Backdoor.Korplug

Posted: July 2, 2012
Threat Metric
Threat Level: 6/10
Infected PCs 42

Backdoor.Korplug Description

The Korplug Trojan is a backdoor Trojan and spyware program that opens a backdoor on your computer (which may be used for various purposes, such as installing extra malware or updating the Korplug Trojan) while also implementing various information-stealing functions. Following shortly after the use of chemical weapons in Syria made headlines, the Korplug Trojan has been seen in spam e-mail messages that claim to be delivering some new information about the Syrian situation, with file attachments installing the Korplug Trojan while distracting their victims with stolen news articles. While SpywareRemove.com malware analysts warn that you've no one to blame but yourself if your computer is infected after you open a spammed e-mail file from an unconfirmed source, anti-malware software still should be able to detect and delete Korplug Trojan before any damage is done.

When the Presses Have Trojan Sneaking in Between Headlines

The Korplug Trojan is a backdoor Trojan that uses indiscriminately-targeted spam e-mail as its preferential transportation mode, with its file attachment disguised as a news article. Although this attachment, once launched, does open legitimate news article 'borrowed' from the Washington Post, it also installs the latest version of the Korplug Trojan. The Korplug Trojan may connect to any of a variety of separate C&C servers to receive instructions, download other malware, update itself or upload anything stolen from the infected computer. SpywareRemove.com malware experts also point out the Korplug Trojan's spyware functions that can be considered especially invasive:

  • The Korplug Trojan may take screenshots without your consent to capture data visually.
  • The Korplug Trojan may use keylogging attacks to record any information that you type to a log file.
  • The Korplug Trojan also may target and transfer various types of specific system information, such as details about your network setup (which criminals may use in future attacks).

These features are sufficiently flexible to allow the Korplug Trojan to steal private information from a range of different computers, including general Web accounts, FTP clients and bank accounts. The Korplug Trojan also is believed to be compatible with almost all versions of Windows up to at least Windows 7.

Plugging a Korplug Trojan Problem Back Up and Away from Your PC

Deleting spam e-mail messages immediately and regularly is the most direct way to stay out of any Korplug Trojan-related trouble. Competent anti-malware tools also should be able to detect the Korplug Trojan as harmful, if you bother to scan a file before opening it. However, SpywareRemove.com malware experts always advise against opening files from e-mail messages that haven't had their senders confirmed, since files transported in this fashion are some of the most popular infection vectors for Trojans to date.

While the Korplug Trojan attacks your computer, the Korplug Trojan does not show any especially evident symptoms. Without appropriate security software, detecting a Korplug Trojan infection is unlikely to be easy for anyone who isn't a PC security professional, even while the Korplug Trojan does its best to steal any personal information that the Korplug Trojan can grab.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Backdoor.Korplug may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



file.exe File name: file.exe
Size: 221.18 KB (221184 bytes)
MD5: 9641752497aa67d3912a5928ccf051df
Detection count: 85
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: July 4, 2012
1889.exe File name: 1889.exe
Size: 250.37 KB (250370 bytes)
MD5: 2263ad19cd270571617b5677d3e5652a
Detection count: 84
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: July 4, 2012
file.dll File name: file.dll
Size: 120.49 KB (120492 bytes)
MD5: 60da52a3709057b677d02cbe80cb0c87
Detection count: 43
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%UserProfile%\SxS\rcdll.dll File name: %UserProfile%\SxS\rcdll.dll
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
%UserProfile%\SxS\rc.exe File name: %UserProfile%\SxS\rc.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%UserProfile%\SxS\bug.log File name: %UserProfile%\SxS\bug.log
Mime Type: unknown/log
Group: Malware file
%UserProfile%\SxS\rc.hlp File name: %UserProfile%\SxS\rc.hlp
Mime Type: unknown/hlp
Group: Malware file

More files

Registry Modifications


The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SxSHKEY_LOCAL_MACHINE\SOFTWARE\Classes\FASTHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SXS

Related Posts

Home Malware Programs Backdoors Backdoor.Korplug

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.