Home Malware Programs Trojans Trojan.Spambot.11349

Trojan.Spambot.11349

Posted: May 24, 2012

Threat Metric

Ranking: 14,638
Threat Level: 8/10
Infected PCs: 400
First Seen: May 24, 2012
Last Seen: October 10, 2023
OS(es) Affected: Windows

Trojan.Spambot.11349 is a Trojan that infects the targeted PC system via security loopholes and unsafe downloads. Trojan.Spambot.11349 can also infect the computer system via malicious spam email attachments and bogus video media codecs. Once installed, Trojan.Spambot.11349 creates the certain files on the PC system. Trojan.Spambot.11349 can also delete particular files on the infected computer. Trojan.Spambot.11349 replaces the HOSTS file. Trojan.Spambot.11349 modifies the Windows registry by changing some registry keys. To avoid firewall, Trojan.Spambot.11349 removes or modifies the particular registry keys.

Aliases

Trj/CI.A [Panda]Generic32.CKRP [AVG]Dropper/Win32.Injector [AhnLab-V3]Heuristic.LooksLike.Win32.Suspicious.B [McAfee-GW-Edition]Trojan-Dropper.Win32.Injector.idwe [Kaspersky]PWS-Zbot-FAQD!072419361172 [McAfee]W32/Jorik.CTPG!tr [Fortinet]Heur.Suspicious [Comodo]Trojan-Ransom.Win32.PornoAsset.cfbu [Kaspersky]WS.Reputation.1 [Symantec]PWS-Zbot-FAQD!B9521019D1DC [McAfee]Suspicious file [Panda]Generic28.BTNU [AVG]W32/Kryptik.WDV!tr [Fortinet]Packed.Win32.Krap [Ikarus]
More aliases (32)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



ferest1.tmp File name: ferest1.tmp
Size: 176.23 KB (176239 bytes)
MD5: 4cb4d565fbd459a0da0b3c42c09dd5d7
Detection count: 60
File type: Temporary File
Mime Type: unknown/tmp
Group: Malware file
Last Updated: June 20, 2012
file.exe File name: file.exe
Size: 109.53 KB (109536 bytes)
MD5: 107ce3a3c1d14b256a392ef48136ce6b
Detection count: 56
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 20, 2012
file.exe File name: file.exe
Size: 109.53 KB (109536 bytes)
MD5: 41a0b12f348bb7e3c487e9efaa6dc9a8
Detection count: 55
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 20, 2012
%USERPROFILE%\qokozypkabaq.exe File name: qokozypkabaq.exe
Size: 86.14 KB (86141 bytes)
MD5: b9521019d1dcbedd8eee170c7219ac20
Detection count: 42
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%
Group: Malware file
Last Updated: May 1, 2013
%SYSTEMDRIVE%\Users\<username>\Desktop\a trubsil spambot.exe\file.exe File name: file.exe
Size: 417.28 KB (417280 bytes)
MD5: 9342dc72e9b7597d1a7ff2c80eeda966
Detection count: 23
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\Desktop\a trubsil spambot.exe
Group: Malware file
Last Updated: June 26, 2020
file.exe File name: file.exe
Size: 418.33 KB (418330 bytes)
MD5: e1d9f25fddbd348e15bf54d2fa974f91
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: February 9, 2022
%AppData%\ntuser.dat File name: %AppData%\ntuser.dat
File type: Data file
Mime Type: unknown/dat
Group: Malware file
%AppData%\desktop.ini File name: %AppData%\desktop.ini
Mime Type: unknown/ini
Group: Malware file

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List '%APPDATA%\x3ctnjmbqssceevmcdfs2pzhzy3sknhv2\svcnost.exe' = '%APPDATA%\x3ctnjmbqssceevmcdfs2pzhzy3sknhv2\svcnost.exe:*:EnaHKEY_CURRENT_USER>\Software\Microsoft\Windows\CurrentVersion\Run 'Windows Init'= '"%APPDATA%\x3ctnjmbqssceevmcdfs2pzhzy3sknhv2\svcnost.exe"'HKEY..\..\..\..{RegistryKeys}SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\purplefeather.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Run\PurpleFeather

Additional Information

The following directories were created:
%APPDATA%\PurpleFeather
Loading...