Trojan.MSIL.Perseus.K

The detection of Trojan.MSIL.Perseus.K on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to infiltrate and compromise your computer, potentially leading to unauthorized access, data theft, and other malicious activities. It is essential to understand the nature of this threat and take prompt action to remove it and prevent future infections.

What Is Trojan.MSIL.Perseus.K?

Trojan.MSIL.Perseus.K is a type of Trojan horse malware that can infect your computer through various means, such as downloading malicious software, visiting compromised websites, or opening infected email attachments. Once inside, it can perform a range of malicious activities, including data theft, unauthorized access, and disruption of system operations. The name "Trojan.MSIL.Perseus.K" suggests that it is a Trojan-type threat, but the specific characteristics and behaviors of this malware are not well-documented.

How Trojan.MSIL.Perseus.K Operates

Like other Trojans, Trojan.MSIL.Perseus.K is designed to operate stealthily, avoiding detection by security software and system administrators. It may use various techniques to evade detection, such as code obfuscation, anti-debugging, and encryption. Once installed, it can communicate with its command and control servers to receive instructions and transmit stolen data. The malware may also attempt to spread to other systems, either through network connections or by infecting removable media.

Symptoms of Infection

The symptoms of a Trojan.MSIL.Perseus.K infection can vary, but common indicators include unusual system behavior, such as slow performance, frequent crashes, and unexpected pop-ups or alerts. You may also notice that your system is accessing the internet without your permission, or that your personal data is being transmitted to unknown destinations. In some cases, the malware may attempt to disable security software or prevent you from accessing certain system functions.

How to Remove Trojan.MSIL.Perseus.K

1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious files or registry entries associated with Trojan.MSIL.Perseus.K.
3. Uninstall any suspicious programs or applications that may be related to the malware infection.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
5. Reboot your system and perform another full scan with your anti-malware tool to ensure that all remnants of the malware have been removed.

Conclusion

Removing Trojan.MSIL.Perseus.K from your system requires careful attention to detail and a thorough understanding of the malware's behavior. By following the steps outlined above, you can help to ensure that your system is free from infection and that your personal data is protected. It is also essential to maintain good security practices, such as regularly updating your operating system and security software, using strong passwords, and avoiding suspicious downloads and email attachments. By taking these precautions, you can reduce the risk of future malware infections and protect your digital assets. Remember to stay vigilant and monitor your system for any signs of suspicious activity, and seek professional help if you are unsure about any aspect of the removal process.

Analysis Report

General information

Family Name:	Trojan.MSIL.Perseus.K
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 9c7af936a0279b773ffba33b6de25624 SHA1: 90a1f3d3ceabdaddd761d9fa1262a62a5d60edbd SHA256: AA42C61BBEEBD6CF0F97C1944FDA5DE963688DBC22BC115ED8CC3386C1477A84 File Size: 1.35 MB, 1354061 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Microsoft
File Version	1.00
Internal Name	Win
Original Filename	Win.exe
Product Name	Win
Product Version	1.00

File Traits

• .NET
• NewLateBinding
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\windows\system.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center::uacdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify		RegNtPreCreateKey

Show More

HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline		RegNtPreCreateKey
HKLM\software\microsoft\windows\currentversion\policies\system::enablelua		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions		RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications		RegNtPreCreateKey
HKCU\software\apcr\1214104697::1919251317	Û	RegNtPreCreateKey
HKCU\software\apcr\1214104697::-456464662		RegNtPreCreateKey
HKCU\software\apcr\1214104697::1462786655		RegNtPreCreateKey
HKCU\software\apcr\1214104697::-912929324	#	RegNtPreCreateKey
HKCU\software\apcr\1214104697::1006321993	é	RegNtPreCreateKey
HKCU\software\apcr\1214104697::-1369393986	http://affiliate.free.rongrean.com/logo.gifhttp://demo.mosiva	RegNtPreCreateKey
HKCU\software\apcr\1214104697::549857331	j�Փ�&�޿c��s���jS�+>�dya�6�{w��5_n(,"�)ǒ��=NZ ��H,z-?	RegNtPreCreateKey
HKCU\software\apcr::u1_0	鱞댶	RegNtPreCreateKey
HKCU\software\apcr::u2_0	⏑	RegNtPreCreateKey
HKCU\software\apcr::u3_0	権ă	RegNtPreCreateKey
HKCU\software\apcr::u4_0		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Other Suspicious	SetWindowsHookEx