Trojan.Ekstak.CA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 11,144 |
| Threat Level: | 90 % (High) |
| Infected Computers: | 548 |
| First Seen: | July 24, 2009 |
| Last Seen: | August 29, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Ekstak.CA on your system indicates a potential security threat that requires immediate attention. This report aims to provide you with a comprehensive understanding of the threat, its operation, symptoms, and most importantly, steps to remove it from your computer. It's essential to approach this situation with caution and follow the recommended guidance to ensure the malware is fully eradicated.
Table of Contents
What Is Trojan.Ekstak.CA?
Trojan.Ekstak.CA is identified as a Trojan-type threat, which means it is a type of malware designed to allow unauthorized access to a computer system. Trojans are known for their ability to disguise themselves as legitimate software, making them particularly dangerous as they can lead to significant data breaches and system compromises. The name itself does not directly indicate a specific malware family but suggests it has been categorized based on its behavior or characteristics.
How Trojan.Ekstak.CA Operates
Like other Trojans, Trojan.Ekstak.CA is likely designed to operate stealthily, aiming to remain undetected on the infected system for as long as possible. It may create backdoors, allowing remote access to the attackers, who can then use the infected computer for various malicious activities. These activities can include data theft, keylogging, spreading other malware, or even using the computer as part of a botnet for distributed denial-of-service (DDoS) attacks. The exact operation can vary widely depending on the intentions of the attackers and the specific capabilities of the Trojan.
Symptoms of Infection
Symptoms of a Trojan infection can be subtle and may not always be immediately apparent. However, common indicators include unusual system behavior, such as unexpected pop-ups, slow performance, frequent crashes, or unfamiliar programs appearing on the system. Sometimes, the presence of a Trojan might only be noticed when other security software detects and alerts about suspicious activity. Given the stealthy nature of Trojans, it's possible for a system to be infected without showing any noticeable symptoms, making regular scans with anti-malware tools crucial for detection.
How to Remove Trojan.Ekstak.CA
- Boot your computer in Safe Mode with Networking. This will help prevent the malware from loading and give you a cleaner environment to work in.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the tool is updated with the latest definitions to increase the chances of detecting and removing the Trojan.
- Uninstall any suspicious programs that you do not recognize or that were installed around the time the infection was detected. Be cautious and only remove programs you are certain are not essential to your system's operation.
- Reset your web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge) to their default settings. This can help remove any malicious extensions or settings changes made by the Trojan.
- After completing the above steps, reboot your computer and perform another full scan with your anti-malware tool to ensure that the Trojan.Ekstak.CA has been fully removed and no additional threats are present.
Conclusion
The removal of Trojan.Ekstak.CA requires careful and methodical steps to ensure the malware is completely eradicated from your system. It's crucial to stay vigilant and maintain good security practices to prevent future infections. This includes keeping your operating system and software up to date, using strong, unique passwords, being cautious with email attachments and downloads, and regularly scanning your system with reputable security software. By following these guidelines and remaining informed, you can significantly reduce the risk of malware infections and protect your digital assets.
Aliases
15 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| TrendMicro | WORM_UTOTI.RC |
| Symantec | W32.SillyDC |
| Sunbelt | Worm.Win32.Autoit.P |
| Prevx1 | Malicious Software |
| Panda | W32/Autorun.SF |
| NOD32 | Win32/Autoit.BA |
| McAfee | Generic.dx |
| Ikarus | Worm.Win32.AutoIt |
| GData | Win32.Worm.Autoit.P |
| Fortinet | W32/Autorun.H!worm |
| eTrust-Vet | Win32/Vishawon.A |
| eSafe | Suspicious File |
| Comodo | Worm.Win32.AutoIt.i |
| ClamAV | Trojan.Autoit-14 |
| CAT-QuickHeal | Worm.Autoit.i |
SpyHunter Detects & Remove Trojan.Ekstak.CA
File System Details
Trojan.Ekstak.CA may create the following file(s):
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | Msmsgs.exe | 7eae3ace4efaf2ce46234688451712d3 | 0 |
Analysis Report
General information
| Family Name: | Trojan.Ekstak.CA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
f8ab2927365e50a9b4aad8573bc2623c
SHA1:
6580b7c4f355be5723e5d46878336d747f330212
SHA256:
AD86AF432285CD2D91E4B91FFEBAFB8386AF1851D95E0A229539DDDE2C45D540
File Size:
3.63 MB, 3633149 bytes
|
|
MD5:
1844c432a530d16754cd179b8f6653ea
SHA1:
0b09b8512247559c0dd8f39d6927755113d2a0f6
SHA256:
50EEFF1C9C8035F42B78A1DA89CA89B56AC7609C757FEBC19FF84525CB1C6126
File Size:
4.36 MB, 4355958 bytes
|
|
MD5:
c45c7f7fd2a255cbcf6f473c2158d877
SHA1:
c03a9c32f26cf00ec6f0e470ff7dd99b4275a73a
SHA256:
83DF37EB035FDC46EA03AC91279B1A5E5DEA4BFBCA22BBCBA16C44279E586224
File Size:
2.40 MB, 2401792 bytes
|
|
MD5:
e3f51541c755023733610353a12ac261
SHA1:
2a95c0f2fec456e156de93b8e9565fd884095686
SHA256:
A283E1F38E4F21E6F8750BF448991FEECDE74DD68245DB3435FB3A4F9A462C32
File Size:
5.49 MB, 5487918 bytes
|
|
MD5:
5c95683bdc90a17a62dcce110569ec13
SHA1:
b345b6b1f3e7ba15585c16eafaa4cb1a4ec14f49
SHA256:
86378F6E305CC240AF83DE71EA00C9D7F00ADED6127C6A917DB518A6F9EAF39B
File Size:
5.93 MB, 5933908 bytes
|
Show More
|
MD5:
470515414df7a5b870fd60ec572d4832
SHA1:
9b4d42a1d035002253e145a476623854923da05c
SHA256:
86E1A0B56CC0B1A91D03128B0FE9BE09A74D639E50DA03163D5DD5739ED5E8B6
File Size:
3.39 MB, 3387176 bytes
|
|
MD5:
0c9c9e367d8225d8375000feedc4139f
SHA1:
79a3e3e9548d048239501bbaa3cda52c582b4c70
SHA256:
CACFA94849EEF6B94EBE4F649DDB977E954F699B004A1C6343511E484B34527C
File Size:
5.50 MB, 5495070 bytes
|
|
MD5:
2325bb42aa2e819d54724de263938584
SHA1:
569962f335d7f85de1e3d9a19f3e0bde2fe5e504
SHA256:
7F40EB04442F245D26D14BF22DF67B8BA8F5ED7830E3D4C8744C0BBAD371C5EB
File Size:
3.67 MB, 3671622 bytes
|
|
MD5:
08ec0b5b31ae374574b7a64b3e87b4b9
SHA1:
f669ea0c71615524e9a5f96714dc0478ab9635c1
SHA256:
DEF8603E1094739399420871AC7D96B188AABE32614F43F17AE630BCB8512E54
File Size:
3.39 MB, 3388118 bytes
|
|
MD5:
3905c72665d91077f6ccade1381fd291
SHA1:
1c93d1db2535424710a65bd20bfbef5d90d33b69
SHA256:
43B6A4C588188224657B6B099A1D64A71B6B439A8679C0199765CFCF3E527AF0
File Size:
3.57 MB, 3567578 bytes
|
|
MD5:
e27540ed7dce2b375a39517502c52e12
SHA1:
a0007d47d8e5ee5427daa9798b43ee676d995b86
SHA256:
77093BCC61CF886DDFA38244E9B43322D0EE0E4806DBD791CA9CF17C9336CFCC
File Size:
4.07 MB, 4072448 bytes
|
|
MD5:
1ba78fb463309251903bb4982b291649
SHA1:
37e4ea3e247948c1d86598b1a72904c9ebb8e3bb
SHA256:
C69C21F1E3382CE2DE4F14BABF82A0973753B071BAD64B93A5A4A96DF3D3E5B1
File Size:
4.30 MB, 4304890 bytes
|
|
MD5:
80676b5dad2edb2dc4ead840725b768b
SHA1:
bc8b60af5b62b4f91fb3cd0c536855563b9ea984
SHA256:
124213CAA31122FCA2A2CA1B79A93C43FD2841C2C629F3C87DE3C223907FF44C
File Size:
8.74 MB, 8739655 bytes
|
|
MD5:
92a9812f90f364aedc2a0338da98a67d
SHA1:
bb7c79a545323da7f281b6f208ac3e38a3939b67
SHA256:
793721ACD253F6DFDC68C141D9070183A510720B5A2C695B34E2220530D67C83
File Size:
1.61 MB, 1609721 bytes
|
|
MD5:
73b7fe3a0a3f300987438c29814a4b91
SHA1:
35c12a8ca1c8b358992c18f6e4d055554408a878
SHA256:
9F5B4F247B5A812E0F46A8191F15AB6A0795C960204221A9C28AF197CE033C75
File Size:
1.84 MB, 1843195 bytes
|
|
MD5:
dbcfd579e6e836a1b7eb075a603a4c1f
SHA1:
b150b819ce47d05023150712e702260df4c45af1
SHA256:
EF7C46416D9CEBAE9ADD7111EE481BA0AD5C2BA5CD89134364AE5C3C5E19311C
File Size:
4.40 MB, 4403983 bytes
|
|
MD5:
e1cebbb4713573da3106d1d3fa2b704e
SHA1:
daa5845da8fb2ddb9ace6b4c56a2bb65916235c1
SHA256:
CF928C265D67F67D8AEF6AF1A95D98FE594B67F3E593F35295EEBA8B2EE06661
File Size:
4.20 MB, 4197616 bytes
|
|
MD5:
e6d43bb3bc97306a7b8024f64649e019
SHA1:
4c3e8a8750b1e40e457cb3d8a9f2579a6e3e0dae
SHA256:
B47FBBB558FE1DA5602C539603E160AAD81F0348F25D7105CD1F0E78C7610D5F
File Size:
3.46 MB, 3457024 bytes
|
|
MD5:
3b16fa73ffe6454dc31cd006554168a4
SHA1:
47c27f7f379881e08e87ff8daaf138aa4c34929f
SHA256:
ED216199DA8A8ABE7306627776A203CB3D268D260DF5DCB17DEB3323FB84A1F7
File Size:
4.17 MB, 4171776 bytes
|
|
MD5:
e5579560049db75ead5812c9421faf51
SHA1:
323a32b6fb38c1d7038a4d84012b774a38cf3699
SHA256:
D9DF169BE299428C84187E0735DF9E4C286776865FB0176EA00884F0AA07A8B5
File Size:
3.09 MB, 3085673 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
7 additional icons are not displayed above.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
|
| Legal Trademarks | Copyright © 2008-2020 Auslogics Labs Pty Ltd |
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- 2+ executable sections
- HighEntropy
- imgui
- No Version Info
- VirtualQueryEx
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 3,411 |
|---|---|
| Potentially Malicious Blocks: | 254 |
| Whitelisted Blocks: | 1,818 |
| Unknown Blocks: | 1,339 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
0
?
0
0
0
x
x
x
x
x
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
x
x
?
?
?
?
?
?
?
?
?
?
x
?
?
0
0
?
?
?
?
?
?
?
0
0
?
?
?
0
0
?
?
?
?
0
0
?
?
?
?
?
?
?
0
0
x
0
0
?
0
0
?
?
?
?
?
?
0
0
?
0
?
?
?
?
?
?
0
?
?
?
?
?
?
?
x
?
?
?
?
0
?
?
?
?
?
0
0
?
?
?
0
?
?
0
0
0
?
0
0
?
0
x
?
0
?
?
0
x
?
?
0
0
0
?
0
0
0
0
x
?
?
?
?
?
0
0
0
0
?
?
?
?
?
?
x
?
?
?
0
?
?
?
?
?
0
?
0
0
0
?
?
0
?
?
?
0
?
?
0
0
?
0
?
0
?
0
0
?
?
?
0
?
?
?
x
0
0
0
0
0
?
?
?
0
0
0
?
0
0
?
0
0
0
0
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
0
0
0
0
0
0
0
?
?
0
0
0
?
?
x
0
?
0
0
?
?
x
0
?
?
?
?
?
?
?
0
0
0
0
?
?
?
x
?
?
?
?
?
0
0
?
0
?
0
0
x
0
?
?
?
?
?
0
0
?
0
0
0
0
?
0
0
?
?
0
?
0
0
x
?
?
0
?
?
?
?
0
?
?
?
?
?
0
0
0
0
?
?
?
0
0
?
?
?
?
?
?
?
?
0
0
?
0
x
0
x
0
?
0
?
?
x
0
0
0
?
?
?
0
0
?
?
0
?
?
?
0
?
0
0
0
?
?
?
?
?
?
?
?
?
?
0
?
0
0
x
0
0
?
0
0
?
?
0
?
x
?
?
x
?
?
0
0
?
x
?
?
?
?
?
x
?
?
?
?
?
?
0
0
?
0
0
x
?
?
0
?
?
?
?
0
0
?
?
?
?
x
0
?
?
0
0
0
?
?
?
?
?
?
?
0
0
0
0
?
?
?
?
0
0
?
x
0
x
?
0
?
?
0
?
?
?
0
0
?
x
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
0
0
0
?
?
0
0
?
?
?
0
0
?
0
?
?
?
0
?
0
0
0
0
?
?
?
0
0
?
?
?
?
0
x
0
x
?
0
0
?
?
0
0
?
?
?
?
0
0
?
0
0
0
0
?
?
?
0
x
0
0
x
0
?
?
?
0
0
?
?
?
?
0
0
0
?
?
?
?
?
0
?
0
?
0
0
?
0
0
?
?
?
?
?
?
?
?
?
0
0
?
?
0
?
?
0
0
x
0
0
x
?
?
?
?
0
?
?
?
?
0
0
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
?
0
?
?
?
0
0
?
?
?
?
0
0
?
?
?
0
0
0
?
0
0
?
0
0
?
?
?
0
0
?
?
0
0
?
?
?
?
?
?
?
?
?
0
0
0
0
?
0
0
0
?
?
0
0
?
?
?
0
0
?
0
?
?
?
0
x
x
?
?
?
0
0
?
?
?
?
?
?
0
0
0
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
0
?
0
0
0
?
?
0
0
?
?
?
?
?
?
?
?
?
x
?
?
?
?
?
?
?
?
x
?
0
0
0
?
?
0
0
?
0
0
?
?
0
0
?
?
0
?
?
0
0
?
?
?
?
?
?
?
?
0
0
?
0
?
0
0
?
x
x
?
?
?
?
?
0
?
?
?
?
0
?
?
0
?
?
?
?
?
0
?
?
?
?
?
0
x
?
?
?
?
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
0
?
x
?
?
0
0
?
0
?
?
x
0
0
0
0
?
?
x
?
?
0
x
?
?
?
0
0
?
?
?
?
?
?
?
?
x
?
?
?
?
x
?
?
0
?
?
x
?
x
0
x
?
?
?
?
?
?
?
?
?
?
x
?
0
0
?
?
x
0
?
x
?
0
x
0
?
0
?
?
?
x
?
?
?
0
0
?
0
?
0
?
x
x
?
?
0
?
x
?
x
?
0
?
0
0
0
?
x
?
?
x
x
0
0
0
?
0
?
0
0
0
0
?
x
0
?
?
?
0
0
0
?
x
?
x
?
?
x
0
0
?
0
?
?
?
x
0
?
0
?
?
x
?
x
?
0
?
0
?
x
?
?
?
?
?
0
0
?
?
x
x
0
?
0
?
?
?
0
0
?
?
x
?
x
?
?
0
?
?
0
?
0
x
0
0
?
0
?
?
?
0
?
?
?
?
?
0
x
?
?
0
?
0
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\temp\is-p65m0.tmp\teamviewer serial key.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\rarsfx0 | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\rarsfx0\__tmp_rar_sfx_access_check_5203453 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\rarsfx0\crack.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\rarsfx0\crack.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\rarsfx1 | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\rarsfx1\__tmp_rar_sfx_access_check_5204921 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\rarsfx1\teamviewer 15 crack.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\rarsfx1\teamviewer 15 crack.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\rarsfx1\teamviewer serial key.exe | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\rarsfx1\teamviewer serial key.exe | Synchronize,Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Keyboard Access |
|
| Anti Debug |
|
| User Data Access |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Service Control |
|
| Network Winsock |
|
| Encryption Used |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
(NULL) C:\Users\Qwtlwgbf\AppData\Local\Temp\RarSFX0\Crack.exe
|
(NULL) C:\Users\Qwtlwgbf\AppData\Local\Temp\RarSFX1\TeamViewer 15 Crack.exe
|
(NULL) C:\Users\Qwtlwgbf\AppData\Local\Temp\RarSFX1\TeamViewer Serial Key.exe
|
"C:\Users\Qwtlwgbf\AppData\Local\Temp\is-P65M0.tmp\TeamViewer Serial Key.tmp" /SL5="$5034A,7223725,58368,C:\Users\Qwtlwgbf\AppData\Local\Temp\RarSFX1\TeamViewer Serial Key.exe"
|
