Home Malware Programs Trojans Trojan.Reveton.C

Trojan.Reveton.C

Posted: September 10, 2012

Threat Metric

Threat Level: 8/10
Infected PCs: 213
First Seen: September 10, 2012
Last Seen: April 12, 2022
OS(es) Affected: Windows

Trojan.Reveton.C is a Trojan that changes the web browser settings in order to connect to remote servers. Trojan.Reveton.C is installed on the compromised PC without the PC user's permission and knowledge. Trojan.Reveton.C targets all web browsers by injecting a malicious code into legitimate process files such as firefox.exe, iexplore.exe, chrome.exe, and opera.exe and successfully compromising them in order to evade detection and removal of anti-virus software from the PC. Trojan.Reveton.C creates the copy of itself as a shortcut fileTrojan.Reveton.C modifies the Windows Registry to disable the 'Protected mode is currently turned off for the Internet zone' message that is shown in Internet Explorer. Also, Trojan.Reveton.C locks the toolbar of Internet Explorer to block the user from undoing the changes. Trojan.Reveton.C connects to the certain IPs and domains and contacts the remote servers to execute it's payload. Once the connection is created, Trojan.Reveton.C affirms Internet connectivity and informs attackers that another computer has been hacked. Trojan.Reveton.C gets configuration data and fulfills a variety of malicious actions.

Aliases

Generic29.AWET [AVG]TR/Reveton.C.75 [AntiVir]Trojan-Ransom.Win32.Foreign.qki [Kaspersky]Generic29.BDKN [AVG]W32/Foreign.QLX!tr [Fortinet]TR/Reveton.C.87 [AntiVir]Trojan-Ransom.Win32.Foreign.qlx [Kaspersky]TrojanRansom.Foreign.qlx [CAT-QuickHeal]Generic29.AUSG [AVG]Trojan/Win32.Swisyn [AhnLab-V3]TR/Reveton.C.74 [AntiVir]Trojan-Ransom.Win32.Foreign.qkh [Kaspersky]Win32:Reveton-DX [Trj] [Avast]TrojanRansom.Foreign.qkh [CAT-QuickHeal]Ransomer.AHZ [AVG]
More aliases (208)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%USERPROFILE%\Local Settings\Application Data\mvy.exe File name: mvy.exe
Size: 308.22 KB (308224 bytes)
MD5: cf09f2bc5e3969fe1e59e49117723006
Detection count: 92
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Local Settings\Application Data
Group: Malware file
Last Updated: September 14, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\0_0u_l.exe File name: 0_0u_l.exe
Size: 179.87 KB (179872 bytes)
MD5: d424d30099bd740f347e00a992cd5c11
Detection count: 92
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: September 11, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\wgsdgsdgdsgsd.exe File name: wgsdgsdgdsgsd.exe
Size: 348.16 KB (348160 bytes)
MD5: d6fd99659342140e467077950176c2d6
Detection count: 30
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: March 1, 2013
%TEMP%\wgsdgsdgdsgsd.exe File name: wgsdgsdgdsgsd.exe
Size: 333.82 KB (333824 bytes)
MD5: a604352cd4688c5232e357a17b72ccb1
Detection count: 30
File type: Executable File
Mime Type: unknown/exe
Path: %TEMP%
Group: Malware file
Last Updated: October 5, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\wgsdgsdgdsgsd.exe File name: wgsdgsdgdsgsd.exe
Size: 334.84 KB (334848 bytes)
MD5: 18fb6c377458e52559b6044aed21b3f1
Detection count: 28
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: November 7, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\conhost.dll File name: conhost.dll
Size: 176.12 KB (176128 bytes)
MD5: 7708984c7c01a41098cba5b8854a604e
Detection count: 13
File type: Dynamic link library
Mime Type: unknown/dll
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: October 5, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\wgsdgsdgdsgsd.exe File name: wgsdgsdgdsgsd.exe
Size: 322.56 KB (322560 bytes)
MD5: 4339bd3eb67169e25a00e60e2cd9688a
Detection count: 12
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: February 6, 2013
%SystemDrive%\Users\<username>\AppData\Local\Temp\wgsdgsdgdsgsd.exe File name: wgsdgsdgdsgsd.exe
Size: 335.87 KB (335872 bytes)
MD5: 178c6fe1e0d1bda3b0a4345968e4f0af
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: September 25, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\wgsdgsdgdsgsd.exe File name: wgsdgsdgdsgsd.exe
Size: 313.34 KB (313344 bytes)
MD5: 6306ca18606277be257eb8db30e2590e
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: October 5, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\install_0_msi.exe File name: install_0_msi.exe
Size: 125.95 KB (125952 bytes)
MD5: afc96dde348c21c10d4cfa85587c2a2e
Detection count: 7
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: September 10, 2012
%SystemDrive%\Users\<username>\AppData\Local\Temp\wgsdgsdgdsgsd.exe File name: wgsdgsdgdsgsd.exe
Size: 155.64 KB (155648 bytes)
MD5: 25e4724a1fa36d91ea49d8622698d9e8
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Users\<username>\AppData\Local\Temp
Group: Malware file
Last Updated: September 17, 2012
Loading...