W32.Craq

By GoldSparrow in Worms

Threat Scorecard

Ranking:	5,036
Threat Level:	10 % (Normal)
Infected Computers:	531

First Seen:	April 4, 2014
Last Seen:	September 20, 2023
OS(es) Affected:	Windows

W32.Craq is a worm that proliferates through removable drives using the potentially infected files. W32.Craq may open a back door and steal information on the compromised PC. Upon execution, W32.Craq creates the potentially infected files. W32.Craq then creates the registry entries. W32.Craq looks for executable files in the %ProgramFiles% and %UserProfile%/Application Data/ directories and the subfolders within the specific directories. W32.Craq then replicates itself using the file name of the executable files that it finds under the particular format. W32.Craq then connects to one of several distant locations. W32.Craq may carry out the potentially harmful activities on the attacked PC such as show PNG files, log keystrokes, capture screenshots, undertake FTP operations, send emails, search for keywords in files, collect clipboard content and information on open windows, close windows and kill processes and reboot the computer.

Table of Contents

File System Details

W32.Craq may create the following file(s):

Expand All | Collapse All

#	File Name	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	%Windir%\Tasks\At[ONE NUMBER].job
Name: %Windir%\Tasks\At[ONE NUMBER].job Group: Malware file
2.	%Windir%\winlogz.log
Name: %Windir%\winlogz.log Group: Malware file
3.	%Temp%\updatems.exe
Name: %Temp%\updatems.exe Type: Executable File Group: Malware file
4.	%Windir%\w1sv32[ONE RANDOM LOWERCASE LETTER FROM 'e' TO 'n'].dll
Name: %Windir%\w1sv32[ONE RANDOM LOWERCASE LETTER FROM 'e' TO 'n'].dll Type: Dynamic link library Group: Malware file
5.	%System%\w1sv32[ONE RANDOM LOWERCASE LETTER FROM 'e' TO 'n'].dll
Name: %System%\w1sv32[ONE RANDOM LOWERCASE LETTER FROM 'e' TO 'n'].dll Type: Dynamic link library Group: Malware file
6.	%UserProfile%\Local Settings\Temp\w1sv32[ONE RANDOM LOWERCASE LETTER FROM 'e' TO 'n'].dll
Name: %UserProfile%\Local Settings\Temp\w1sv32[ONE RANDOM LOWERCASE LETTER FROM 'e' TO 'n'].dll Type: Dynamic link library Group: Malware file
7.	%Temp%\w1sv32[ONE RANDOM LOWERCASE LETTER FROM 'e' TO 'n'].dll
Name: %Temp%\w1sv32[ONE RANDOM LOWERCASE LETTER FROM 'e' TO 'n'].dll Type: Dynamic link library Group: Malware file
8.	%UserProfile%\Application Data\skype\update.exe
Name: %UserProfile%\Application Data\skype\update.exe Type: Executable File Group: Malware file
9.	%UserProfile%\Application Data\google\update.exe
Name: %UserProfile%\Application Data\google\update.exe Type: Executable File Group: Malware file
10.	%UserProfile%\Application Data\java\update.exe
Name: %UserProfile%\Application Data\java\update.exe Type: Executable File Group: Malware file
11.	%UserProfile%\Application Data\quicktime\Qtupdate.exe
Name: %UserProfile%\Application Data\quicktime\Qtupdate.exe Type: Executable File Group: Malware file
12.	%UserProfile%\Application Data\yahoo\YahooUpdate.exe
Name: %UserProfile%\Application Data\yahoo\YahooUpdate.exe Type: Executable File Group: Malware file
13.	%UserProfile%\Application Data\Internet Explorer\iexplorer.exe
Name: %UserProfile%\Application Data\Internet Explorer\iexplorer.exe Type: Executable File Group: Malware file
14.	%UserProfile%\Application Data\Internet Explorer\ieinstaller.exe
Name: %UserProfile%\Application Data\Internet Explorer\ieinstaller.exe Type: Executable File Group: Malware file
15.	%UserProfile%\Application Data\chrome\update.exe
Name: %UserProfile%\Application Data\chrome\update.exe Type: Executable File Group: Malware file
16.	%UserProfile%\Application Data\firefox\update.exe
Name: %UserProfile%\Application Data\firefox\update.exe Type: Executable File Group: Malware file
17.	%ProgramFiles%\skype\update.exe
Name: %ProgramFiles%\skype\update.exe Type: Executable File Group: Malware file
18.	%ProgramFiles%\google\update.exe
Name: %ProgramFiles%\google\update.exe Type: Executable File Group: Malware file
19.	%ProgramFiles%\java\update.exe
Name: %ProgramFiles%\java\update.exe Type: Executable File Group: Malware file
20.	%ProgramFiles%\yahoo\YahooUpdate.exe
Name: %ProgramFiles%\yahoo\YahooUpdate.exe Type: Executable File Group: Malware file
21.	%ProgramFiles%\quicktime\Qtupdate.exe
Name: %ProgramFiles%\quicktime\Qtupdate.exe Type: Executable File Group: Malware file
22.	%ProgramFiles%\Internet Explorer\iexplorer.exe
Name: %ProgramFiles%\Internet Explorer\iexplorer.exe Type: Executable File Group: Malware file
23.	%ProgramFiles%\Internet Explorer\ieinstaller.exe
Name: %ProgramFiles%\Internet Explorer\ieinstaller.exe Type: Executable File Group: Malware file
24.	%ProgramFiles%\chrome\update.exe
Name: %ProgramFiles%\chrome\update.exe Type: Executable File Group: Malware file
25.	%ProgramFiles%\firefox\update.exe
Name: %ProgramFiles%\firefox\update.exe Type: Executable File Group: Malware file
26.	%DriveLetter%\recycler\files.ico
Name: %DriveLetter%\recycler\files.ico Group: Malware file
27.	%DriveLetter%\recycler\Setup.exe
Name: %DriveLetter%\recycler\Setup.exe Type: Executable File Group: Malware file
28.	%DriveLetter%\Autorun.inf
Name: %DriveLetter%\Autorun.inf Group: Malware file

Registry Details

W32.Craq may create the following registry entry or registry entries:

HKEY..\..\{CLSID Path}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\"ConsentPromptBehaviorAdmin" = "0"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\"EnableLUA" = "0"

URLs

W32.Craq may call the following URLs:

Maria.00freehost.com/configpub

Nadamohammed.tripod.com/configpub

Squirk0.tripod.com/configpub

fileconvertertab.com

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

W32.Craq

Threat Scorecard

EnigmaSoft Threat Scorecard

File System Details

Registry Details

URLs

Submit Comment

Trending

'YouPorn' Email Scam

Safe Search Eng

Findtheirreport.com

Most Viewed

Is Lookmovie.io Safe?

How To Fix 'Printer Driver is Unavailable' Error

Discord Shows Black Screen when Sharing Screen