Trojan.Scar

The detection of Trojan.Scar indicates that your system has been compromised by a potentially malicious program. This type of threat is designed to infiltrate your computer and carry out unauthorized actions, often without your knowledge or consent. It's essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.

What Is Trojan.Scar?

Trojan.Scar is a type of malware that can compromise the security and integrity of your computer system. The name "Trojan" refers to the fact that this type of malware often disguises itself as a legitimate program or file, allowing it to bypass security measures and gain unauthorized access to your system. The ".Scar" suffix may indicate a specific variant or subtype of Trojan malware, but without further information, it's difficult to determine the exact characteristics of this threat.

How Trojan.Scar Operates

Trojan.Scar, like other types of Trojan malware, operates by exploiting vulnerabilities in your system or deceiving you into installing it. Once installed, it can carry out a variety of malicious actions, such as stealing sensitive information, installing additional malware, or providing unauthorized access to your system. Trojans can also be used to disrupt system operation, cause data loss, or create backdoors for further malicious activity.

Symptoms of Infection

Identifying a Trojan.Scar infection can be challenging, as it may not always exhibit obvious symptoms. However, some common indicators of a Trojan infection include unusual system behavior, such as slow performance, unexpected crashes, or unfamiliar programs running in the background. You may also notice suspicious network activity, unfamiliar icons or shortcuts, or unexpected changes to your system settings. If you suspect that your system has been compromised, it's crucial to take immediate action to remove the threat.

• Unexplained system crashes or freezes
• Slow system performance
• Unfamiliar programs or icons
• Suspicious network activity
• Unexpected changes to system settings

How to Remove Trojan.Scar

1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for internet access.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and identify any malicious files or programs.
3. Uninstall any suspicious programs or applications that may be related to the Trojan.Scar infection.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
5. Reboot your system and perform another full scan to ensure that the threat has been completely removed.

Conclusion

Removing Trojan.Scar from your system requires careful attention to detail and a thorough understanding of the threat. By following the steps outlined above and using reputable anti-malware tools, you can help protect your system from further damage and prevent the spread of this malicious program. Remember to always be cautious when installing new software or opening email attachments, and keep your operating system and security software up to date to reduce the risk of infection.

Analysis Report

General information

Family Name:	Trojan.Scar
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: dc60cedbe3be8c6b9543791029fcebf8 SHA1: 116a3f787beaf7a51365856428f13b2b00210eda SHA256: 32E7583984B57C5A6073BB58BCC66C3CC9E3256902A649B84BB1A78FE4384939 File Size: 276.83 KB, 276833 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

File Traits

• 2+ executable sections
• HighEntropy
• No Version Info
• vb6
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\dav rpc service	Generic Read,Write Data,Write Attributes,Write extended,Append data
\device\namedpipe\wkssvc	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	ᖴ쿥ㄠǝ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	㳤쿬ㄠǝ	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::updates	D:\Updates.exe	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\run::backup	D:\Backup.exe	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Other Suspicious	SetWindowsHookEx
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess WriteConsole
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Terminate	TerminateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

cmd /c reg add HKCU\software\microsoft\windows\currentversion\run /v Updates /t REG_SZ /d D:\Updates.exe /f

cmd /c reg add HKCU\software\microsoft\windows\currentversion\run /v Backup /t REG_SZ /d D:\Backup.exe /f

tskill reg

D:\Updates.exe

C:\WINDOWS\system32\reg.exe reg add HKCU\software\microsoft\windows\currentversion\run /v Updates /t REG_SZ /d D:\Updates.exe /f

Show More

WriteConsole: The operation co

C:\WINDOWS\system32\reg.exe reg add HKCU\software\microsoft\windows\currentversion\run /v Backup /t REG_SZ /d D:\Backup.exe /f

WriteConsole: The operation co