Posted: February 27, 2015
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
|First Seen:||February 27, 2015|
|Last Seen:||May 4, 2021|
Chanitor is a Trojan downloader whose campaigns frequently use fraudulent e-mail messages for distribution, and enable the installation of other threats, such as banking Trojans. As of its latest campaign, malware experts have verified a degree of personalization in Chanitor attacks, which may include reference information and use disguises associated with Microsoft or other, equally legitimate companies. Windows users, especially those on corporate networks, should be cautious of potential messages that redirect to attack sites, and delete Chanitor with anti-malware tools, as per the usual protocols.
When Microsoft Services Turn into Trojans
Trojan downloaders may be the intermediaries in threat campaigns; being served by initial attacks, and then serving other threats, in turn, to the compromised PC. Chanitor keeps to this traditional role of a threat while using disguises meant to fool business employees interested in Microsoft's VLSC products. Typical Chanitor attacks begin with specially-crafted e-mails purporting to be from Microsoft, including custom-made links for the targeted victim. The internal message text also includes personal references, such as employee names and e-mail addresses.
Clicking the supposed 'Microsoft.com' URL redirects the victim to a fake page for the Volume Licensing Service Center. Malware experts can confirm at least four variants of this WordPress-based domain. Although the people responsible designed this page to look identical to that of its real Microsoft counterpart, the download URL for Chanitor's installer (a ZIP file) uses an inappropriate host server.
Other disguises seen in use by Chanitor include fake invoices, fax messages and package delivery notifications. All of these tactics are common to e-mail attacks and, in many cases, attacks against specific corporate employees.
With its installation finished, Chanitor then automatically downloads and installs other threatening software of a variable nature. Malware experts can particularly point to the likelihood of Chanitor's distributing spyware, backdoor Trojans and similar threats meant to enact large security vulnerabilities or collect data. However, Chanitor doesn't distribute itself to other networks, devices or machines automatically, unlike the worms that are common to some corporate espionage attacks.
How Chanitor Breaks the Sandbox
In most respects, Chanitor is a traditional Trojan performing a traditional role in its threat campaigns. However, malware experts also took note of Chanitor's using exceptional steps to prevent itself from being analyzed by various security companies. Chanitor automatically detects sandbox environments and terminates itself in a matter of seconds, without delivering its payload. A Sleep Mode feature also could allow Chanitor to disable itself temporarily, before potentially resuming its activities after the removal of any interfering security processes. Even its network traffic uses TOR (formerly 'the Onion Router'), an anonymity service.
Chanitor also includes several methods of preventing PC users from identifying Chanitor as a threat and deleting it, including using different file names and copying its components. Although anti-malware products and features remain your best defense against Chanitor, a majority of PC security companies haven't developed threat entries for this Trojan. Removing Chanitor may require updates to your anti-malware tools or additional steps for removing the other threat installed.
Use SpyHunter to Detect and Remove PC Threats
If you are concerned that malware or PC threats similar to Chanitor may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.Download SpyHunter's Malware Scanner*
Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.