Home Malware Programs Trojans Aspam

Aspam

Posted: March 28, 2006

The Aspam trojan allows the remote attacker to gain control over a compromised computer. The spyware arrives in executable file attached to a spoofed e-mail message, which is disguised as a letter from Microsoft Corporation. The letter contains information about spam and describes the attached file as a useful anti-spam tool. Once the user executes a file, the trojan silently installs itself to the computer. It automatically runs on every Windows startup.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 amcis32.dll
    2 aspam.exe
    3 drvman32.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINESOFTWAREClassesAMCIS32.IEClassHKEY_LOCAL_MACHINESOFTWAREClassesDRVMAN32.IEClass
  • The following CLSID's were detected:
    HKEY..\..\{CLSID Path}657B9354-BB3B-4500-A9B0-109B4FA64815499DB658-1909-420B-931A-4A8CAEFD232F

Related Posts

Loading...