcr::u3_31 | RegNtPreCreateKey | |
| HKCU\software\apcr::u4_31 | RegNtPreCreateKey | |
| HKCU\software\apcr::u1_32 | 导誨 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_32 | 睧䲮 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_32 | ҉䶭 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_32 | 溠䲮 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_33 | ੌ倎 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_33 | 郞뼓 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_33 | 蠼븐 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_33 | 뼓 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_34 | RegNtPreCreateKey | |
| HKCU\software\apcr::u2_34 | 亪ㅹ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_34 | 㾣ぺ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_34 | 喊ㅹ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_35 | ؼ洭 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_35 | RegNtPreCreateKey | |
| HKCU\software\apcr::u3_35 | ꋖꋝ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_35 | 죿ꏞ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_36 | 嵒 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_36 | ◲ᙄ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_36 | 噝ᝇ | RegNtPreCreateKey |
| HKCU\software\apcr::u4_36 | 㱴ᙄ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_37 | ힾ | RegNtPreCreateKey |
| HKCU\software\apcr::u2_37 | 녨袩 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_37 | 엀親 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_37 | 꿩袩 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_38 | 뇚 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_38 | ݸ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_38 | 䥷兀 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_38 | ⍞ | RegNtPreCreateKey |
| HKCU\software\apcr::u1_39 | 잞䨃 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_39 | 衰浴 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_39 | ﳺ汷 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_39 | 雓浴 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_40 | | RegNtPreCreateKey |
| HKCU\software\apcr::u2_40 | RegNtPreCreateKey | |
| HKCU\software\apcr::u3_40 | RegNtPreCreateKey | |
| HKCU\software\apcr::u4_40 | RegNtPreCreateKey | |
| HKCU\software\apcr::u1_41 | 磮ό | RegNtPreCreateKey |
| HKCU\software\apcr::u2_41 | 媐刿 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_41 | ប匼 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_41 | 綽刿 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_42 | 呏㾇 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_42 | 쒤 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_42 | 鬛얧 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_42 | 쒤 | RegNtPreCreateKey |
| HKCU\software\apcr::u1_43 | 㸝Д | RegNtPreCreateKey |
2951 additional registry modifications are not displayed above.
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| Network Winsock2 |
|
| Keyboard Access |
|
| User Data Access |
|
| Network Wininet |
|
| Network Winhttp |
|
