Trojan.Rhubot

By GoldSparrow in Trojans

Threat Scorecard

Threat Level:	90 % (High)
Infected Computers:	6

First Seen:	May 9, 2014
Last Seen:	March 7, 2020
OS(es) Affected:	Windows

Trojan.Rhubot is a Trojan that may use the targeted PC to initiate distributed denial-of-service (DDoS) attacks. Once loaded, Trojan.Rhubot creates numerous potentially infected files on the contaminated computer system. Trojan.Rhubot also creates numerous registry entries. Trojan.Rhubot then connects to the distant locations. Trojan.Rhubot may then execute potentially harmful activities on the affected computer system such as retrieve a list of affected websites and use the corrupted PC to initiate DDoS attacks.

Table of Contents

File System Details

Trojan.Rhubot may create the following file(s):

Expand All | Collapse All

#	File Name	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	%UserProfile%\Application Data\msup1.exe
Name: %UserProfile%\Application Data\msup1.exe Type: Executable File Group: Malware file
2.	%UserProfile%\Application Data\msup10.exe
Name: %UserProfile%\Application Data\msup10.exe Type: Executable File Group: Malware file
3.	%UserProfile%\Application Data\msup11.exe
Name: %UserProfile%\Application Data\msup11.exe Type: Executable File Group: Malware file
4.	%UserProfile%\Application Data\msup12.exe
Name: %UserProfile%\Application Data\msup12.exe Type: Executable File Group: Malware file
5.	%UserProfile%\Application Data\msup13.exe
Name: %UserProfile%\Application Data\msup13.exe Type: Executable File Group: Malware file
6.	%UserProfile%\Application Data\msup14.exe
Name: %UserProfile%\Application Data\msup14.exe Type: Executable File Group: Malware file
7.	%UserProfile%\Application Data\msup15.exe
Name: %UserProfile%\Application Data\msup15.exe Type: Executable File Group: Malware file
8.	%UserProfile%\Application Data\msup16.exe
Name: %UserProfile%\Application Data\msup16.exe Type: Executable File Group: Malware file
9.	%UserProfile%\Application Data\msup17.exe
Name: %UserProfile%\Application Data\msup17.exe Type: Executable File Group: Malware file
10.	%UserProfile%\Application Data\msup18.exe
Name: %UserProfile%\Application Data\msup18.exe Type: Executable File Group: Malware file
11.	%UserProfile%\Application Data\msup19.exe
Name: %UserProfile%\Application Data\msup19.exe Type: Executable File Group: Malware file
12.	%UserProfile%\Application Data\msup2.exe
Name: %UserProfile%\Application Data\msup2.exe Type: Executable File Group: Malware file
13.	%UserProfile%\Application Data\msup20.exe
Name: %UserProfile%\Application Data\msup20.exe Type: Executable File Group: Malware file
14.	%UserProfile%\Application Data\msup3.exe
Name: %UserProfile%\Application Data\msup3.exe Type: Executable File Group: Malware file
15.	%UserProfile%\Application Data\msup4.exe
Name: %UserProfile%\Application Data\msup4.exe Type: Executable File Group: Malware file
16.	%UserProfile%\Application Data\msup5.exe
Name: %UserProfile%\Application Data\msup5.exe Type: Executable File Group: Malware file
17.	%UserProfile%\Application Data\msup6.exe
Name: %UserProfile%\Application Data\msup6.exe Type: Executable File Group: Malware file
18.	%UserProfile%\Application Data\msup7.exe
Name: %UserProfile%\Application Data\msup7.exe Type: Executable File Group: Malware file
19.	%UserProfile%\Application Data\msup8.exe
Name: %UserProfile%\Application Data\msup8.exe Type: Executable File Group: Malware file
20.	%UserProfile%\Application Data\msup9.exe
Name: %UserProfile%\Application Data\msup9.exe Type: Executable File Group: Malware file

Registry Details

Trojan.Rhubot may create the following registry entry or registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup1.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup10.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup11.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup12.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup13.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup14.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup15.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup16.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup17.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup18.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup19.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup2.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup20.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup3.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup4.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup5.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup6.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup7.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup8.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM CHARACTERS]" = "%UserProfile%\Application Data\msup9.exe"

URLs

Trojan.Rhubot may call the following URLs:

Aktualisieren-soft.ru

Blog32.ru

Teleon2.ru

Tryboots.ru

Vsehnahuy.com

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Trojan.Rhubot

Threat Scorecard

EnigmaSoft Threat Scorecard

File System Details

Registry Details

URLs

Submit Comment

Trending

'YouPorn' Email Scam

Safe Search Eng

Findtheirreport.com

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen