Home Malware Programs Trojans Trojan.Ascesso.B

Trojan.Ascesso.B

Posted: August 3, 2012

Threat Metric

Threat Level: 9/10
Infected PCs: 30
First Seen: August 3, 2012
Last Seen: July 14, 2023
OS(es) Affected: Windows

Trojan.Ascesso.B is a Trojan that sends spam emails and downloads malicious files from a remote location. Once executed, Trojan.Ascesso.B creates several registry entries on the affected computer. Trojan.Ascesso.B also creates a certain registry entry to block Windows from shutting down appropriately. Trojan.Ascesso.B contacts a randomly created domain name and downloads several files to the certain location and runs them. Trojan.Ascesso.B steals data from the infected computer and transmits it to the remote command-and-control (C&C) server.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%System%\drivers\usbhc.sys File name: %System%\drivers\usbhc.sys
File type: System file
Mime Type: unknown/sys
Group: Malware file
%Windir%\system32\kb[RANDOM CHARACTERS].exe File name: %Windir%\system32\kb[RANDOM CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\"CleanShutdown" = "0"HKEY_LOCAL_MACHINE\SECURITY\RXACT\"Log" = "[BINARY DATA]"HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhc
Loading...