Threat Database Trojans Trojan.Begseabug

Trojan.Begseabug

By JubileeX in Trojans

Threat Scorecard

Threat Level: 80 % (High)
Infected Computers: 11
First Seen: February 28, 2016
Last Seen: February 26, 2023
OS(es) Affected: Windows

Trojan.Begseabug is a malignant computer trojan that drops more malware threats onto the infected computer system. Trojan.Begseabug also drops and executes harmful files onto the affected computer. Once installed, Trojan.Begseabug creates certain dangerous registry entries to allow its automatic execution every time Windows boots up. Trojan.Begseabug prevents security-related applications from running by disabling security service. Remove Trojan.Begseabug as quickly as possible to secure your computer.

File System Details

Trojan.Begseabug may create the following file(s):
# File Name Detections
1. %Temp%\IXP000.TMP\Setup4.exe
2. %System%\[RANDOM CHARACTERS].exe
3. %Temp%\IXP001.TMP\Setup8.exe
4. %Temp%\IXP001.TMP\QVODSE~1.EXE
5. %Temp%\IXP001.TMP\Setup4.exe
6. %Temp%\IXP000.TMP\Setup8.exe
7. %System%\system.exe
8. %Temp%\1.tmp

Registry Details

Trojan.Begseabug may create the following registry entry or registry entries:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Temp%\IXP000.TMP\Setup8.exe" = "%Temp%\IXP000.TMP\Setup8.exe:*:Enabled:QVOD"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Temp%\IXP000.TMP\Setup4.exe" = "%Temp%\IXP000.TMP\Setup4.exe:*:Enabled:QVOD"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Temp \IXP001.TMP\Setup4.exe" = "%Temp%\IXP001.TMP\Setup4.exe:*:Enabled:QVOD"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\"wextract_cleanup0" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 \"%Temp%\IXP000.TMP\\""
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\"wextract_cleanup1" = "rundll32.exe %System%\advpack.dll,DelNodeRunDLL32 \"%Temp%\IXP001.TMP\\""
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"%Temp%\IXP001.TMP\Setup8.exe" = "%Temp%\IXP001.TMP\Setup8.exe:*:Enabled:QVOD"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"system" = "%System%\system.exe"

Trending

Most Viewed

Loading...