Vosteran

By GoldSparrow in Trojans

Threat Scorecard

Ranking:	1,762
Threat Level:	50 % (Medium)
Infected Computers:	73,417

First Seen:	October 13, 2014
Last Seen:	September 20, 2023
OS(es) Affected:	Windows

The Vosteran malware should not be mistaken for the Vosteran.com browser hijacker because they differ greatly. While the Vosteran.com browser hijacker may cause annoyance and load several tabs with promotions in your browser, the Vosteran malware may prevent users from accessing their desktop at all times. Security experts report that the Vosteran Trojan may be deployed to users by means of free software packages and fake updates for Google Chrome. Some experts use the tag Deep Vosteran to distinguish the Trojan from the browser hijacker mentioned above. The Vosteran Trojan is a severe threat that is similar to Sirefef, Basutra and Ircbrute that upon infection may initiate a restart on the victim's PC automatically. Moreover, the Vosteran Trojan may substitute the installations of Google Chrome with a corrupted version of the Google's browser that might be listed in the 'Programs and Features' panel as Vosteran.

Deep Vosteran may install other programs like WS_Vosteran, Arcade Giant and StormWatch that are recognized as adware and might use your system resources for Bitcoin mining and cloud-computing. The corrupted Vosteran browser seems to serve one purpose—that is to show numerous advertisements. Also, the Vosteran browser may become the default Internet client of users that are infected with the Deep Vosteran malware. The Vosteran Trojan may write several registry keys to cement its infiltration, welcome users to browse the Internet without protection and display advertisements to earn affiliate marketing revenue for its creators.

In many cases, the Deep Vosteran malware may disable the taskbar of the Windows systems and load the Vosteran browser during system startup to direct users to sponsored websites and wait for users to input their credit card data. The disappearance of your Taskbar should be enough for you to abstain from using the corrupted browser associated with the Deep Vosteran malware. Security experts note that bootable USBs and rescue disks may not help users to remove the Vosteran Trojan. The proper strategy to follow when addressing the Vosteran malware is to install a reputable anti-malware utility and run a security scan.

Table of Contents

SpyHunter Detects & Remove Vosteran

File System Details

Vosteran may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	bkup.dat	1f032b23dadb1e50c84beef698d49713	55
Name: bkup.dat MD5: 1f032b23dadb1e50c84beef698d49713 Size: 17.47 KB (17474 bytes) Detections: 55 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
2.	UpdateTask.exe	81714713107c861bdecb16ff5e150763	55
Name: UpdateTask.exe MD5: 81714713107c861bdecb16ff5e150763 Size: 450.56 KB (450560 bytes) Detections: 55 Type: Executable File Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: September 14, 2017
3.	UpdateTask.exe	1e6eca0bc6a58c9dac3dd93628228080	45
Name: UpdateTask.exe MD5: 1e6eca0bc6a58c9dac3dd93628228080 Size: 475.64 KB (475648 bytes) Detections: 45 Type: Executable File Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: September 14, 2017
4.	bkup.dat	9bb829d43653349012133f5c13479436	41
Name: bkup.dat MD5: 9bb829d43653349012133f5c13479436 Size: 18.27 KB (18275 bytes) Detections: 41 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
5.	bkup.dat	606b76ec1bc1c07dc2225631df15c234	28
Name: bkup.dat MD5: 606b76ec1bc1c07dc2225631df15c234 Size: 18.26 KB (18269 bytes) Detections: 28 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
6.	bkup.dat	a109c316b7d28ce552cd4a79bc47fb68	28
Name: bkup.dat MD5: a109c316b7d28ce552cd4a79bc47fb68 Size: 19.37 KB (19379 bytes) Detections: 28 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
7.	UpdateTask.exe	e2d3fb36651c0e44f1174da387fa52bf	22
Name: UpdateTask.exe MD5: e2d3fb36651c0e44f1174da387fa52bf Size: 427 KB (427008 bytes) Detections: 22 Type: Executable File Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: September 14, 2017
8.	bkup.dat	6224f3ab10246c76ee37bb2f6d64c8d4	21
Name: bkup.dat MD5: 6224f3ab10246c76ee37bb2f6d64c8d4 Size: 17.16 KB (17165 bytes) Detections: 21 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
9.	bkup.dat	1db2c76685ab9be965a623ea52cf3d0d	19
Name: bkup.dat MD5: 1db2c76685ab9be965a623ea52cf3d0d Size: 19.82 KB (19825 bytes) Detections: 19 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
10.	bkup.dat	9d5e0f13243766e6d11d1a0a1460755a	18
Name: bkup.dat MD5: 9d5e0f13243766e6d11d1a0a1460755a Size: 16.35 KB (16355 bytes) Detections: 18 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
11.	bkup.dat	b8e05d78a75eadf2cad33f5ae8675040	13
Name: bkup.dat MD5: b8e05d78a75eadf2cad33f5ae8675040 Size: 18.64 KB (18647 bytes) Detections: 13 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
12.	bkup.dat	318948ab544a9b45916c205c98093e9e	13
Name: bkup.dat MD5: 318948ab544a9b45916c205c98093e9e Size: 16.7 KB (16704 bytes) Detections: 13 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
13.	bkup.dat	2ee57463815b90bc8babdc57f4d3aa73	12
Name: bkup.dat MD5: 2ee57463815b90bc8babdc57f4d3aa73 Size: 17.32 KB (17327 bytes) Detections: 12 Type: Data file Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: July 7, 2017
14.	UpdateTask.exe	6695bc2a98d91d49386af14d52d0e9a2	11
Name: UpdateTask.exe MD5: 6695bc2a98d91d49386af14d52d0e9a2 Size: 500.41 KB (500417 bytes) Detections: 11 Type: Executable File Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: March 22, 2016
15.	UpdateTask.exe	d489605d403867b778fe55728481029d	10
Name: UpdateTask.exe MD5: d489605d403867b778fe55728481029d Size: 517.97 KB (517978 bytes) Detections: 10 Type: Executable File Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: March 22, 2016
16.	UpdateTask.exe	6311c9f5fdb5a5c300084f353b39ea77	9
Name: UpdateTask.exe MD5: 6311c9f5fdb5a5c300084f353b39ea77 Size: 517.99 KB (517991 bytes) Detections: 9 Type: Executable File Path: %SystemDrive%\Users\<username>\AppData\Roaming\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: March 22, 2016
17.	UpdateTask.exe	2ca746ce57e7eb879c82ee25399496c2	8
Name: UpdateTask.exe MD5: 2ca746ce57e7eb879c82ee25399496c2 Size: 500.95 KB (500958 bytes) Detections: 8 Type: Executable File Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: March 22, 2016
18.	UpdateTask.exe	a8540eda05b58ac73e2ef6983f1a20cb	6
Name: UpdateTask.exe MD5: a8540eda05b58ac73e2ef6983f1a20cb Size: 517.73 KB (517736 bytes) Detections: 6 Type: Executable File Path: %APPDATA%\WSE_Vosteran\UpdateProc Group: Malware file Last Updated: March 22, 2016
19.	vosteran.exe	9b986c9f99a099605471b05e1fadf61f	4
Name: vosteran.exe MD5: 9b986c9f99a099605471b05e1fadf61f Size: 2.12 MB (2128384 bytes) Detections: 4 Type: Executable File Path: %LOCALAPPDATA%\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
20.	vosteran.exe	ae8f905d39ca149695accaca6864db25	3
Name: vosteran.exe MD5: ae8f905d39ca149695accaca6864db25 Size: 1.01 MB (1014272 bytes) Detections: 3 Type: Executable File Path: %LOCALAPPDATA%\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
21.	vosteran.exe	123f683c6e79bc559f95e863a241a398	2
Name: vosteran.exe MD5: 123f683c6e79bc559f95e863a241a398 Size: 1.08 MB (1083904 bytes) Detections: 2 Type: Executable File Path: %USERPROFILE%\Local Settings\Application Data\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
22.	vosteran.exe	f20f903560666166700da7726b8dcc98	2
Name: vosteran.exe MD5: f20f903560666166700da7726b8dcc98 Size: 1.12 MB (1124334 bytes) Detections: 2 Type: Executable File Path: %USERPROFILE%\Local Settings\Application Data\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
23.	vosteran.exe	4f570dc695159d5a895d78ed0b0174ee	1
Name: vosteran.exe MD5: 4f570dc695159d5a895d78ed0b0174ee Size: 1.15 MB (1152927 bytes) Detections: 1 Type: Executable File Path: %LOCALAPPDATA%\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
24.	vosteran.exe	90ff41413233cb0f101edfc5d42794cd	1
Name: vosteran.exe MD5: 90ff41413233cb0f101edfc5d42794cd Size: 1.07 MB (1072128 bytes) Detections: 1 Type: Executable File Path: %LOCALAPPDATA%\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
25.	vosteran.exe	b2914b18c9c179fff894e42544b64e8c	1
Name: vosteran.exe MD5: b2914b18c9c179fff894e42544b64e8c Size: 1.19 MB (1191902 bytes) Detections: 1 Type: Executable File Path: %LOCALAPPDATA%\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
26.	vosteran.exe	6253b94773983ec33085b19c111183ed	1
Name: vosteran.exe MD5: 6253b94773983ec33085b19c111183ed Size: 3.24 MB (3242496 bytes) Detections: 1 Type: Executable File Path: %LOCALAPPDATA%\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
27.	vosteran.exe	80326c7c52d474dfc2586f3d0287fc24	1
Name: vosteran.exe MD5: 80326c7c52d474dfc2586f3d0287fc24 Size: 1.04 MB (1041920 bytes) Detections: 1 Type: Executable File Path: %LOCALAPPDATA%\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
28.	vosteran.exe	dc5bc01095d32e9409fbd82c09721378	1
Name: vosteran.exe MD5: dc5bc01095d32e9409fbd82c09721378 Size: 1.31 MB (1311619 bytes) Detections: 1 Type: Executable File Path: %LOCALAPPDATA%\Vosteran\Application Group: Malware file Last Updated: March 19, 2016
29.	wow_helper.exe
Name: wow_helper.exe Type: Executable File Group: Malware file
30.	C:\Users\\appdata\local\vosteran\application\vosteran.exe	944a91af08bbed92bd0abc81203042a9
Name: C:\Users\<username>\appdata\local\vosteran\application\vosteran.exe MD5: 944a91af08bbed92bd0abc81203042a9 Type: Executable File Group: Malware file
31.	"C:\Users\\appdata\Local\Vosteran\Application\31.0.1650.23\Installer\setup.exe" --uninstall
Name: "C:\Users\<username>\appdata\Local\Vosteran\Application\31.0.1650.23\Installer\setup.exe" --uninstall Group: Malware file
32.	chrome.dll
Name: chrome.dll Type: Dynamic link library Group: Malware file
33.	chrome_child.dll
Name: chrome_child.dll Type: Dynamic link library Group: Malware file
34.	npchrome_frame.dll
Name: npchrome_frame.dll Type: Dynamic link library Group: Malware file
35.	am.dll
Name: am.dll Type: Dynamic link library Group: Malware file
36.	ar.dll
Name: ar.dll Type: Dynamic link library Group: Malware file
37.	bg.dll
Name: bg.dll Type: Dynamic link library Group: Malware file
38.	bn.dll
Name: bn.dll Type: Dynamic link library Group: Malware file
39.	ca.dll
Name: ca.dll Type: Dynamic link library Group: Malware file
40.	chrome_frame_helper.dll
Name: chrome_frame_helper.dll Type: Dynamic link library Group: Malware file
41.	chrome_frame_helper.exe
Name: chrome_frame_helper.exe Type: Executable File Group: Malware file
42.	chrome_launcher.exe
Name: chrome_launcher.exe Type: Executable File Group: Malware file
43.	cs.dll
Name: cs.dll Type: Dynamic link library Group: Malware file
44.	d3dcompiler_46.dll
Name: d3dcompiler_46.dll Type: Dynamic link library Group: Malware file
45.	da.dll
Name: da.dll Type: Dynamic link library Group: Malware file
46.	de.dll
Name: de.dll Type: Dynamic link library Group: Malware file
47.	delegate_execute.exe
Name: delegate_execute.exe Type: Executable File Group: Malware file
48.	el.dll
Name: el.dll Type: Dynamic link library Group: Malware file
49.	en-GB.dll
Name: en-GB.dll Type: Dynamic link library Group: Malware file
50.	en-US.dll
Name: en-US.dll Type: Dynamic link library Group: Malware file
51.	es.dll
Name: es.dll Type: Dynamic link library Group: Malware file
52.	es-419.dll
Name: es-419.dll Type: Dynamic link library Group: Malware file
53.	et.dll
Name: et.dll Type: Dynamic link library Group: Malware file
54.	fa.dll
Name: fa.dll Type: Dynamic link library Group: Malware file
55.	ffmpegsumo.dll
Name: ffmpegsumo.dll Type: Dynamic link library Group: Malware file
56.	fi.dll
Name: fi.dll Type: Dynamic link library Group: Malware file
57.	fil.dll
Name: fil.dll Type: Dynamic link library Group: Malware file
58.	fr.dll
Name: fr.dll Type: Dynamic link library Group: Malware file
59.	gu.dll
Name: gu.dll Type: Dynamic link library Group: Malware file
60.	he.dll
Name: he.dll Type: Dynamic link library Group: Malware file
61.	hi.dll
Name: hi.dll Type: Dynamic link library Group: Malware file
62.	hr.dll
Name: hr.dll Type: Dynamic link library Group: Malware file
63.	icudt.dll
Name: icudt.dll Type: Dynamic link library Group: Malware file
64.	id.dll
Name: id.dll Type: Dynamic link library Group: Malware file
65.	it.dll
Name: it.dll Type: Dynamic link library Group: Malware file
66.	ja.dll
Name: ja.dll Type: Dynamic link library Group: Malware file
67.	kn.dll
Name: kn.dll Type: Dynamic link library Group: Malware file
68.	libegl.dll
Name: libegl.dll Type: Dynamic link library Group: Malware file
69.	libglesv2.dll
Name: libglesv2.dll Type: Dynamic link library Group: Malware file
70.	metro_driver.dll
Name: metro_driver.dll Type: Dynamic link library Group: Malware file
71.	nacl64.exe
Name: nacl64.exe Type: Executable File Group: Malware file
72.	ppgooglenaclpluginchrome.dll
Name: ppgooglenaclpluginchrome.dll Type: Dynamic link library Group: Malware file
73.	hu.dll
Name: hu.dll Type: Dynamic link library Group: Malware file

More files

Registry Details

Vosteran may create the following registry entry or registry entries:

CLSID

{0A6B3C37-2EC3-508F-435B-7567673389FF}

{4CB3598A-82E8-4D1F-983F-061238AE696E}

File name without path

Vosteran.lnk

HKEY..\..\..\..{RegistryKeys}

Software\Microsoft\Internet Explorer\DOMStorage\vosteran.com

Software\Microsoft\Internet Explorer\SearchScopes\{9E20EB26-0B53-4159-9FC6-F2ACA85DF167}

SOFTWARE\Microsoft\MediaPlayer\ShimInclusionList\vosteran.exe

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\WSE_Vosteran

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\vosteran.exe

Software\Microsoft\Windows\CurrentVersion\RunOnce\WSE_Vosteran

SOFTWARE\RegisteredApplications\Vosteran.NSJA6BHDA3NCFCFMXW3QSCUYUQ

Software\Vosteran

Software\Vosteran Browser

SOFTWARE\Wow6432Node\Microsoft\MediaPlayer\ShimInclusionList\vosteran.exe

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\vosteran.exe

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\WSE_Vosteran

SOFTWARE\Wow6432Node\RegisteredApplications\Vosteran.NSJA6BHDA3NCFCFMXW3QSCUYUQ

Software\wse_vosteran

HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}

http://vosteran.com/?a=&q

Vosteran

WSE_Vosteran

Directories

Vosteran may create the following directory or directories:

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Vosteran

%APPDATA%\Vosteran

%APPDATA%\WSE_Vosteran

%LOCALAPPDATA%\Vosteran

%PROGRAMFILES%\WSE_Vosteran

%PROGRAMFILES(x86)%\WSE_Vosteran

%UserProfile%\Local Settings\Application Data\Vosteran

URLs

Vosteran may call the following URLs:

http://vosteran.com/?

http://vosteran.com/?a=&q

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Vosteran

Threat Scorecard

EnigmaSoft Threat Scorecard

SpyHunter Detects & Remove Vosteran

File System Details

Registry Details

Directories

URLs

Submit Comment

Related Posts

Vosteran.com

Trending

'YouPorn' Email Scam

Safe Search Eng

Findtheirreport.com

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen